The Government Wants A Backdoor Into Your Online Communications - <AUTHOR> https://www.eff.org/deeplinks/2013/05/caleatwo <comment><USER2> For those who are skeptical about these conspiracy theories, I've tried to explain why large vendors accede in a previous post and got great skeptical questions: <https://news.ycombinator.com/item?id=5706695>

tl;dr -- Most large public services you use (Skype, Exchange, likely Gmail, etc) have backdoors.

Large vendors believe they have to respond to subpoenas or face public obstruction or co-conspiracy charges. As a result, they place these backdoors to avoid the PR or believe they are required to play by the US govt's rules. They may not be realtime backdoors, and they may require a bunch of processing, but it is possible to read most messages sent through large, popular systems (both voice and text like email, sms, chat). I think everyone is waiting for a major court ruling or congressional bill to clarify what's what.

snippet of previous post to explain the vendor's mentality:

> The govt comes by with a subpoena (secret, classified, or public) and > requires Microsoft or the customer company to produce communication records > that exist in a form that may be used as evidence. Failure to do so is best > contempt of court and worst obstruction of justice. No 5th amendment > privilege for other people's crimes [and prior to last year's ruling, it was > assumed that passwords (or private keys) could be compelled for _any_ reason > in the US, and systems were built with that assumption]. So everyone who > chooses to store or process messages makes it so the encryption is > reversible and they can honor court requests. Nothing is private as a > result.

> There is not yet a way to build a messaging service that has both features > [content-aware features like URL detection, spell-checkers, web browsing for > dumb clients, targeted ads to fund free services, etc] AND [pure] privacy > [in the US].

<comment><USER3> _(I'm one of the guys that was talking with you in that link)_

To be clear, I think that vendors make their services "backdoorable" because they want to extract revenue from them and attract consumers. Once they have the capability, the government can then capable of compelling them to comply. I don't think the government is compelling them to build the capability in the first place.

To use a concrete example, Bitlocker is presumably not backdoored by Microsoft and I don't believe that the government has any (public) laws that would allow them to compel Microsoft to modify Bitlocker in such a way. Microsoft's refusal to backdoor Bitlocker could not get them into any sort of official trouble. If Microsoft had Bitlocker backdoored already for whatever reason (say, customer service data recovery), then the government could compel them to comply them to unlock drives.

I don't think we really disagree on anything substantial.

<comment><USER4> _To be clear, I think that vendors make their services "backdoorable" because they want to extract revenue from them and attract consumers._

I disagree. Most are "backdoorable" because it is easier to build a service that way.

For instance consider gmail. The hard requirement is that a person armed with a user name and password can login from a browser and get access to that email. The common requirement is that a person armed with the right cookie can get that email. Now in theory you could encrypt all of the emails on the server, but now your operations costs went through the roof. However if you store them in plain text then you can use smart indexing, and your operations costs are much more manageable.

However once you've decided to have plain text files on your server, EVEN IF you aren't doing anything with them other than storing/sending them to the user, you're now able to backdoor those files, and hence can be compared to by a court.

There have been many email systems out there. Open source (qmail, sendmail, etc), proprietary (Exchange, Dovecot, etc), hosted in the cloud (Hotmail, Gmail, etc), hosted at your company (Exim, Oracle Communications Messaging Server, etc), built on top of platforms not meant to do email (Lotus Notes being a prime example) and so on.

Every single one of the ones I named and many, many, more stored data in plain text and legal discovery could be compelled on them. Simply because that was the easiest way to build them. There are exceptions, but they are exceptions because they were meant to be. Hushmail comes to mind. However even there, even when it was designed to store data in encrypted format, if the government can find a way to force you to extract data, they will push you to do so. (See <http://en.wikipedia.org/wiki/Hushmail> for a description of the way in which the government got Hushmail to capture plain text, even though the data was stored in plain text.)

The moral? Often the government has access not because evil profit-mongering corporations did wrong, but simply because obvious technical decisions leave them able to do so. And this can be true even when those corporations made a good faith effort to make that impossible.

<comment><USER5> This is well said. The thing is, though, that it was the non-Java version of Hushmail that was exploited by the Feds. The fact that it could be exploited shouldn't cast the end-to-end secure version in a negative light.

