Ask HN: Online backup without a computer? - <AUTHOR>

I'm going to be travelling for about 3 months, and won't be taking my laptop with me. My technology will largely be restricted to a camera with a 4GB SD card, an iPod touch, and a 250GB USB HD. My plan is to dump my photos from the camera to the HD at such times as I get access to a computer, but I don't like that being a SPOF, so I'd really like an online backup too.
I can, of course, carry software on the HD that could be installed temporarily on computers I'm using in order to manage this, but I'd like to minimise the amount of hoops I'll need to jump through at each location (i.e. installing Cygwin everywhere to run rsync isn't really an option!)
I have my own server that I can upload to, but I'm also open to software that stores data on S3 or wherever (this will hopefully be write once, read never!)
Suggestions?
(Alternatives also welcome, e.g. "Don't bother with online backup: just carry a couple of extra SD cards and backup to those", but online backup has the added benefit of being more resistant to everything getting stolen / destroyed when I fall into a lake / whatever) <comment><USER2> Why not just use FTP?

Set up your camera to save the photos to in different folders based on date, then just get some web space, go to ftp://yoursite/ and drag&drop the photos.

It's low tech, but it's almost guaranteed to work from anywhere, and you're less likely to get kicked out for "hacking" when you don't have a cygwin terminal open.

<comment><AUTHOR> I'd rather have something that can work out what I've already uploaded (and ideally with partial file resume) so that I don't have to keep track of everything myself. I probably won't always have good enough upload bandwidth to be able to always catch up in one session, so just organising by date isn't ideal. But it's not too much hassle to just keep Uploaded/NotUploaded folders locally and move things when done, so this is probably the fallback position.

What's a good SCP/FTP-over-SSH client for Windows? Filezilla seems to work OK, but is a little clunky (on the Mac, anyhow. I don't have a windows machine to hand to test it on)

<comment><USER3> The best SCP/FTP-over-SSH client for Windows I've encountered is WinSCP (<http://winscp.net/eng/index.php>).

It comes in a standalone install-nothing flavour and lets you choose, when copying a group of files from A to B, to only copy files that have changed.

I'm not aware of what algorithm is used to determine when a file has changed. I've always assumed this is based on file modification time so this might not be clever enough to spot a partially-uploaded file and either re-copy or start from where it left off.

You can certainly pause file transfers and subsequently resume but only during a session.

</comment></comment></comment><comment><USER4> Consider using Dropbox (A YC startup).

<https://www.getdropbox.com/>

You can get 2gb for free, or pay for more if you need it. If you need more than you're able to pay for, you could have a home PC syncing the stuff to another location and removing the original to free up the space.

<comment><AUTHOR> I've played with Dropbox before, so it's an option, although I'd prefer something with finer granularity of pricing. I'll probably need more than 2GB, but unlikely to need more than 10, so jumping straight to 50 is quite a leap.

I also got the impression that Dropbox doesn't cope so well with being run from a different computer every day, and would want to sync all my existing stored files down onto the computer I happen to be using that day, which isn't so good. And AIUI I'd need to make double-double-sure I'd uninstalled it from each when I was done, and notify Dropbox that this machine is no longer active etc. But I admit I haven't dug too deeply into all that yet.

<comment><USER5> Couldn't you have the dropbox folder as a folder on your removable drive, removing the need for syncing every time?

</comment></comment></comment><comment><USER6> Just buy more SD cards. They are cheap and you can pack a lot of them into the space taken by HDD. And you won't have to look for a PC with internet.

<comment><USER7> A 4GB card at retail, 5 months ago, was $7. How many pictures do you think you'll be taking? 16GB should be plenty of space.

<comment><AUTHOR> Interesting question. I really should have worked that out already :)

The current plan involves being in about 20 countries over the course of just under 3 months. So let's say 90 days x 50-100 photos per day x 2-3MB per picture. That gives somewhere in the region of 16GB right there; with backup, twice that. And that's probably on the low side.

Hmmm. I'm going to need more space (and more upload bandwidth) than I thought!

</comment></comment></comment><comment><USER8> I've never set up Cygwin on a USB drive, and then tried to transport it between computers, but that's the first thing I'd try.

Then you could write a simple script to do an rsync-over-ssh to your server, and just run it directly from the USB drive.

It would probably be best to test it on at least both Vista and XP systems, to make sure it works.

I'd use ssh keys, so that you don't have to worry about keystroke logging. You could also make a user for it on your server side, and lock it down to just allow the rsync in.

Look into the '--link-dest' option to rsync, this allows you to really easily do incremental backups, each time you backup your new backup directory has all the files in it, but any files that haven't changed are hardlinked to the previous version, so you don't take up much disk space. Really, really cool.

<comment><AUTHOR> I think the Cygwin approach might be a little too much, but thanks for the --link-dest pointer: I wasn't aware of that before, and it'll be handy for other things I'm doing.

</comment></comment><comment><USER5> If it's just photos, you could possibly use Flickr Pro? It might be tedious downloading them all later if you lose them, but it's a fairly obvious online home for photos, especially if you want the world to stumble across them. Just another option, really.

<comment><AUTHOR> Heh. I already have a Flickr Pro account that I use actively, and hadn't thought of that :)

I wouldn't want to pollute my normal stream with the 95% of dross that I'll doubtless take, but setting the default visibility to private could work well.

ISTR that flickr does some processing of the images as you upload them though, and don't really like the idea of losing the originals, but perhaps that only impacts the lower res versions, and the original always stays intact. Must investigate further...

<comment><USER9> If you got Flickr Pro the originals always stay intact. If you want (don't think you can considering general upload speeds in internet cafe's) you can even upload the RAW's and Flickr will keep them available for your at all times.

</comment></comment></comment><comment><USER10> FileZilla on the USB hard drive (<http://filezilla-project.org/>)

It doesn't need to be installed, you can just run it from the drive, and it can transfer via FTP or SSH to a cheap slicehost or dreamhost. I even think it supports syncing directories, so you can just resume where you left off.

</comment><comment><USER11> <http://www.eye.fi/> and a flickr.com account. The card connects to any open wi-fi access point and just uploads everything to flickr.com or other online photo site. When you get back, go through all of your photos and delete the ones you don't need. Better than lugging around a USB harddrive.

</comment><comment><USER12> I'm assuming that you are assuming (it gets tedious) that that computer you use to dump your data with to the HD will have network access.

Have a look at this (I just took a peek at it this morning, it's built by another HN poster):

<https://beta.tarsnap.com/>

<comment><USER13> > will have _good_ network access

You will need a reasonably fast Internet access to use the online backup. Depending on where you will be traveling, you may run into upstream bandwidth being severely restricted.

<comment><AUTHOR> Yeah, that's one of the unknown quantities in all this, and it's one of the reasons why I'd like something that can remember what's been uploaded already (and ideally handles partial file transfers etc). Then I can just leave it running everytime I'm online and have it just pick up where it left off next time. Then when the connection isn't great I can at least hopefully get _something_ uploaded, and when I hit good connectivity everything will catch up.

</comment></comment></comment><comment><USER14> I would put them on S3 via any of the FTP clients that support it. Just keep the installers on the hard drive.</comment>


Intel Performance Hit 5x Harder Than AMD After Spectre, Meltdown Patches - <AUTHOR> https://www.extremetech.com/computing/291649-intel-performance-amd-spectre-meltdown-mds-patches <comment><USER3> Things just keep getting better and better for AMD... it's like once you have a little bit of luck things just keep snowballing from there.

They are on track to have an amazing year with CPUs that may take a very significant chunk of the cloud compute away from intel and then maybe even on the performance side.. it's just fascinating that a company that almost died just a few years ago is now a big contender on multiple fronts.

<comment><USER4> It wasn't just luck. It was Jim Keller. [https://en.wikipedia.org/wiki/Jim_Keller_%28engineer%29](https://en.wikipedia.org/wiki/Jim_Keller_%28engineer%29)

<comment><USER5> Hilariously, the one takeaway I have from that article is that no one wants to lead the autopilot arm of Tesla.

<comment><USER6> It's certainly not a great sign that less than 1 month before Musk is parading around screaming that they've got self-driving solved, the head of the project has jumped ship.

<comment><USER7> Also - [https://www.cnbc.com/2019/05/17/tesla-shares-fall-on- report-...](https://www.cnbc.com/2019/05/17/tesla-shares-fall-on-report- autopilot-system-was-engaged-during-crash.html)

</comment></comment></comment></comment></comment><comment><USER8> At some point we need to start pointing the blame directly at Intel here. It's becoming more and more obvious that this isn't a problem where modern CPU architecture didn't anticipate a security attack vector — but more that Intel took shortcuts with security infrastructure on the chip in order to improve their IPC count.

</comment><comment><USER9> Original source: [https://www.phoronix.com/scan.php?page=article&item=intel- md...](https://www.phoronix.com/scan.php?page=article&item=intel-mds- xeon&num=1)

<comment><USER10> Not exactly the right link, that is for the server chips. This one is for the consumer CPUs: [https://www.phoronix.com/scan.php?page=article&item=mds- zomb...](https://www.phoronix.com/scan.php?page=article&item=mds-zombieload- mit&num=1)

</comment></comment><comment><USER11> As far as I understood, the solution to this in sandboxes such as the js world, is simply to deny anyone using timers with a resolution that could reveal cache misses. How much is software really relying on timers with this resolution? What would it mean if CPU manufacturers simply gave up and said "to mitigate side channels, you can't have a clock that is so accurate that it lets you measure whether X has happened because knowing that is equivalent to reading any memory".

Or, instead of detecting various things and flushing out sensitive data on some context switch, the CPU just adds noise to the timers instead? I'm gussing this is a complete no-go, but I'm wondering why it is?