So who at Google is going to code an encrypted Gmail in their 20% time? Paid, of course, because the server won't know what ads to show. (You could put that intelligence in the client, but it seems a privacy-sensitive clientele wouldn't like even that info to leak.)

<comment><USER6> I'm sure Google already has an encrypted version of their Gmail service, but why would they shoot themselves in the foot and loose all that Ad revenue?

You _could_ put that intelligence in the client, but there is only so much analysis you do do using JavaScript, I'm sure the computing power they have available on their servers is phenomenal, and add to that a huge databank of information they have available to be able to better match those ads to you. And you've already mentioned the privacy issue...

<comment><USER5> Google would choose to lose "all that ad revenue" if they could replace it with sufficient, and probably more lucrative, non-ad revenue through paying customers.

</comment></comment></comment></comment></comment></comment><comment><USER7> Boiling frog. As long as digital freedoms remain unlegislated, government will circumscribe ever-shrinking boundaries with and without the help of industry. It will continue forever until and unless the freedoms are enshrined into law.

</comment><comment><USER8> Backdooring major services may lead to the mass adoption of encrypted systems. Not immediately, of course, but after the leaks start. Who'd use a backdoored Google Drive for proprietary information when they could use SpiderOak?

Can't stop the signal, Mal.

<comment><USER9> The FBI is asking for backdoors on the client side of secure communication systems. Did you think they forgot about the 90s?

The difference today is this: lots of people are buying restricted computers (tablets, smartphones, even some laptops), and it would not be hard for the government to push backdoors into software distributed via the "app store model." This time there is actually a chance of the Justice Department getting their way.

<comment><USER10> Android is not restricted, not yet at least. But I see your point, and it's rather alarming.

<comment><USER11> Unless you create your own raspberry pi to used as a (sanctioned from you) mitm proxy that encrypts the paintext on any communication you send to the online services. So basically google get already encrypted mail that only the receiver can decrypt.

So it will go like this - I write hi on the IM client, the Pi intercepts the protocol unpacks the hi encrypts it with the private key, sends some base64 to the server who then translates it to the receiver that has similar device installed which does the decryption.

It is not perfect but it can be done. And I am sure Mr Schneier can think of something much better in its sleep.

</comment></comment></comment></comment><comment><USER12> Open-source end-to-end encrypted communications. Using it is not rocket science. You should not trust legislation and goodwill of service providers for your privacy. Take the power to your own hands.

<comment><USER13> Can you share all the effective and easy to use tools you know here please?

<comment><USER12> GPG is the number one tool of course. For IM-like functionality OTR (over XMPP) seems to be the preferred protocol, you could use eg Jitsi as the client. For (mobile) voice there is RedPhone and SilentCircle. Both are fairly new so I wouldn't be 100% confident on them but they are made by experts and lay on very strong foundations.

</comment></comment></comment><comment><USER14> Could some hackers please hack the police wiretapping systems already in place the government doesn't seem to understand the threat to our security and anonymity this poses without a demonstration.

No system is completely secure including the wiretapping system which introduces one point of failure not to mention incredible power for a not so benevolent dictator.

If Hitler were alive today we would all be screwed by now so how long do you reckon it would take for another man like him to rise to power? I would give it maybe 5 generation and I'm being generous here. Given how China is behaving right now drunk on power i don't think we're going to have to wait that long.

</comment><comment><USER15> Do there yet exist tutorials that the average Joe can follow for PGP/GnuPG?

<comment><USER16> That they can follow? Yes. I think Gwern's got a fairly simple rundown on her silk road article on her website. That they can make practical use of for day to day? Not really, no.

</comment></comment><comment><USER17> I agree crypto on personal and business communication by default would be great, but it won't do much to truly protect the data from national security.

If using NSA approved crypto they'd love that such as RSA.

It's newer algorithms like PGP in the 90's that actually protect (or did) or extreme military grade encryption. Trapdoors and algos that can be broken by the NSA are more preferred and don't get the Zimmerman treatment because of that. If I were the NSA I'd do the same thing, it is their job.

There really is no way to fully encrypt that isn't undoable by the NSA. As long as it is only the NSA and not some other competitor spying on business ideas and private communications. Trapdoors for national security are typically in the software or a known flaw that makes it easier to decrypt and recover this information, obtain keys or enter the system to trigger and get the needed information to reverse. There are ways to trigger these modes within the software, software to be used by the NSA has to be approved by them. There is a reason you are subject to all sorts of scrutiny if you don't use approved algos/software wherever you do encryption/decryption (even when you upload a new app you are asked this and can cause problems if you aren't using the system crypto libraries).

<http://www.rsa.com/rsalabs/node.asp?id=2188> <http://www.rsa.com/rsalabs/node.asp?id=2240>

If you want to test this, simply make your own crypto lib and send some comms to a bad place in current geopolitics (I don't recommend it). Soon you will get a visit from the FBI and you may get the Phil Zimmerman treatment. Again, can't fault them, it is their job, but understand nothing is truly secure from national security. Yes it might be impossible for other businesses to read it or individuals but not the organization that employs the greatest cryptographers of all time.

<comment><USER18> Where do you get the claim that NSA can reverse cryto that is generally believed unbreakable? Maybe you meant to refer to DSA, which is deprecated, in this line: "If using NSA approved crypto they'd love that such as RSA". RSA is used today for SSH keys.

How about links supporting the claims about NSA? I don't doubt they're trying to break any encryption as far as possible, but the statement that they definitely can break anything needs some evidence.

<comment><USER17> The algorithms may be secure, the software isn't always, much like backdoors in software so to can the libraries that do the encryption even outside the software (Windows even had an NSA backdoor in the 90's - [http://slashdot.org/story/99/09/03/0940241/nsa-backdoor- crea...](http://slashdot.org/story/99/09/03/0940241/nsa-backdoor-creates- security-hole-in-windows)). They confirm nor deny this but I ask you if you were a national security cryptography agency what would you be doing?

Some papers on some techniques, even modes that make weaker key generation: <http://www.cryptovirology.com/cryptovfiles/newbook.html>

The last real non NSA approved system was PGP in early 1990's, look up Phil Zimmerman and understand that if you create a system that the NSA has trouble peering into if needed (sometimes with considerable processing power) you will be contacted.

<http://www.rsa.com/rsalabs/node.asp?id=2316>

"As the premier cryptographic government agency, the NSA has huge financial and computer resources and employs a host of cryptographers. Developments in cryptography achieved at the NSA are not made public; this secrecy has led to many rumors about the NSA's ability to break popular cryptosystems like DES (see Section 3.2), as well as rumors that the NSA has secretly placed weaknesses, called ``trapdoors,'' in government-endorsed cryptosystems. These rumors have never been proved or disproved. Also the criteria used by the NSA in selecting cryptography standards have never been made public."

There would never be definitive evidence and if so it would cause huge problems, for most communications including fast SSL/HTTPS exchanges for business or regular private communications this is not a worry. Most encryption is good enough for that level of communication, there is a reason though the military for sensitive information is using much greater levels and systems for crypto than consumer grade. Just don't be naive to think the NSA can't right now read all of your communications encrypted or not through many avenues trapdoors, backdoors in libraries, taking over computers to get private keys (all keys are stored somewhere and all passwords have to be typed in at some point) etc.

<comment><USER19> Do you have any further info on "the military for sensitive information is using much greater levels and systems for crypto than consumer grade"?

From what I understand, the DoD standard is AES 128.

<comment><USER17> For commercial and FIPS supported that works, also for SECRET data. AES 192 and 256 are approved for TOP SECRET data. [http://en.wikipedia.org/wiki/Advanced_Encryption_Standard#Se...](http://en.wikipedia.org/wiki/Advanced_Encryption_Standard#Security)

However I am pretty sure noone is uploading target coordinates or guiding missiles using AES 256 even, it seems. I could be wrong but I would assume something greater.

It is assumed the NSA, other than side channel attacks, cannot break AES as of 2006, still it is getting close.