<comment><USER12> If you really want to, you can "manufacture" high resolution timer pretty easily with thread spinning.

<comment><USER11> I suppose then "adding timing noise" here would also require making sure instructions don't have fixed and dependable execution times, because then you can just manufacture a clock by incrementing a number and knowing how many clock cycles the increment is. So an increment cannot be a known number of cycles. It does sound messy.

<comment><USER13> But then you'd have to increase execution times, and here we are ...

<comment><USER11> That's true of course. So basically adding timing noise is equivalent to adding artificial slowdowns. The only upside I suppose is that it might solve _all_ timing sidechannel attacks in one go. So it's not 3% for one and 4% for the next and so on. It's a one time cost to disable timing as an attack vector.

<comment><USER14> Adding randomness doesn't solve the issue, it just slows it down somewhat. Fast operations are still going to be faster on average, etc.

</comment></comment></comment></comment></comment></comment><comment><USER15> Does anyone have the full kernel command line to turn all of the mitigations off? I don't need this on my private development server which runs all code either written by me or under my control.

<comment><USER16> [https://make-linux-fast-again.com/](https://make-linux-fast-again.com/)

<comment><USER17> That's why average joe doesn't like Linux. how i'm going to use this?

<comment><USER18> Maybe you'll prefer the Windows version:

      reg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management" /v FeatureSettingsOverride /t REG_DWORD /d 3 /f

      reg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management" /v FeatureSettingsOverrideMask /t REG_DWORD /d 3 /f

<comment><USER19> Source for this is here [1].

[1]: [https://support.microsoft.com/en-us/help/4072698/windows- ser...](https://support.microsoft.com/en-us/help/4072698/windows-server- speculative-execution-side-channel-vulnerabilities-prot)

</comment></comment></comment></comment></comment><comment><USER20> What are we supposed to draw from those graphs? The AMD part is already much slower than the intel part.

<comment><USER21> I mean, a 15% reduction in effective computation is not nothing just because AMDs CPUs aren't faster. The 8700k has 2 less cores and costs ~$100 more, so now it is not a very compelling purchase if you plan to turn mitigations on.

Many people bought the 8700k for a level of performance, that they now need to compromise for: 1) higher performance, small chance of exploits, 2) lower performance and less exploits.

This dilemma did not exist until this year, and now everyone is paying for it, besides Intel.

<comment><USER20> The point is that it isn't comparable. It is likely that one of the reasons that the measured intel parts are so much faster is because of insecure optimizations. It would have been a much more interesting comparison to start from two SKUs with similar performance.

<comment><USER22> Isn't that what they've done? The 6800K had been slightly faster than the 2700X, now it's significantly slower. The 8700K had been significantly faster than the 2700X, now it's slightly slower (and yet more expensive). The same for the 7980XE and the 2990WX.

</comment></comment></comment></comment><comment><USER23> If I'm not wrong, these are kernel patches. Intel is adding hardware (they call it in-silicon) mitigations to Meltdown (in Coffee Lake [1]) and Spectre (in Ice Lake[2]).

This should help increase performance again, right? I'm actually waiting for Ice Lake before buying a new laptop.

[1] [https://www.tomshardware.com/news/intel-9th-generation- coffe...](https://www.tomshardware.com/news/intel-9th-generation-coffee-lake- refresh,37898.html) [2] [https://en.wikipedia.org/wiki/Ice_Lake_(microarchitecture)](https://en.wikipedia.org/wiki/Ice_Lake_\(microarchitecture\))

</comment><comment><USER24> What's the cost of interprocessor communication versus clearing these caches so aggressively?

I wonder, as cores continue to increase, if another solution will present itself in the form of segregating traffic per processor.

<comment><USER25> Those who care already do this. NUMA is taking advantage of memory locality by itself, and processes can be pinned to cores manually as well. But even reading memory of your own process can be an issue (it is for browser tabs)

<comment><USER24> The browser is providing OS services so if those services are "broken" they have to be fixed twice. Wouldn't one process per origin and letting the OS do its job reduce the surface area here?

</comment></comment></comment><comment><USER26> Admitting all the issues with this 'attack' as given, I can't help thinking this is only an issue because, CPUs use the old 'secrecy as security' model. E.g. if we add to each thread an encryption key used to interpret every memory access (just an xor with a rolling mask) then access to somebody else's memory become access to an encrypted document with a key you don't know. No longer a problem?

<comment><USER27> These are really timing attacks. It's not a matter of directly reading the data, it's a matter of being able to deduce what's there based on how long it takes to do it.

<comment><USER26> Yes; but that would be irrelevant if they didn't depend on secrecy for security, right?

<comment><USER27> Ah, you're proposing a solution for Meltdown rather than Spectre. The difference is that with Meltdown there is speculative access to memory that isn't even mapped to the original process.

Memory encryption might work as a way to solve that, but we already know how to solve that -- do what AMD and others have been doing the whole time and don't continue speculative execution through a page fault.

<comment><USER26> ...until somebody finds another vector to reveal the value of Kernel memory.

The mantra is, secrecy is not security. The User/Kernel dichotomy flagrantly ignores this principle.

</comment></comment></comment></comment></comment><comment><USER28> The title is clickbait, because 5x does not matter if the AMD's difference is under 1%. Also not the original source.

<comment><USER29> Clickbait because it could be misleading in a counterfactual?

15% vs. 3% is pretty meaningful. 15-16% is comparable to the gap between 4th and 9th generation Intel processors at the same frequency. And in that time turbo has gotten better but base clocks have dropped.

<comment><USER30> Also, I think fully mitigating the security issues on Intel processors requires applying all the patches _and_ disabling hyperthreading, at which point you're seeing more like a 20+% impact on performance. In particular, from what I can tell the microcode and software patches for RIDL and ZombieLoad only flushes the state on context switches and cannot protect against the hyperhreading-based variants of the attacks.

<comment><USER31> Loss of hyper-threading is only "20%+" because you put a plus there.. Hyper- threading in synthetic workloads is usually in the order of 40% loss in performance. Depending on how well used the hyper-threads are it can actually be higher.

It's unlikely to be lower than 40% unless you're bottlenecked before the CPU (memory speed or heavy CPU cache invalidation)

<comment><USER32> The article says...

"Disabling [hyperthreading] increases the overall performance impact to 20 percent (for the 7980XE), 24.8 percent (8700K) and 20.5 percent (6800K)."

...so I think a performance impact of "20%+" (i.e. 20% or more) is fair - <USER2> the 8700K it's 24.8%.</comment></comment></comment></comment></comment>


Jan Koum promoting WhatsApp in the Flyertalk forum (2009) - <AUTHOR> http://www.flyertalk.com/forum/travel-technology/952359-thoughts-about-my-free-iphone-app-whatsapp.html

<comment><USER2> A post by him from after the deal was signed: [http://www.flyertalk.com/forum/22387891-post72.html](http://www.flyertalk.com/forum/22387891-post72.html)

<comment><USER3> Jan Koum seems like a genuinely nice guy. I am glad he is tech's most visible billionaire this boom cycle.

<comment><USER4> (Created a throwaway account just to post this)

When he was at Yahoo, he was considered a bit of dick by the way he parked his shiny BMW M5; he would take two spots, and then argue with people who complained. Parking at Yahoo's Sunnyvale campus is a bit tight, so seeing him park like that rubbed people the wrong way; and despite being called out on it, his attitude was "so, what are you gonna do about it? I'll park as I see fit".

Go to Flickr and look up "ycantpark" tag from those days.

Just offering another data point thats all.

<comment><USER5> Wow, is this common at other companies, or are Yahoo employees particularly bad at parking?

<comment><USER6> Heh! I didn't work at the SNV campus, but in my time at Yahoo they had a daily email threads about bad parking jobs. Y! Cant Park or something...

</comment></comment></comment></comment></comment><comment><USER7> Funny to see this.

Posting to subject area forums (particularly communities using the familiar vBulletin) to gain your first 100 users, is a great way to get started. Posted this suggestion to the first 100 users thread recently: [https://news.ycombinator.com/item?id=7250358](https://news.ycombinator.com/item?id=7250358)

</comment><comment><USER8> He has some IM profiles listed on his flyertalk profile: [http://www.flyertalk.com/forum/members/jkb76.html](http://www.flyertalk.com/forum/members/jkb76.html) Hasn't gotten round to adding whatsapp yet!

<comment><USER9> Since having a WhatsApp contact is equivalent to sharing a mobile phone number, that makes a certain amount of sense. It's intentionally more intimate.

</comment></comment><comment><USER10> Flyertalk is basically everything that was ever good about HN, Reddit, Slashdot, without the negatives. I don't understand how it has remained so awesome for so long.

<comment><USER11> FT has a huge and very strong mod team. Anything off-topic gets killed or moved to Omni pretty fast. Some of the individual forums are more heavily modded than others (United Airlines forum compared to Travelbuzz).

Flyertalkers also talk in code. "(23 Feb) UA 574 ord to ewr upgraded to 767 3 class" is a pretty typical thread title. The barrier to joining the conversation is high. That's nothing to compared to this gem from the trick-it thread (up to 31,000 posts):

> Were you guys aware that you can FD half by C1-C2 via northern star and then > returning on the neutral longhorns that are the wholly owned sub of the > airline named after me? Just discovered that today by accident. Pretty cool > at times.

<comment><USER12> The trick it folks intentionally talk in vague terms to avoid anything being spread around. Most of the easy FD deals have been killed over the last few years because of this. The time/value tradeoff for those is now above my threshhold, but back in 2009 when they were much easier I flew SFO-SYD for ~$570.

</comment></comment></comment><comment><USER13> It's interesting to see that he promotes the app by mentioning the status feature, which is rarely used nowadays (at least in my experience).