"AES has 10 rounds for 128-bit keys, 12 rounds for 192-bit keys, and 14 rounds for 256-bit keys. By 2006, the best known attacks were on 7 rounds for 128-bit keys, 8 rounds for 192-bit keys, and 9 rounds for 256-bit keys.[11]"

</comment></comment></comment></comment></comment><comment><USER20> You know, part of me wants this to happen. It will force a lot of high profile technology companies (and spawn new ones) to adopt end to end asymmetric encryption. Of course, this is idealistic, but there could be some good to be gleaned from it.

<comment><USER21> Huh, I had the opposite interpretation. If you have end-to-end crypto then you'd have to add a backdoor, but if you have weak or no crypto then your system will need little or no change.

</comment></comment><comment><USER22> I actually feel much worse with the fact that large corporations with no oversight, who knows what kind of security, no counter-intelligence and little if any background checks on employees, have a front-door entrance to my data. Think about this: how hard would it be for a crime organization to put some Google employees on their payroll and use them to get personal information on just about anyone. How hard would it be for them to threaten a Google employee to provide them with information? So now the government wants in? Join the party.

I'd actually be happy, though, if the government put in place some/more regulation on companies that collect so much personal data.

<comment><USER23> It is difficult to get traceable user information at companies like Google. In my experience startups do little or nothing to protect this data. They also would be the ones likely to put a vulnerable backdoor in a product just to meet some government mandate.

</comment></comment><comment><USER24> This is why we should use Bitmessage.

<https://bitmessage.org/>

PPA for Ubuntu or Debian:

<https://launchpad.net/~fuzzgun/+archive/pybitmessage>

</comment><comment><USER25> Encryption is hard to implement right, but by its nature, it can be implemented at the ends, outside of the transmission network.

Ironically, one of the groups working hardest to enable and promote end-to-end secure communications technology is NIST, ie, "the Government."

<comment><USER26> >Ironically, one of the groups working hardest to enable and promote end-to- end secure communications technology is NIST, ie, "the Government."

I don't see the irony. It's just the nature of government. The government isn't one person, it's competing factions with conflicting interests.

The ideal in cryptography is to minimize the attack surface and eliminate vulnerabilities. If NIST adopts poor cryptographic standards which fail in that regard then they lose face and risk having their dominion over those matters reduced. Their incentives therefore align well with those of the general public.

On the other hand, the FBI's job is to put humans in prison. Security vulnerabilities are their friend because they're often legally allowed to exploit them. And as a bonus, the bad guys can exploit them too -- more bad guys (real or imaginary) means larger law enforcement and defense budgets.

<comment><USER25> Agreed, this was what I was pointing out. Government is a complex and multifaceted enterprise, but people often treat it as a monolith, especially in conspiracy theories.

There's a great line in "What Chinese Hackers Get Wrong About Washington:"

 _This is the most pervasive of of all Washington legends: that politicians in Washington are ceaselessly, ruthlessly, effectively scheming. That everything that happens fits into somebody's plan. It doesn't. Maybe it started out with a scheme, but soon enough everyone is, at best, reacting, and at worst, failing to react, and always, always they're doing it with less information than they need.

That's been a key lesson I've learned working as a reporter and political observer in Washington: No one can carry out complicated plans. All parties and groups are fractious and bumbling. But everyone always thinks everyone else is efficiently and ruthlessly implementing long-term schemes._

[http://www.washingtonpost.com/blogs/wonkblog/wp/2013/02/25/w...](http://www.washingtonpost.com/blogs/wonkblog/wp/2013/02/25/what- chinas-hackers-get-wrong-about-washington/)

</comment></comment></comment><comment><USER13> Given that the Government has already back-doors in nearly all of your communication. How would they utilize it? What would their benefit be?

That's nothing but Psychopathic behavior!! Someone wanting to know everything about you, just because there could something be that could harm you, or there could something be that you could use to profit from. That's sick!

You put 99,9% of the population into quarantine, because 0,01% is infected, thus harming all.

Then there is this obsession of some even more psychopathic citizens that act as a voluntary traitor, just to get attention. Remember the volunteers who helped to reveal the identities of demonstrators in the UK.