<comment><USER14> Back then, that's all it had. At the start, you could update your current status and see all your contacts' statuses. When iOS added push notifications, it got updated so you could get notifications of friends' status updates without opening the app. It wasn't until version 2.0 (at least a couple of months after the forum post linked here) that the messaging functionality was added.

<comment><USER15> Ah, I always thought "WhatsApp" was a weird name for a messaging app. Makes sense that the first version was just a status-update-sharer, a "what's up?" app. Nice.

</comment></comment></comment><comment><USER16> Big things start small like a post in a forum.

</comment><comment><USER17> The best deal on FlyerTalk, by far!</comment>


Touchdown! My new address: 67P - <AUTHOR> https://twitter.com/Philae2014/status/532564514051735552 <comment><USER2> This is amazing, it seems as if we are really entering the space age now.</comment>


The Code Zombies of StackOverflow - <AUTHOR> http://www.nicolasbize.com/blog/the-code-zombies-of-stackoverflow/

<comment><USER2> A reasonable strategy for developmet and a clever title for the blog entry.

As someone who uses an unusual computer environment, I echo nicolas' statement that thinking about the problem and trying for a solution first is a good way of keeping the job interesting and becoming an expert.</comment>


XAuth – a Terrible, Horrible, No Good, Very Bad Idea - <AUTHOR> http://hueniverse.com/2010/06/xauth-a-terrible-horrible-no-good-very-bad-idea/

<comment><USER2> Other terrible, horrible, no good very bad ideas include toolbars that fly out on page load and pop ups that ask you to read some message that i completely ignored while I tried to hit the 12x12px 'X' button in its top right corner.

Otherwise, great article. I need to remember to click that new Safari 'Reader' button.

<comment><USER3> Yeah, I added the site to adblock after I saw that popup. Not cool. If I like your blog, I'll remember to promote it on my own. Now all I remember about the blog is that the author is a douche that reads too many "you should follow me on twitter" articles.

</comment></comment><comment><USER4> In case you read comments before stories, no, this is not the xauth you're likely thinking of.

<comment><USER5> Really? Which one were you thinking of?

<comment><USER6> Ahem: <http://www.x.org/archive/X11R6.8.1/doc/xauth.1.html>

<comment><USER5> Heh, I guess what "you're likely thinking of" depends on your frame. I haven't thought of _that_ xauth in years ... never occurred to me that someone might decide all of a sudden to start bashing it today.

</comment></comment></comment></comment><comment><AUTHOR> Although I agree with Eran, in the interest of balance let me also link to John Panzer (of Google, but writing independently) who tries to address some of Eran's concerns:

[http://www.abstractioneer.org/2010/06/xauth-is-lot-like- demo...](http://www.abstractioneer.org/2010/06/xauth-is-lot-like- democracy.html)

<comment><USER7> Even Googlers agree with Eran, xauth is just a temporary solution, the real solution should go into the browser, maybe with a API that is xauth compatible. Mozilla is already working on those ideas.

edit, from another googler: [http://www.google.com/buzz/dclinton/RcW6X3EjKj1/John- Panzers...](http://www.google.com/buzz/dclinton/RcW6X3EjKj1/John-Panzers-take- on-the-XAuth-project-is-pretty)

> John Panzer's take on the XAuth project is pretty much spot-on. It's not > that XAuth is what anyone wants for the ultimate answer in this space. > > Rather, XAuth is a short-term way of pushing for any momentum in this > direction.

> There are a number of companies leading it, btw:

> MySpace: <http://xauthdemo.myspace.com/>

> Microsoft: <http://xauthdemo.mslivelabs.com/>

> Yahoo: > [http://developer.yahoo.net/blog/archives/2010/04/xauth_oauth...](http://developer.yahoo.net/blog/archives/2010/04/xauth_oauth_and_yahoo_openid.html)

> Etc., etc. (Eran suggested this was Google-led, which didn't quite strike me > as accurate, given that Yahoo, Microsoft, MySpace, etc., were all as > involved as Google was.)

> For more background on XAuth, I did a round-up of the various announcements > and responses during the XAuth launch:: > <http://www.google.com/buzz/dclinton/CYgLcs24yqP/>

</comment></comment><comment><USER8> Oh dear. Computing sometimes has naming conflicts, but choosing 'xauth' as your authentication scheme when there's already an authentication scheme named xauth?

> Security guy 1: xhost is deprecated. use xauth.

> Security guy 2: xauth? But that's reliant on whoever controls a single > domain.

> Both: ???</comment>


Background Matting: The World is Your Green Screen - <AUTHOR> https://grail.cs.washington.edu/projects/background-matting/ <comment><USER2> This does look like an interesting step forward however I've found the biggest limitations of previous techniques to be

\- people who are using occupying a wider z-axis (for example leaning forwards in the camera or who have arms in front of them)

\- people holding objects like cups

How well do your method handle those kind of situations?

<comment><USER3> I'm not sure how either of those situations would trip up the system they're using. For a system trained on the background image, what difference does it make if the subject is holding a cup? The cup is not the background image, and it would be obvious in the same way that it's obvious the subject isn't the background image.

<comment><USER4> He might be referring to transparent/translucent/refractive objects, like a glass cup. Supposedly this technique can manage the transparency, but not refraction (and maybe the refraction could trip the transparency into failing).

</comment></comment></comment><comment><USER5> This is broadly called natural image matting if anyone is curious enough to look into the last 20 years of research.

<comment><USER6> Thank you!

(wouldn't it be nice if every time a research topic pops up here that there would be a small list of the essential keywords to look for more background information?)

</comment></comment><comment><USER7> Is there an easy way to stream it to Zoom/Slack etc...? Will be nice to use it as a virtual camera source

</comment><comment><USER8> Is it fast enough to operate on a live video feed from, say, a webcam?

<comment><USER9> Yes. OBS offers it. Teams and Zoom have guesswork-based imitations.

<comment><USER8> And where can I find the OBS implementation of this work?

<comment><USER10> [https://github.com/obsproject/obs-studio](https://github.com/obsproject/obs- studio)

<comment><USER11> I found the chroma key implementation, but this seems to assume you have a green screen or similar: [https://github.com/obsproject/obs- studio/blob/master/plugins...](https://github.com/obsproject/obs- studio/blob/master/plugins/obs-filters/data/chroma_key_filter.effect)

I thought GP was asking for an implementation of background removal without a green screen.

<comment><USER8> Indeed. I'm fairly sure it's not in OBS. Which is why I asked for a link to where it was implemented. Surprisingly I didn't receive one...

</comment></comment></comment></comment></comment></comment><comment><USER12> And Apple PhotoBooth deprecated this functionality too 32 bit debty.

<comment><USER13> Looking at the demo released, this seems to work much better than apple's implementation.

</comment></comment><comment><USER14> Very cool. Next step would be to emulate lighting in the target scene, but that probably requires pose detection and facial landmarks for accurate shading.

<comment><USER15> I have been thinking that a killer zoom product would be a USB controller for an rgb led strip that helps match color with your virtual background.

<comment><USER16> Very good idea. And change in real-time if the background is dynamic. And allow the user to set styles such as warming the FG subject, shimmering as if there is a fire or candlelight in the room, etc.

</comment></comment></comment><comment><USER17> Anybody know of any work done to improve greenscreen keying? The current old school techniques work quite poorly and require so much manual work. I would imagine with the new work coming out with neural nets etc. there would be possibilities for improvement. This is very cool work and good for certain applications, but seems to produce similar problems like greenscreen to some edges.

<comment><USER18> Modern green screen plugins/filters are miles better than what they used to be to the point that if the keying is hard, then the image must not have been produced well. By that, I mean an evenly list background (no light fall off producing gradients). Proper lighting of the subject. Proper distance from the background (helps reduce the edges and color tinting).

<comment><USER17> I work quite a bit with green screen keying. I see the same keylights, ultimattes and primattes used still even in big productions I have worked. Fixing the key can take weeks. Maybe industry is bit conservative and I haven't seen cool new stuff bubbling under, but would love to have new tools in the toolset to approach difficult shots.

</comment></comment></comment><comment><USER19> I recently tried working on this with OpenCV but it didn't quite work like I expected. I had problems with artifacts caused by my own shadows

</comment><comment><USER20> Does this work with reflective objects in the foreground, such as a car?

</comment><comment><USER21> What's novel about this?

If you have a background picture, you have all the info you need to identify your subject - just plain subtraction. I think this is what the Photo Booth app on my circa-2012 MacBook does, quite effectively.

<comment><USER22> Ex-VFX person here.

Green screens are crap with hair, because its translucent the green/blue bleeds through which means that it has to be cleaned up by hand.

Then there are the situations where there isn't a green screen. Again manual cleanup is required. Each frame needs to be cut out by hand. 24 times a second.

The same with a difference matte. Cameras are noisy, so there is constant noise in the alpha channel. This makes the effect look wobbly and cheap.

What this method does is pull a key from a difference matte, and makes it look good.

<comment><USER23> Are there no tools that automate the cleanup of green-screen artifacts?

<comment><USER24> The green screen software itself is that tool. The parent is saying it has limitations

</comment></comment></comment></comment><comment><USER25> That's @!#!@$ magical!

</comment><comment><USER26> The originally submitted URL ([https://www.catalyzex.com/paper/arxiv:2004.00626](https://www.catalyzex.com/paper/arxiv:2004.00626)) points to

[https://github.com/senguptaumd/Background- Matting](https://github.com/senguptaumd/Background-Matting), which points to

[https://grail.cs.washington.edu/projects/background- matting](https://grail.cs.washington.edu/projects/background-matting), which points to

[https://arxiv.org/abs/2004.00626](https://arxiv.org/abs/2004.00626), which points to

[https://arxiv.org/pdf/2004.00626.pdf](https://arxiv.org/pdf/2004.00626.pdf), which is inlined at the originally submitted URL. I'm not sure what's going on here, but on HN the convention is probably to link to the project home page first, and after that maybe the Github page and if neither of those exist, to the arxiv.org homepage (but not the pdf since those change with each revision). So I've changed to the project home page for now.

<comment><USER8> Are you suggesting it is an advertisement for catalyzex.com?

<comment><USER26> I wasn't suggesting anything, but having just looked at the submission history it seems clear that it's promotional. The HN community doesn't favor that. It's fine to submit your own site or work occasionally, but not to use HN primarily for promotion.

Also, the submitted title ('Zoom's virtual background swap but better. DL+GANs for background replacement') was too promotey.

<comment><USER8> I agree with you.

FYI your first sentence effectively says > I wasn't suggesting anything, but I was suggesting exactly that.

</comment></comment></comment></comment><comment><USER27> Peripheral: What is the benefit of halving these artificial backgrounds? Apart from "it's fun", which wears off after about a minute? In my experience (Zoom Meetings), there's blurring/artefacts around the edge of the head and the image quality seems to suffer as well.

I had a meeting where one participant uses an actual green screen, and the difference was remarkable, with none of the issues above.

<comment><USER28> There are two parts to background matting. The first is removing the existing background and the second is replacing it with something else. Removing the background improves the focus on the foreground - people watching can see you better and they'll listen more closely because they're not distracted by what's behind you. The second part, replacing the background with something else, might be done because you don't want people to see where you are, or because you want to overlay your foreground video on a presentation. Being able to pretend you're on a holodeck or a desert island is a trivial use of the tech.</comment></comment>


The Law Can't Keep Up with Technology, and That's Good - <AUTHOR> http://www.newsweek.com/government-gets-slower-tech-gets-faster-389073 <comment><USER2> It is good so long as the legal philosophy of the land is "unless something is explicitly forbidden, it is automatically allowed". This is _not_ a good thing when that philosophy is "you're not allowed to just go and do new stuff until we get a chance to consider it and pass regulations".

There are plenty of examples around of "unless explicitly permitted, automatically denied" that are stifling innovation in my opinion. Pick a random county in America and try to build a residential dwelling using any sort of alternative materials or architecture for example.

<comment><USER3> Agree with your point in principle, but I'd nitpick with your example.

Building regulations & planning approval are a matter of public safety precisely because human beings have a millenia-long track record of putting together dwellings in weird ways using whatever materials are available/convenient, and often aren't aware of the repurcussions.

Should it be okay for someone to build a 3-storey domestic dwelling, in a unique way, out of unregulated materials, 4 feet from another home? Not next to my home it shouldn't. Nor should it be my responsibility to discover & research their building materials and lodge a complaint.

If they want to build their house using 3d-printed ceramic blocks using plans they downloaded from douchebrick.io, and raw materials they sourced themselves, then the burden of proof should reasonably be on them that they're not putting neighbours, friends, Airbnb guests, adjacent property, kids fetching their ball from your garden, tenants, future buyers, passers-by, postal workers, and Avon ladies at risk.

You could make an argument that these approval processes should move faster, but it doesn't sound like the argument you're making, and it may result in more mistakes (Asbestos anyone?).

</comment></comment><comment><USER4> > It's whether they're willing to take action that would destroy the > companies' $2.5 billion combined value owned by important investors (and > campaign donors) like KKR, Comcast, NBC, Major League Baseball and several > Silicon Valley VCs.

On one hand I want to agree, on the other hand I'd like to see some justification for this statement. $2.5 billion doesn't seem like a really big industry, sure, it's a lot for two companies to be dominating in, but nothing compared to even the smallest durable goods market.

It seems like a really small fish that the government wants to protect, rather than some giant that can't be touched. What it reminds me of is Hollywood. I read somewhere that the market cap of the entire movie business is handily outstripped by Disney's toy arm, or something like that, and what gives them outsized influence on policy-making is the symbiotic relationship that so much of our capitalism has with our content industries.

Football is like that. Yes, there's a lot of money in advertising and ticket sales and the actual business of football. But the rest of the economic effects that football generates is just huge. The govt is loathe to do anything to endanger football's ability to make money because of all that. It's not that they can't, they just don't want to.

<comment><USER5> That seems like a compelling argument for restricting corporate political donations.

If the politicians want to block something that their _voters_ don't want to see blocked, that's the politicians' problem and they can pay for it at the next election. But if they aren't blocking something they should be because of the business connections involved, that's corruption pure and simple.

As for the businesses collectively investing a few billion in a new industry, that's why the value of your investment can do down as well as up and why you're supposed to do your homework before you put your money into a new venture. It doesn't always work out, and if you backed a controversial scheme and that was one of those times, that was the risk you took.

<comment><USER4> > But if they aren't blocking something they should be because of the business > connections involved, that's corruption pure and simple.

Well, first off, corruption involves people and not industries. I highly doubt that the two firms dominating the industry are themselves politically connected. Government officials protecting an industry is categorically not corruption, protecting individual firms and giving them a leg up over other firms in the same industry categorically is.

Propping up an industry is called subsidization and it's part and parcel of how modern governments manage the economy.

Second, whether they should be blocking it or not is not a settled question. Gambling is weird, it can't really be called good or bad, like any vice, in moderation it's fine for people. And it's arguable whether fantasy football is actually gambling. Also we lost the ability to regulate real gambling when the big online poker companies fled the country and set up shop overseas. Seems like there would be nothing keeping this niche from doing that either.

<comment><USER5> My point was that if you have public officials making decisions about whether or not to enforce regulations that would potentially cost businesses money _because the investors are campaign contributors_ , as not-so-subtly implied by the quotation from your previous post, then that is clearly corrupt. Those officials should be responsible to the people they represent, not to whichever big businesses give them the most money at election time.

I'm not offering any opinion on whether the government in any particular place should take steps to protect any particular industry here.

</comment></comment></comment></comment><comment><USER6> We may want some way to regulate company and individual actions even though we don't want traditional government. Bitcoin-like technologies could be a starting point.

We do have unwritten and written social contracts and expectations and having a common framework for encouraging/discouraging certain types of behavior might be important.

Another issue is that these companies become so dominant that they are almost the de facto government in certain areas. Technopolies lioe Google and Amazon. Which its nice to decouple modules of (effectively) governance but we probably would be better off with many smaller companies operating on public information technology platforms.

</comment><comment><USER7> I'm not seeing anything to convince me that this is a "very good thing." It seems to be a thing that's great if you're a Disruptive Tech Startup(TM) and somewhat mixed if you're an average Joe, but--like many recent tech articles-- it's written solely from the perspective of a Disruptive Tech Startup, which is getting tiresome.

<comment><USER8> caveat, I didn't read the article because either it is timing out or ublock is blocking it (just see white page)

I think it is a good thing that the law can't keep up with technology. Take Uber, people like it and it works well. It is hard for the law to stop this and public opinion is quite loudly for it, so it stands. The internet is changing from centralized to distributed with finance depending on it wholly for infrastructure.

Protocols will change at that level and slowly money will become more digitized. Even without bitcoin, it will be possible to quickly transfer funds from organizations at banks. If the public embraces this, the gov't can't do anything.

This is like a riot for freedom. When enough people do something the government is outnumbered and it becomes defacto legal. Often, this rare phenomenon is referred as _democracy_.

Drones falling on people will be bad. Some people will be scammers. Medical devices/technoques will be more dangerous (with better upside). People will hide income which is good for the individualshort-term but bad for the governemnt, and possibly everyone long term. Wages are fucked.

This will force cooperation between people and ultimately governments because the power distance delta will be lowered significantly from a person to "the government". Technology is killing government just like home taping killed the music industry. Very slowly.

<comment><USER9> _it will be possible to quickly transfer funds from organizations at banks_

This is called "Faster Payments" in Europe, where it's already working quite nicely.

<comment><USER5> Indeed. In fact, a great deal of what is wrong with financial infrastructure is precisely because the industry is dominated by a few huge players with a vested interest in not rocking the boat, and because of their scale and often their multinational later they are very hard for governments to regulate effectively.

Many problems, from highly visible ones like the crazy level of fraud and financial crime we tolerate or the way some governments have propped up failed financial institutions with public money in recent years, to more hidden problems like the one-sided deals small businesses get with financial services and the amount creamed off almost every electronic financial transaction by those same financial service providers, should have been dealt with long ago.</comment></comment></comment></comment>


Application Engineer Salary in Tokyo - <AUTHOR>

I'm an experienced Android software engineer. I moved to Tokyo a little while ago and am looking for a new job. I got an offer which is a third as much as I was making in San Francisco. I know it is a very different market here, but it's pretty hard to swallow. I also don't have a big background on what people are making here to know if it is in the right ballpark.
What are experienced engineers at start ups making?
What about other compensation? <comment><USER2> That sounds like roughly market for Tokyo. You can do better, but you'll probably need to get a job at a foreign corporation in Tokyo. Remote is, of course, an option.

 _What about other compensation?_

Japanese companies are great about compensating you with internal social status and decent at providing pecuniary benefits which are, for tax purposes, not counted as "salary" (but that's like a 20% multiplier, not a 300% multiplier), but if you were thinking equity, historically, companies here do not award meaningful amounts of it.

</comment><comment><USER3> This obviously depends on what you were making before but 40-60k is the norm in Japan from what I understand. Certainly a huge difference compared to the US market.

</comment><comment><USER4> It's very different than what it's like here that's for sure. You're expected to work longer hours for little(r) pay. It's a cultural thing to slave and slave away and to be happy that you have a job and you're contributing to a greater good.

</comment><comment><USER5> You moved to Japan but it sounds like you still need to research Japaneese culture. Salaries in Japan are lower but jobs typically make up for it in stability.