When I see an IT-Expert, I won't ask him to fix my computer just because he can, but people do. They don't care about the time and effort someone has to offer for you for free. They require it, because they believe they can require it. IT-Experts usually don't have high self-esteem which allows many people to put knives into the backs of those IT-Experts. That's the same egoism that the Government has, it believes to stand above the human rights.

Well it's sad, but in the US you've given up on privacy more or less, because everybody thinks about his own profit and not being willing to share a dime of your profit, even in theory, allows politicians to reform the law into something stinky. But politicians profit from doing that, because the suggest stinky compromises. Someone has to break this cycle. If I said that in an uneducated channel, people would say: "stupid communist" or something. But in reality I believe that people should just be friendlier to each other. Why is that so hard to understand. :( This makes me truly sad.

I live in a world where I have to use simpler and simples words, just because my surrounding doesn't understand common words anymore. The overall IQ is getting lower and lower, so low that I cannot use metaphors, sarcasm, irony and even folk wisdom anymore, because people are completely unaware of them. Knowing that these people would accept this law, because they don't care, don't read, don't think on their own is sad. People don't start thinking on their own, they agree on others or more popular people say, as if this was fully acceptable and logical. I am so happy when I hear about services like <http://udacity.com> because I hope the next generation won't dumb down like this generation. Way too many children fail at school, way too many pupil don't get higher education. The gap is becoming greater, your heritage becomes your identity.

Orwell laid it out dangerously obvious in his novel. Most of it got real. Let's hope that the day "Lies" become "Truth" never arrives.

We blame China, while we export the technology for it. We blame China while we implement that censoring infrastructure into our own Governments.

Hypocrites.</comment>


Hacker Yoga – Part 0: Arms - <AUTHOR> https://gun.io/blog/hacker-yoga-part-zero-arms/

<comment><AUTHOR> I'd love your feedback on these!

Please actually try to follow along with the little routine and let me know if it helps you out! I do this every day and it really makes my back feel better.

If there's enough interest, we're going to a whole little series on little things to help improve keyboard-induced shoulder, back and wrist strain.

<comment><USER2> <3 hackers <3 yoga</comment></comment>


Show HN: Automatically share your stock trades with your close family or friends - <AUTHOR> https://swarm.trade <comment><AUTHOR> We are excited to share with you what we have been busy building over the past few months. We call it Swarm!

We created Swarm to give the average investor (like us!) a better shot at making money in the stock market. Sure there are a ton of research and investment analysis tools out there, but if you're like us, you are overwhelmed by all of the information and don't know who to trust or what to believe.

We built Swarm so that we could talk to people we trust transparently about what investments we are making, and use their insights to help us make smarter decisions.

Swarm is really easy to use: Securely link your brokerage and create your Swarm (your private group with only the people you trust). Next time you trade, we automatically group-text your transactions to your Swarm. The sharing goes both ways — you'll also see the trades others in your Swarm are making! Start discussing your trades and learn from others you trust.

We take privacy and security seriously. We only share with your Swarm what you are trading — we do not share how much money you are investing. We use Plaid to connect to your brokerage to ensure security. Please note that our automated texting service isn't real-time. Because we use Plaid, there is usually a delay in automatically texting your trades to your network. Also note, we only support USA currently.

It's free to use. Give Swarm a try! We think you'll love it.

Have ideas for how to make Swarm better : [https://swarm.nolt.io/top](https://swarm.nolt.io/top) Connect with us on Twitter: @swarm_investing

<comment><USER2> > _We created Swarm_

Who created Swarm? There are no names on your website as far as I can tell.

> _We use Plaid to connect to your brokerage to ensure security._

Plaid is (maybe) secure _connection_ to my account. It enables you to scrape my account without storing my password.

None of that tells us whether our data is secure or private with you. You say that the data is encrypted, but is it encrypted at rest? Can your developers see my data, or does it require a key from one of my devices?

(Full disclosure: I have no interest in day-trading or taking investment cues from what friends/family are doing. I've just done a lot of work in FinTech and have an interest in security.)

<comment><USER3> Hey Co-Founder here!

We are listed on this page: [https://app.swarm.trade/register](https://app.swarm.trade/register) \- you can see the three of us responsible for this product.