</comment><comment><USER6> I worked at a startup outside of Tokyo (Fukuoka) and got a little over 3million yen. Programming salaries are low.

</comment><comment><USER7> Have you talked to Patio11? He might know.</comment>


Google Nest Cam outage takes down live video, history - <AUTHOR> https://9to5google.com/2020/02/25/nest-cam-down/ <comment><AUTHOR> I'm not sure how you can push an update that takes multiple services down for 17 hours. Unbelievable.</comment>


Cheap Android Phones Could Cost Telcos Billions in Repairs  - <AUTHOR> http://www.wired.com/gadgetlab/2011/11/android-repairs-costly/ <comment><USER2> So this article is trying to say that cheap Android phones have high hardware failure rates because of software diversity?</comment>


The Heartbleed Aftermath: all CloudFlare certificates revoked and reissued - <AUTHOR> http://blog.cloudflare.com/the-heartbleed-aftermath-all-cloudflare-certificates-revoked-and-reissued

<comment><USER2> Really great writeup. Here's the most astounding part to me: "[Rubin Xu] decided to use Coppersmith's Attack[1] to derive the private exponent. In this attack, only pieces of the private key are needed and the private key is reconstructed mathematically. This attack is so efficient that he managed to extract the private key from only the first 50 dumps!"

That's no more than ~3MB of data. Some of the other winners hit the server with hundreds of thousands of requests which might have gotten noticed. Doing this with only 50 heartbeats (which could be spread across many days) makes the "undetectable attack" even less detectable.

[1]. Coppersmith's Attack: [http://en.wikipedia.org/wiki/Coppersmith's_Attack](http://en.wikipedia.org/wiki/Coppersmith's_Attack)

<comment><USER3> Would love to see more details on the practical implementation of this attack / source code. Whilst detecting primes in random data is feasible, can't imagine how chunks of returned data were "unrandomized" for this type of attack.

<comment><USER4> Coppersmith is complex enough that I'd be impressed to see working implementations even in lab conditions; it's one of the lattice reduction crypto attacks.

<comment><USER5> It's really not that bad with today's computer algebra packages. Here's a simple example in Sage that works most of the time:

        p = random_prime(2**512)
        q = random_prime(2**512)
        n = p*q

        P.<x> = PolynomialRing(Zmod(n))

        partialp = p - p % 2**224 # most significant 288 bits
        f = x + partialp
        root = f.small_roots(X=2**(224), beta=0.5, epsilon=2**-5)
        assert(root[0] + partialp == p)

        partialp = p % 2**288 # least significant 288 bits
        f = x + partialp * inverse_mod(2**288, n)
        root = f.small_roots(X=2**(224), beta=0.5, epsilon=2**-5)
        assert( root[0]*2**288 + partialp == p )

<comment><USER3> Cool. Would this approach work if 'partialp' is not coming from the starting or ending bits of the targeted prime number?

<comment><USER5> Yes. But it makes for a worse didactic example, since Sage does not support it out of the box.

Imagine you know the middle 288 bits of p. Then you have to find small roots of the equation

        x1*2**400 + partialp + x0,

which now has 2 variables x0, x1 < 2^112. This requires building a different lattice than in the single variable case, but the complexity of the attack is not very different.

Also note that it doesn't have to be p or q. Bits of d, d mod (p-1), and d mod (q-1), and possibly other intermediate values of RSA computations are also usable for this.

</comment></comment></comment></comment></comment></comment><comment><USER6> I love the reaction from ISC's handler on duty. Globalsign's CRLs were temporarily removed from the dataset until they could verify it was "real":

      > Update: We temporarily stopped reading
      > "http://crl.globalsign.com/gs/gsorganizationvalg2.crl" . It had > 30,000
      > revocations today, drowning the rest of the data. Trying to figure out if
      > this is real. (4/16/2014 7:30pm)x
      >
      > Update 2: I used the online chat to talk to GlobalSign tech support and
      > they confirmed that it is real and related to the revocations due to
      > Heartbleed. Adding them to the graph again. (4/16 8pm ET)

<comment><USER7> Yes! I laughed at that too. Though it makes sense that a mass-increase in data like that would seem off, especially when it is so much higher.

</comment></comment><comment><USER7> As much shit as CloudFlare took for the way they humble-bragged about finding out about Heartbleed early, I have to give kudos to the team for doing the right thing and reissuing and revoking all the certs, as well as detailing the exploit and offering up the test site.

I'll admit, when the CloudFlare Challenge launched, the cynical part of me saw it as merely a way for the company to convince itself that it didn't need to reissue and revoke all of its certs (and I maintain that is exactly what it was), but the way the company handled things after the challenge was won is what really impressed me.

They didn't have to be that transparent. Moreover, the test server has provided a way for Filippo Valsorda to improve his excellent Heartbleed checker, so well played.

<comment><USER4> I'm a little irritated by the challenge not because of any delay in rotating certs, but because its whole premise was invalid; the challenge was accompanied by a long blog post that presumed a model for how RSA keys hit heap memory that appears to have been self-evidently false (again: I might be wrong here).

Or, to put it differently: Akamai, which attempted to write a secure heap to contain memory corruption flaws in OpenSSL, conceded immediately Willem Pinckaers observation that they weren't protecting the CRT intermediates. Akamai seemed to believe ahead of time that keys weren't simply loaded once and held.

There are lots of smart people working at Cloudflare, but I think the "challenge site" approach was a waste of time. The stuff John Graham-Cumming posted today, showing bitmap diagrams of the memory space of OpenSSL processes, would have been much more productive as a starting point. Diagrams like that are a standard part of reverse-engineering practice. They should have started there, and not with the challenge site.

We all make mistakes (some of mine are easy to find). I'd just say that a lesson to learn from this is, "err on the side of greater severity, not lesser."

(Is what I think.)

<comment><AUTHOR> There's one significant difference I think between what Akamai did and what we (CloudFlare) did.

Akamai thought their memory allocator meant they were safe and so didn't change their SSL keys; we weren't convinced by our own analysis (which I was involved in) launched the challenge, and simultaneously started the process of revoking keys.

In the challenge blog post we said: "We've begun the process of reissuing and revoking the keys CloudFlare manages on behalf of our customers. In order to ensure that we don't overburden the certificate authority resources, we are staging this process. We expect that it will be complete by early next week."

That wasn't BS, we were doing that and we had a _ton_ of keys to deal with. Today's blog post is a result of further analysis and the announcement that we revoked everything.

BTW I'm not done with analysis of OpenSSL memory. There's still something weird going on (I think in the bignum library) where data isn't getting OPENSSL_cleanse'd from memory.

<comment><USER4> I am "a little bit" not a fan of waiting to rekey. A lot of people did that.

I am "a lot" not a fan of setting up a challenge game to have people try to pull the key with one hand figuratively tied behind their back, when a debugger or memory dump would have decisively answered the question --- and, presumably, did exactly that for at least some of the winners.

I am "severely" not a fan of _marketing_ skepticism about the severity of a flaw. This is almost vulnerability response 101: it's the reason Cisco and Microsoft tag memory corruption flaws "possible remote code execution" even when they're obviously not exploitable. Err on the side of severity.

As evidence for my concern, I'll again observe that Bruce Schneier's read of the Crowdflare Challenge blog post was that your team believed it to be "next to impossible" to extract RSA keys.

As you know, very few people in your audience have the technical background to evaluate that claim, especially when it's accompanied by heap metadata diagrams.

I don't think any of this is earth-shattering or even all that controversial. I would just hate to see a standard response to complicated vulnerabilities become "set up a challenge site". Challenges are great! You guys should do more of them! Just don't do them to answer critical security questions. :)

 _Edited to sound less petulant._

<comment><USER8> Worth noting that the cost imposed on the Internet's infrastructure of mass revocation is non-trivial:

[http://blog.cloudflare.com/the-hard-costs-of- heartbleed](http://blog.cloudflare.com/the-hard-costs-of-heartbleed)

Just CloudFlare revoking all the certs on our network added 40Gbps of net new traffic to one CA. Mass revocation without making sure all systems were ready to handle it would have also been irresponsible. Props to Globalsign (our primary CA partner) for working with us to make sure we could pull it off.

<comment><USER4> That is a totally understandable reason for why it took many hours or days to revoke keys. I'm not really faulting you for that. My issue here is different, more subtle, and nerdier.</comment></comment></comment></comment></comment></comment>


Don't be an idiot. Find a great startup advisor. - <AUTHOR> http://www.humbledmba.com/dont-be-an-idiot-find-a-great-startup-advisor

<comment><USER2> Curious if people actually formally ask people to be advisors, or just keep asking them more and more questions until its defacto.

<comment><USER3> In my experience, the most successful startup advisor relationships are the ones that are very deliberately and explicitly pursued. It may take a while to find the right person, but once you do, making sure you're both clear on the advisor/advisee relationship is paramount.</comment></comment>


Shipping Startup Shyp Raises $10M, Plans Expansion to New York City - <AUTHOR> http://techcrunch.com/2014/07/16/shyp-10m-sherpaventures/

<comment><USER2> Really convenient product, excellent customer experience. Shipped half an apartment through these guys, would have taken me forever without their crew taking care of everything.