We do encrypt at rest leveraging Amazon RDS + logging / monitoring safeguards to prevent unauthorized data access, and are currently investigating starting a SOC 2 Audit.

Due to having to push out the trades through text messages we do have read access to the data (need to push it through our Swarm Bot).

Let me know if you have any other questions! What have you worked on in the FinTech space?

<comment><USER2> > _What have you worked on in the FinTech space?_

Web apps for banks, Plaid-like scraper/API for non-US markets, reporting, web payroll... nothing particularly revolutionary or interesting.</comment></comment></comment></comment>


DigitalOcean enables Amsterdam 512MB and 1GB Droplets - <AUTHOR> https://www.digitalocean.com/blog_posts/amsterdam-512mb-and-1gb-droplets-are-enabled

<comment><USER2> Why is DO so slooow today?

<comment><USER3> Everyone is buying Amsterdam Droplets.</comment></comment>


Why numbering should start at zero (1982) - <AUTHOR> http://www.cs.utexas.edu/users/EWD/transcriptions/EWD08xx/EWD831.html? <comment><USER2> That's on the front page right now already...</comment>


There Is Blatant Racist and Sexist Language Hiding in Open Source Code - <AUTHOR> http://gizmodo.com/5980842/there-is-blatant-racist-and-sexist-language-in-github-code

<comment><USER2> Although I this shouldn't be encouraged, banning their accounts would be limiting sharing. Also, moderation would be a nightmare for GitHub.

Additionally, it's somewhat hypocritical for Gizmodo to be posting this article.</comment>


Ask HN: What's everyone's obsession with NDA's? - <AUTHOR>

What's everyone's obsession with NDA's? As a freelance developer I am constantly running into people who absolutely insist that I must sign an NDA before we can either discuss their project.
My questions:
-Do you all run into this a lot?
-What do you say?
-Do you flat out refuse to sign and refuse to back down like me?
I think NDA's are arbitrary and unnecessary and I'm of the mind that if the person is so caught up on this they probably aren't worth working with. <comment><USER3> I used to get nervous about NDAs. My programmer's mind was always coming up with arcane problem cases. In practice NDAs are treated pretty simply - <USER2> you're under NDA with someone you dont talk about their stuff.

My suggestion: find/develop a lightweight NDA that you _are_ willing to sign, rather than fighting a battle all the time. NDA's can range from impossibly restrictive to nearly inert with a few small wording changes. If someone insists on a weirdly restrictive NDA, they're probably a dick to work with anyway.

Nobody goes back to look up the wording in the NDA. They just store a single bit in their mind, "under NDA". And rightly or wrongly, that bit is pretty important to many people.

<comment><AUTHOR> That's a good idea for a compromise in this situation. Do you have a sample NDA that you could share?

<comment><USER3> If you like I can talk you through the major items that I look at when reviewing an NDA. My email address is in my profile.</comment></comment></comment>


Tech Sector Feeling Covid-19's Economic Pain - <AUTHOR> https://www.hiringlab.org/2020/07/30/tech-sector-covid19-impact/ <comment><USER2> Side-note for people switching work, move your money from your direct deposit account before starting a new job.

I was talking to a security researcher about a friend who had a full interview with a company, sent papers for hiring, filled everything out, and then discovered the company she was interviewing for was named similar to a real company, with the only difference being a hyphen in the website name. The company was fake and once they had direct deposit information, drained her bank account. She was lucky there was only ~$1k in it. still.

Do your due diligence. Be careful out there.

<comment><USER3> How do you drain somebody's bank account with deposit information?

<comment><USER4> Deposit information in the US is account number + routing number, which is all that is required to pull funds from an account. Amusingly, this is also the information printed at the bottom of every check you use.

<comment><USER5> Wow. I don't intend to be inflammatory, but I am continually shocked by how far behind Europe the US appears to be in terms of personal banking and payments.

<comment><USER6> It is literally the same in Europe, via Stripe:

[https://qry5s.sse.codesandbox.io/](https://qry5s.sse.codesandbox.io/)

Any name Any email address Test account number: DE89370400440532013000

<comment><USER7> You can only PUT money in a bank account knowing the IBAN in Europe. Automatic payments have to be formally authorized first. Europeans give it their ibans without second thoughts, never heard of any such problems as in US.

<comment><USER6> It is called SEPA Direct Debit. You give people your IBAN, and they can take money from it. You formally have to give your permission of course (the "mandate"), but that is really a pinky promise by businesses that they have it. That there is not wide-spread abuse of this system seems to be because of accountability on who is granted access to this system.

I would imagine the situation in the US to be quite similar.

</comment></comment></comment></comment></comment></comment></comment><comment><USER8> Anecdotal but in Montreal,Canada it's a very different situation. Recruiter calls, number of jobs posts are much higher in the last month or so (despite summer vacations). Many companies from San-Francisco reaching out. Is it because in Canada the Covid-19 spread is under control or because it's all remote now so why not Canada?

<comment><USER2> This is what people are afraid of. If you live in a city where you have IT salaries over 100k (Seattle, San Fransisco, Chicago), companies may be using this as an opportunity to hire 'cheaper' workers in markets where you don't need that type of income to pay rent.

There was a lot of hiring early on. We might see big tech layoffs come August/September.

<comment><USER9> > companies may be using this as an opportunity to hire 'cheaper' workers in > markets where you don't need that type of income to pay rent

That's not a bad tendency in the long run. In case remote work gains serious traction, tech workers would be eventually dispersed around the whole country, and that would drive down rents in previously expensive areas. With workers living in less expensive places, they wouldn't need an SV salary to afford a good lifestyle.

<comment><USER10> > they wouldn't need an SV salary to afford a good lifestyle.

While I agree you wouldn't need to worry about affording SV-grade housing costs, I feel like these discussions leave out a couple of things:

* The CoL is going up _everywhere_. Food, medical care etc... None of it is getting cheaper.

* Good houses in good school systems with reasonable access are still expensive in many areas of the country.

* It's kind of ridiculous to see companies pushing the narrative that they can suddenly pay everyone less based on arbitrary geography when the average revenue/profit generated per engineer is often many, many multiples of their total compensation costs.

<comment><USER11> This isn't true. The costs of some things are going up while others are going down. Transportation is much cheaper, for example, even without taking into account remote work. The cost of cars, gas, and auto insurance is lower than it was 20 or 30 years ago when adjusted for inflation. Education and Healthcare are getting dramatically more expensive. Clothes are much cheaper, and the cost of consumer goods in general is decreasing a lot. Think about how much a microwave cost in 1980's.

<comment><USER10> I'll concede that some durable goods are cheaper adjusted for inflation.

But at the end of the day, what has the most impact on socioeconomic mobility and overall success? It's probably not a cheap microwave.

It's access to good schools, health care, and diet. All of the things that are getting _more_ expensive.

Cheaper gas and clothes also have hidden(less so now) costs in pollution and ethical sourcing concerns.

<comment><USER11> Good point. I'd strongly prefer cheaper healthcare and pricier gasoline to cheap gas and cost-prohibitive healthcare.

</comment></comment></comment></comment></comment></comment></comment><comment><USER12> Hmmm...well the facts are what they are, but based on the number of job postings and recruiter calls I'm seeing, it sure doesn't seem much lower. I got a new job starting in early June, and it didn't take any longer than normal (I admit I was probably lucky).

One factor might be that I prefer to work as a contractor, and get my own health insurance; it might be different if you're looking for "permanent" employment. Perhaps employers are more willing to hire someone they've never met in person, if it's as a contractor?

</comment><comment><USER13> The recruiting dept of a lot of companies are only pretending that they're hiring to justify their own existence as long as possible.

Many actually are not, though not all of them even know that they are pretending until it goes to VP/exec for final sign off and they find budgets/priorities have "shifted"

<comment><USER14> That would weed out the worst companies and VPs fairly quickly

<comment><USER13> I agree on the weed out, I have less confidence in the quickly. Bigger companies move at glacial pace and most are going to do everything they can to not let on that there are any problems at a group/division/whole enterprise level.