</comment><comment><USER3> Not surprised. Awesome product, great team</comment>


Ask HN: Should I buy this domain? - <AUTHOR>

Hi everyone, looking for a name for my B2B webapp project and think I have something. I'd eventually like to turn it from a project into a profitable company.
7 letters, 2 syllables, .com, looks like 1 word, and I can get it for high 3 figures USD. (Not a small amount of money, but my bank balance has gone up enough recently to cover it). Looks great written/typed, can be said over the phone, just doesn't roll 'perfectly' off the tongue.
It's a verb representing what people will do on my webapp (e.g. share) + short suffix (e.g. ly) + .com.
There's a (very) slightly related product using the .net; but it's from a small middle-eastern country, looks small, and it just a sub-project of a bigger company (judging by the different company name in its footer).
I'm not an expert, but it looks like it's being sold a little under value, because similar (worse) domains are going for 4 figures.
I'd almost buy it even for its investment value, but I thought I'd ask here first if there's anything else I should check or do.
Any advice would be much appreciated, thanks! <comment><USER2> How far along is your project? Do you have a good feel for whether this is something you're likely to carry through to completion?

I personally tend to put too much time into looking for a domain name too early in the project (because it's fun to do, honestly). It's much better to at the very least do serious research first (competitors, understanding and talking to possible customers, etc.), and have done proof-of-concept work for technical challenges, and done some design on your minimum-viable-product first version before worrying about a domain name, because it's so frequent to find some serious problem during that process that will cause you to abandon the project (or perhaps realize that you don't find it as interesting as you thought initially -- if you don't have some serious passion for solving this particular problem, it's not likely you'll have the motivation to get through the hard parts of building a business around it!).

If you've already gotten past those steps -- sure, go for it. Upper 3-figures isn't a high number if this feels like a very good candidate.

I don't recommend buying it as an investment, though... There was an HN thread a few weeks back on the subject of assessing domain names, and in general they aren't very valuable. Yes, many names are taken, but there are so many businesses that are succeeding in spite of quite odd domain names (hell, thinking of domain names, what about "GoDaddy.com" for a completely random domain name?).

<comment><AUTHOR> Great reply, thank you.

I'm just working on the MVP at the moment, but it's not that far yet. I'm also doing it as a project to learn some new technologies so it might take longer than expected.

Nice point on the investment too. I may just add it to my watchlist for now. Thanks again!

</comment></comment><comment><USER3> If you are going to buy it, make sure you will use it. I can't tell you how many domains I bought and never used.

<comment><AUTHOR> Haha, I'm keeping that in mind too :)

</comment></comment><comment><USER4> If you pay me half the amount, I will come up with a better domain name.

</comment><comment><USER5> Buy it when your webapp is live and showing signs of success.

</comment><comment><USER6> Check for potential trademark issues.

</comment><comment><USER7> Snag it. Don't wait.</comment>


Show HN: Automated log analytics using machine learning - <AUTHOR> https://www.loomsystems.com/showhn <comment><USER2> You could do better with the presentation graphics in the video ;) but the product seems to be interesting, do you have customers? is it built for scale?

<comment><AUTHOR> Yep, guess you're right :D we do have customers, you can see them in the bottom of the top strip and regarding scale, it actually gets better with scale.</comment></comment>


Discuss on HN: The NSA Leaks Make Everyone Less Safe, Here's Why - <AUTHOR>

The NSA leaks have been defended by the NSA itself, politicians, and some members of the public as a measure to keep us safe.
This is a patently false statement. These programs have proven 100% beyond any doubt that every human on the planet is less safe.
There is no safety from a system where you have no ability to freely dissent, disagree, discuss, or discover the ideas and thoughts of others that may be in opposition to the currently ruling power structure.
The NSA in specific, the USG in general has completely eliminated the ability for any American citizen to feel safe in their articles and effects:
>The right of the people to be secure in their persons, houses, papers, and effects, against unreasonable searches and seizures, shall not be violated, and no Warrants shall issue, but upon probable cause, supported by Oath or affirmation, and particularly describing the place to be searched, and the persons or things to be seized.
The NSA's dragnet eliminates any and all security of person (conversations, location by phone), papers (email, browsing), effects (files, downloads, contacts, accounts) and the ability to query anything is an entirely unreasonable search.
The NSA has eliminated the spirit and soul of what America is.
There is simply no justification for the level to which the 'system' has evolved in response to "the war on terror".
It's time to stand up against the encroachment and expression of the terror-intelligence state.
Today, I am proposing a call to action to protest, peacefully, but relentlessly, against the state of the United States Government, and its agents in the NSA with complete civil disobedience. Refuse to accept their lawful authority over you, your person and your life given that they are not upholding the basis on which this country is built; the U.S. Constitution.
Please discuss. <comment><USER2> I believe that abuse of power in general, and illicit surveillance in particular, is nothing new, especially for the United States. This does not make any of it kosher of course.

But in an age where the courts can literally, retroactively re-write the laws to serve their own interests, protests and petitions are as evocative as a breeze.

I suspect that portions of every generation feels that things will get worse before it gets better. I believe that other portions of every generation believe theirs to be the ultimate showdown, the Armageddon. All said, I don't see how we can be backed any further into a corner. I've been running daily news aggregation articles at my website:

[http://thelotteryparty.com/](http://thelotteryparty.com/)

And every day's post makes me feel more and more like a sadomasochist. I see no easy solutions. I think we will all need to go without many things that we've been taking for granted, before life will look anymore hopeful for future generations, even the next generation.

Edit to add: I have not had a bank account since the big bailout of '07, and have never owned a credit card. I pay only sales taxes. I do not vote. I boycott freely and widely. These and other small battles make for a truly awkward lifestyle, but I think it the best way to buck the system- by not enabling any of it. Take the power away from the Powers That Be. The People own the gov.

<comment><AUTHOR> How are you paid without a bank account? I'd be really interested in hearing how you manage that physically.

<comment><USER2> Cash primarily, though I cash checks at non-chain pawn shops as needed. I've been getting lucky in the last year or so with trading goods and services- such as covering my hosting fees by proofreading/script doctoring/ghostwriting for others, etc. Even lawncare for groceries in the funner months. It is not easy, but I watched Turk182 waaay too much when I was a kid.

</comment></comment></comment><comment><USER3> Yes, indeed, a sentiment shared in some form or another by most of the users here. However, your call to action is nebulous at best. Most of the solutions that myself and others are taking include 1) Encryption, 2) Writing politicians, and 3) Discussing the issue with friends and family. If you are able to suggest something more effective, please do so.

Also, if you are truly want to make a difference, I think it's a good idea to start using Bitcoin. The ability to circumvent taxes (at least, for now, while Bitcoin is fresh) decreases the government's ability to control you. Of course, Bitcoin's public success is more of a fantasy I hold. Regardless, I'd be interested to hear your thoughts on that matter.

<comment><USER4> Just a thought - which do you think will be cut more if tax revenue declines? Food stamps or NSA funding?

<comment><USER3> That's a good point. I would hope that if tax revenue declines, the NSA, at the very least, would cease growing. It is possible that more justified programs would take a hit, such as food stamps, but in the end I'm far more concerned about being spied on. But honestly, I think it's more about the principle: I'm not going to finance a government that so blatantly ignores its own Constitution.</comment></comment></comment>


Show HN: Get a Slack message when your brand is mentioned on HN - <AUTHOR> https://littlebirdie.io/ <comment><USER2> Do not wanna be that guy, but you can do that with Zapier and way more [https://zapier.com/zapbook/zaps/675/post-message-slack- when-...](https://zapier.com/zapbook/zaps/675/post-message-slack-when-your- company-name-mentioned-hacker-news/)

We (tyk.io) use Slack notifications with Zapier for various searches on HN, Reddit, Twitter, Stackoverflow or even Google Alerts (the last one use built- in Slack `/feed` feature).

<comment><AUTHOR> Actually Zapier was the reason I made Little Birdie! They had a HN and Reddit integration that didn't work at all and that motivated me to make my own solution, also the $600/year was a bit too much for personal use.

<comment><USER3> You do not need to pay for a Zapier account to do something as simple as HN -> Slack unless you have hundreds of HN mentions a month.

</comment></comment></comment><comment><USER4> Have been using [https://www.hnwatcher.com/](https://www.hnwatcher.com/) for more than 3 years. Love it.

<comment><USER5> Just registered. I seem to be able to add keywords, but can't find a way to remove keywords or edit the frequency of notifications. I've tried disabling uMatrix for the site, but that doesn't seem to help. Is it just some weird config with my browser or is that the way it's meant to be?

</comment></comment><comment><AUTHOR> This was made for my own and a friend use, and we found it useful, maybe others will find it useful too.

</comment><comment><USER6> Mention ([https://web.mention.com/](https://web.mention.com/)) is also another social mention tracker. I use it for an open source project and would recommend it.

</comment><comment><USER7> Free product idea: Same general concept but applied to the _content_ of sites that make the front page.

In your Bitcoin example, one would be notified if the displayed content of an article on the front page (or say top N, or greater than M points, ...) includes the word "Bitcoin".

Bonus points if you can do complex or negative matches. Ex: +database -mongodb

<comment><AUTHOR> That's an awesome idea - I'll add it to the todo list.

</comment></comment><comment><USER8> That was my first exposure to webhooks was slack, I see it in a few places now that triangle circle-corner logo.

I don't know how often the front page of Hacker news is updated but you could build this yourself.

CRON > PHP > CURL > HTMLDOMScraper > Slack webhook

I had everything else except the CRON part, I had trouble trying to run that.

note: the CRON thing for me, I tried Ubuntu and Debian, I don't know I couldn't get it to work. I couldn't get a simple php script to execute on the timed interval.

So a dumb solution would be to use a setTimeout poll with JavaScript and call the AJAX request to the PHP script which then runs everything else.

</comment><comment><USER9> Just to be clear, the bot doesn't get full read access to all channels, right? It can just respond back when called or message a pre-setup person or channel?

<comment><AUTHOR> It requires no read permissions at all to the channels. It receives commands eg /littlebirdie help - and posts to a channel of your choice via webhook.

</comment></comment><comment><USER10> I love this kind of stuff. Super precise side project that fills a need and is fun to build.

Slightly related and clearly shameless plug: you could build this from scratch in about 2 minutes using my our new (or about 30 seconds if you fork an existing one). If you're interested email email@example.com for a developer account. I'd very much like to hear your feedback.

Obviously not as targeted as OP but still cool :)

</comment><comment><USER11> F5Bot[1] is a free alternative that sends an email instead.

[1] [https://f5bot.com](https://f5bot.com)

<comment><USER12> For just looking at titles on the front page, here's a one-liner in Powershell that scrapes every 60 seconds, and emails you:

While ($True) {If ((iwr [https://news.ycombinator.com](https://news.ycombinator.com)).content.split('", ') | select-string "YourBrand") {Send-MailMessage -from firstname.lastname@example.com -to email@example.com -server MySmtpServer.example.com -subject "YourBrand was mentioned on the front page of HN!"}; Sleep 60}

<comment><USER13> Does your one-liner continue to send the same email every 60 seconds while "YourBrand" is on the front page?

<comment><USER12> Yes, you may want to disable it when your brand hits the front page.

</comment></comment></comment></comment><comment><USER14> Cool. Is there a blog post somewhere that shows how it works internally? I'm curious if there's some formal named entity recognition, or more basic string matching. Would it work well, for example, if you had a brand name that was also a common term?

<comment><AUTHOR> Nope there is no fancy entity recognition going on here at the moment, though that would be cool. It's a simple regex of the form

        '\bterm\b'

or in wildcard cases

        '\bterm.*\b

</comment></comment><comment><USER15> There's also [https://notify.ly/](https://notify.ly/) which includes "dozens of sources, like Twitter, Facebook, Google+, Reddit, Blogs, News, Medium & Product Hunt."

</comment><comment><USER16> Another suggestion: Send me the posts in the front page that have more than 100 (or any amount) votes. Or maybe a daily message of yesterdays front page.

Thanks!

<comment><USER17> [https://twitter.com/newsyc100](https://twitter.com/newsyc100)

top 10: [http://www.daemonology.net/hn-daily/](http://www.daemonology.net/hn- daily/)

</comment></comment><comment><USER18> This looks nice ! i was missing such thing to search for hacker news mentions of our company.

</comment><comment><USER19> Would be great if we could select source (eg. not have Reddit)

<comment><AUTHOR> Added, you can use -source:reddit now.</comment></comment>


Beat the Fed - <AUTHOR> http://graphics.wsj.com/beat-the-fed/ <comment><USER2> This "game" seems to allow me to modify the outcome of the Fed's policies, and not the inputs. Unless it's advocating price controls as a means to economic prosperity, I don't see the relevance.

Am I missing something here?

</comment><comment><USER3> Perhaps I am economically naive, but why does there need to be any inflation? Why isn't 0 a target?

<comment><USER4> To encourage spending

<comment><USER5> Inflation of zero is just as good for encouraging spending as small positive inflation -- the rate you'll get by low-risk investing will always beat inflation by a bit.

But the moment inflation dips below zero it really starts discouraging spending.

So I suspect it's about having a margin for error. Target zero and it will spend a lot of time negative, target mildly positive and it will spend most of its time mildly positive.

<comment><USER6> >But the moment inflation dips below zero it really starts discouraging spending.

While this view is common, it is incorrect.

This is obviously evident when you consider the price of computers and other tech products over the decades.

<comment><USER7> Even in computers, you had the dilemma of "should I buy now, or wait a year and get the same thing for less money?" That was a standard question for many years.

<comment><USER6> Despite that, companies like Apple have hundreds of billions in revenues. Which is to say, the falling prices aren't a real problem. After all, the same person could say they could get the same thing for even cheaper in 2 years, 3 years, 5 years or 10 years.

<comment><USER7> True. And yet, it still means there is some pushing of demand into the future due to the deflating prices. Which means that your argument in the GGP post is false. The fact that, despite the pushing of some demand into the future, Apple makes tons of revenue does not change the fact that demand is still being pushed into the future. That is, your reply, while true, is irrelevant.

<comment><USER6> >True. And yet, it still means there is some pushing of demand into the future due to the deflating prices. Which means that your argument in the GGP post is false.

I never said deflation cannot defer people's demand. The comment I originally responded to indicated that a deflation rate of 1% would, in general, discourage spending. I would wager, that almost no one defer buying an iPhone if they knew for a fact that it would be 1% cheaper a year later. Just as I don't think that knowledge that the price would be 1% higher a year later would cause someone to buy an iPhone they were not already planning on buying.

What I'm getting at is falling prices, in and of themselves, are not a huge problem. If you want to say that a deflation rate of 20% would cause huge problems, ok, maybe that's true for some products. Conversely an inflation rate of 20% would cause huge problems in some realms. Inflation is not generally good and deflation generally bad--that is the myth I'm addressing.

<comment><USER7> 1% deflation doesn't shift demand very much. OK, I'll buy that. (Pun not intended, but not avoided.)

</comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER8> "Fed's goal: get the U.S. inflation rate to 2%": This is partially true, since the Fed's goal is also to maximize employment[1]. So really, they should add employment rates in these different categories as well. Which makes the job even harder.

In fact, balancing the two was thought to be a very hard job in theory, almost impossible. And that's why the EU central bank mission _is_ to only stabilize inflation and let each country focus on employment. (it's less and less true because of pressure from EU countries such as France and Italy).

[1] [http://www.federalreserve.gov/aboutthefed/mission.htm](http://www.federalreserve.gov/aboutthefed/mission.htm)

<comment><USER9> Interesting fact: adding the unemployment part of the dual mandate came after the recession of '73-'75 which saw unemployment hit 9%. Originally, the Fed's only mandate was to keep prices stable.

[1] [https://www.chicagofed.org/publications/speeches/our-dual- ma...](https://www.chicagofed.org/publications/speeches/our-dual-mandate)

[2] [https://en.wikipedia.org/wiki/1973%E2%80%9375_recession](https://en.wikipedia.org/wiki/1973%E2%80%9375_recession)

</comment></comment><comment><USER10> At first glance, had no idea what I was supposed to do or how it worked. At second glance, it seems like you're just setting price inflation on a number of components, trying to get the weighted average to be 2%. Wildly overhyped "game"?

<comment><USER11> Yeah, I don't get it either. I dragged each control to the maximum one by one, until I got to 2%. Then I clicked the button and won, even though I hadn't touched half of the controls yet. I assume there's supposed to be some underlying lesson in it....

<comment><USER12> I'm guessing the 'lesson' from your iteration is that you increased prices most on a subset of goods- housing and utilities, health care, and financial services and insurance- while leaving the rest to track their industry.

The problem with that, and with health care especially, is that the 'native' price increase already far outstrips inflation. With that monetary policy, you've introduced an extra 5% tax on already quickly growing industry. So a family going through a health care crisis or crisis of changing insurance will be affected negatively, whereas a family only buying groceries and liquor will feel no undue changes.

So that's what I'm guessing the article is saying, where can/should/will the Fed attempt to affect American savings and purchases.

<comment><USER13> Of course, the Fed doesn't make that kind of targeting decisions because monetary policy -- the only lever the Fed has -- doesn't work that way. Targeted effects are the domain of fiscal policy (where government choose to tax and spend), not monetary policy, and are the domain of Congress, not the Federal Reserve.

</comment></comment></comment></comment><comment><USER14> This "game" is stupid because it doesn't do anything at all to show the trade offs.

As a gross generalization:

Higher Growth -> Higher Employment -> Higher Inflation

High Inflation -> Negative Income Growth (for those on low wages and fixed incomes) -> Risk of Recession and/or Social Disruption

Lower Growth -> High Unemployment -> Risk of Recession and/or Social Disruption

Put those parameters in and the "game" gets interesting. At the moment it's just pointless.

</comment><comment><USER15> It's about time somebody did...</comment>


How to Hack Hotmail - <AUTHOR> http://www.quora.com/Andrew-Brown-17608/How-to-Hack-Hotmail

<comment><USER2> I bookmarked that under "hacking -> poetry"</comment>


PeepCode: Leveling Up - <AUTHOR> http://blog.peepcode.com/blog/2013/leveling-up

<comment><USER2> This is a great move by Pluralsight, which currently boasts ASP.NET as its largest source of content. Peepcode's content library is very complementary, and they are focusing on the right technologies that HN readers at least would recognize as the newest frontier in programming (Rails, Node, etc.).

Our team at Bitcast.io has had the same insight, but instead of manually curating and producing the content like Peepcode (very limited in scale), we've created an open platform where anyone can buy, sell, and upload screencasts. We're hoping that we can capitalize on some of the same success Peepcode has, in addition to expanding the screencast market and bringing it to a larger audience on both sides.

</comment><comment><USER3> Congratulation Geoffrey, the quality of your screencasts never disappoints.

</comment><comment><USER4> And in consistent PeepCode style, this announcement comes in a blog post with a unique design :)

[https://peepcode.com/blog](https://peepcode.com/blog)

</comment><comment><USER5> This is great. Just renewed my PeepCode unlimited subscription, and I'm happy to see Pluralsight expanding it's opensource connections. Best wishes going forward!

<comment><USER6> How much does an unlimited subscription cost?

</comment></comment><comment><USER7> This is fantastic news - I believe with the additional of High Quality Open Source courses, Pluralsight is now one stop resources for any Developer.

</comment><comment><USER8> Congratulations, Geoffrey.

Been a fan since you originally launched the site way back when, and learned a lot from the videos I purchased.

</comment><comment><USER9> Congratulations Geoffrey! Excited to have you on board at Pluralsight!

</comment><comment><USER10> This is very exciting news!!!! What an awesome combination.

</comment><comment><USER11> congrats</comment>


Why do we still write insecure software? - <AUTHOR> http://www.jerf.org/iri/post/2942 <comment><USER2> > (Sidebar: It is a common misconception in the programming world for some > reason that the adage "It's a poor craftsman that blames his tools." means > that someone blaming their tools proves they are a poor workman. The true > meaning of the phrase is that it is a poor craftsman that has bad tools in > the first place. A skilled craftsman does not use a dull saw without > complaint. They get or make a sharp one, without complaint. A craftsman who > uses poor tools without complaint is even poorer than the one who is at > least complaining!)

This is fantastic.

</comment><comment><USER3> No mention of the obvious answer here; because coders have jobs, employers and lives. Hence a lot of the time, code has to be written quickly and the company usually doesn't give a toss whether something's been done the 'right' way... so long as it works.

If you've got a deadline in thirty minutes, you're probably not going to try and do everything the best possible way. Same deal if you've got a family or friends to get back to, an event to go or anything else that requires you to get things done quickly.

You're rewarded more for getting things done quickly than you are getting them done properly or securely. When your client wants their site or program done as quickly as possible for a low cost, or your startup needs to 'move fast and break things'... security will usually suffer in the process.

<comment><USER4> To add to this, coders frequently have managers who don't allow time to test and improve much beyond what works, even when asked for.

<comment><USER5> Exactly! It is often that the coders are the ones pushing to do thing more correctly, but mnagemnt wants the latest feature out.

<comment><USER4> I've been multiple places where requests to fix what was broken in the production system were shot down repeatedly because there "wasn't money in the budget to fix that system".

Yet if anyone added up the manhours it took to fix the same production issues that repeatedly popped up, it would've clearly been less expensive to fix the recurring bugs.

</comment></comment></comment></comment><comment><USER6> The first thing to fix is bad tooling, yes, but it's not the whole picture.

Once all your queries are safe by default, your languages have memory safety, your templates XSS-encode by default etc etc (this is basically the situation at most sane workplaces) - there are still security issues.

There are _fewer_ security issues left, but they're gnarlier. What we see now are "application logic" and business logic issues. Overflow and language-level sharp edges exist, but these are a small proportion of the mistakes developers (in particular, web application) seem to be making.

Situations where the server unintentionally signs user-controlled data, bad OAuth2 flows, missing or incorrect authorisation checks, accepting data from the client as "validated" \- these are much more common in my experience.

The other interesting thing I've noticed is that when developers who are used to "safe by default" frameworks have to step outside the framework for any reason (e.g. front-end is 90% angular, but 10% "bespoke" JS) they will make mistakes with very high likelihood.

The solution is tooling yes, but also education and process.

<comment><USER7> I think such security issues are similar to the ones author described. They require decent language-level abstractions to disappear as well. Some sort of lightweight processes to deal with trust boundaries explicitly and easily.

<comment><USER8> What you'd need is almost dynamic live proof checkers hooked to your IDE capable of tracking the effects of code changes / refactoring to do that, linked to test cases themselves carrying proofs of testing the spec completely.

How else will you be guaranteed to catch Goto Fail and similar?

What's worse is when you hit the issue of "composability" in cryptography - two servers run different algorithms making different assumptions, and when they interact the assumptions fail to translate and neither provide the guarantee they should. Like cross-protocol attacks, such as when one server becomes a signing oracle for another.

Edit: and beyond that, we have cross architecture disagreement on results of calculations intended to be deterministic. Like how SPARC Bitcoin Qt binaries previously would have had the Bitcoin reward schedule loop every 255 years and go back to 50 coins per block and restarting the countdown.

</comment></comment></comment><comment><USER9> We write insecure software because the costs of insecure software do not fall on the companies selling it.

</comment><comment><USER10> There is actually a very simple answer to this question: We have 100's of implementations of roughly the same thing instead of just 1 implementation that is made bulletproof. Every new framework, every new HTTP server, every new language will cause another round of re-implementation and will cause yet another round of the same old bugs and security problems.

<comment><USER11> The problem with monoculture (e.g. the Irish potato famine [1]) is that the bug that takes down one machine takes down them all.

[1] [http://evolution.berkeley.edu/evolibrary/article/agriculture...](http://evolution.berkeley.edu/evolibrary/article/agriculture_02)

<comment><USER10> That's definitely a valid objection and I have absolutely no idea what could be done about that. But as it is the bug that takes down one machine today will take down other machines tomorrow and yet other ones five years from now.

So for entirely new bugs your objection stands, they could (and likely would) be disastrous. Even today a 'zero day' exploit for a major platform can be dealt with though, I don't see why we would not be able to deal with such exploits in a scenario where there is only one implementation of something, it's not as if right now we use the other implementations to keep things running, it's mostly a matter of impact all at once rather than spread out over time and infinitely repeating.

<comment><USER12> >Even today a 'zero day' exploit for a major platform can be dealt with though

But they can only be dealt with once they're discovered by people with an incentive to fix it. The NSA _says_ they weren't using Heartbleed[1], but I can't think of a single reason they wouldn't lie about it. In any case, that was a massive security flaw that could have conceivably been exploited for _more than a decade_. If it affects 30 percent of systems instead of 90 percent, that seems like worthwhile hedging of bets.

[1] [http://www.engadget.com/2014/04/11/nsa- heartbleed/](http://www.engadget.com/2014/04/11/nsa-heartbleed/)

<comment><USER10> Afterthought: If we really only had _one_ implementation of something _all_ our energy could go into making that one thing really good, which might even push the quality beyond the point where zero days would be an issue.

</comment></comment></comment></comment></comment><comment><USER13> > int8(100) + int8(100) = -56

is just one possible answer. Signed integer overflow depends on signed integer representation in go (it's undefined for unsigned integers in C):

[https://golang.org/ref/spec#Integer_overflow](https://golang.org/ref/spec#Integer_overflow)

So the SafeAddInt8 in the blogpost may not be correct on architectures that use really strange representations.

Lots of C developers that wanted to make their code safer ran into a related trap in C. There it's totally undefined and the compiler may just throw the check out all together.

I wonder why Go doesn't just define signed integers to be in 2's complement representation. Are there any architectures out there that use something else for integers?

<comment><USER14> > (it's undefined for unsigned integers in C):

No, unsigned integer overflow is defined to wrap around in C. Only signed integer overflow is undefined.

> I wonder why Go doesn't just define signed integers to be in 2's complement > representation

It does: "The value of an n-bit integer is n bits wide and represented using two's complement arithmetic" (from [https://golang.org/ref/spec#Numeric_types](https://golang.org/ref/spec#Numeric_types))

<comment><USER13> You're right, I wanted to write signed integers.

I wonder what they mean with representation in the spec then?

</comment></comment></comment><comment><USER8> Define what's secure first. Any unintended behavior can become a security flaw, and there will always be unintended behavior in anything complex.

<comment><USER2> He actually addresses this.

</comment></comment><comment><USER15> Stop complaining and use Ada or [https://en.wikipedia.org/wiki/SPARK_%28programming_language%...](https://en.wikipedia.org/wiki/SPARK_%28programming_language%29). There is also a web Server in Ada: [http://libre.adacore.com/tools/aws/](http://libre.adacore.com/tools/aws/)

</comment><comment><USER16> > Whether you want an exception or an error or some sort of Either/Option type > or whatever depends on your language, but something ought to twitch here.

The problem with handling integer overflow is that the mechanisms for it are clunky. Is there a programming language that handles integer overflow using a better mechanism than those listed? (I mean without resorting to a BigNum.)

</comment><comment><USER17> Its really simple, my boss said I have to have done in 3 weeks what takes 3 months.

</comment><comment><USER18> Because software is meant to be written by computers, not humans.

</comment><comment><USER19> Because the underlying hardware MMU can't prevent one process from accessing memory that don't belong to it.</comment>


EBay v. Newmark: Corporations Are Legally Required To Maximize Profits - <AUTHOR> http://www.litigationandtrial.com/2010/09/articles/the-law/for-lawyers/ebay-v-newmark-al-franken-was-right-corporations-are-legally-required-to-maximize-profits/

<comment><USER2> I'll repeat the commentary I left on Kennerly's blog (which is always a great read, by the way):

\</comment><comment>- This debate is fascinating.

Conservative commentators like Bainbridge et al should be taking the stance that eBay loses this case because an investor takes the company he invests in, poison pills, staggered board--presumably minimized profit aspirations--and all. More-liberal commenatators on the other hand should be crying foul at the blatant shareholder disenfranchisement. But those roles are reversed. Which just goes to show how weak legal arguments are in the face of moral instinct:

Disenfranchisement is okay--you take the company you invest in--when the company is doing something good. Minority-shareholder activism is okay--you aren't bound by pre-existing rules--when the shareholder is trying to do something good.

</comment><comment><AUTHOR> Be aware of this if you incorporate and take investment.</comment>


London YC/Hacker news Meetup  - <AUTHOR>

Anyone know if there is a London YC/Hackernews meetup? If not, anyone interested in meeting up somewhere in London? <comment><USER2> I frequently travel through London and have several times suggested a meeting. I've rarely had a response, but I'm interested in trying again. I'm not based in, or even near London, but, as I say, travel through reasonably often.

I will be in London February 8th and 10th, and March 3rd. Possibly others as I go through to somewhere else.

</comment><comment><AUTHOR> Cool, well would defiantly be up for meeting people. March 3rd sounds like a good day for me. How does that fit in with everybody? Anyone know of a good way of organising this?

<comment><USER3> Facebook :-)

</comment></comment><comment><USER4> I'd potentially come down from cambridge for one if the date/time worked out.

</comment><comment><USER5> I'd probably come too if the date worked

</comment><comment><USER6> I'd come. I'm sure swombat would too.

</comment><comment><USER3> I'm probably around then.

</comment><comment><USER7> Count me in.</comment>