</comment></comment></comment><comment><USER15> I'm worried this will really damage tech workers in the USA. I'm in meetings with overseas clients most of the day and it's getting to the point that some are back in offices and we're still locked in our kitchens. Mental health seems to be crashing if you judge by Twitter peers. I'm in the same boat. I've been locked in an apartment alone for 6 months outside of grocery grabs and some outdoor hikes and it's starting to really affect me.

Its so embarrassing and I'm nowhere near as productive as I should be. Most of my EU peers are probably having to take up the slack.

<comment><USER16> From what I see--and admittedly a fair number of the people I know and work with were largely remote before this--many offices at least in the US are never going back to "normal." Most of the people I know are planning to be primarily remote indefinitely. Which means that even those who do go back into an office will have to deal with a largely distributed workplace.

<comment><USER17> And, importantly, competing on the global stage for talent, rather than only against people who are commuting distance to a glass and concrete temple.

<comment><USER11> I think we'll see the beginnings of a regulatory moat in the not too distant future.

Tech workers have the benefit of hindsight, having seen U.S. manufacturing jobs get decimated in the last few decades.

A lot of fields already have built in protection from foreign competition. For instance, most if all states require that anyone conducting telemedicine work needs to be both licensed in the state were the service is being performed.

Given the leftward drift of the Democratic party and Republican's newfound disdain for the big tech companies and things like HB1 visas, I would be shocked if we don't see some significant restrictions on how foreign workers are used in the tech sector.

<comment><USER16> A lot of US tech people wouldn't be happy if the government started requiring, say, Professional Engineer licenses (which in turn require 4 year degrees) for a lot of positions.

<comment><USER11> Fair enough, but the trend in everything does seem to be in favor of increased "credentialization". Heck, you need a license just to paint someone's toenails for a few bucks. And in most cases the primarily benefit of credentials is to limit and control the number of individuals in a given occupation. An added benefit goes to rent seekers like governments and credentialing services make a pretty penny too.

</comment></comment></comment></comment></comment></comment><comment><USER18> Odd message given the timing, one day after tech giants announce strong quarterly results.

<comment><USER19> Most of the US tech space is still booming right now, from big tech to the dozens of large cloud companies that have been reporting between good and stellar quarterly results.

We'll see if this article's premise holds any water over the remainder of the year, for now it's weak.

<comment><USER20> "booming" does not mean hiring. With the next few months being very uncertain, prudent companies have paused hiring to help control costs.

</comment></comment></comment><comment><USER21> Is this due to the economic conditions? I feel as though companies might be holding off on hiring because the logistics of hiring & onboarding someone remotely is extremely difficult, doubly more so in tech.

</comment><comment><USER22> I don't know how much closer to reality this is. I can see tech hiring probably slowed down but my guess is it's opportunistic. The companies that are doing poorly before the pandemic simply cut jobs. I don't see a real impact on the market. Of course I do realize I am arguing against data here and saying stuff without evidence but the sample size is small for the data and it's a gut feeling that it will not hold long term.

<comment><USER11> I don't know if you're necessarily arguing against data. Data is a funny thing and it can lie very easily. For example, the following statement is data- driven and technically true, but a complete lie at the same time:

"Newborn baby's have _on average_ one testicle"

I think you're right about it being opportunistic, at least that's what I've observed.

<comment><USER23> Certainly it's slightly less than one.

</comment></comment></comment><comment><USER24> Is this actually so pronounced? If you look at the "Mixed bag for tech positions in tech hubs" table, the change in tech postings trend looks more or less the same as the change in all postings trend (I bet it's not even stat sig). Reading the article, the claims being made are not even strong ones.

</comment><comment><USER10> I don't want to dismiss this post out of hand, but the last few instances I've spent any time browsing Indeed, it did _not_ strike me as representative of the tech hiring market.

Where's the LinkedIn data?

<comment><USER25> I have the same sentiment, Indeed does not seem to be a representative source for the tech jobs market. I have an impression that most postings there are for staffing firms and the number of their posts do not correspond to the actual vacancies (they might be all posting the same job or post fake jobs to collect resumes).

The drop could be just the result of some of those firms ceasing their activity as I definitely don't see as many CyberCoders and whatever was that bot, which automatically reposted vacancies on Linkedin (JobNetwork or something), in the recent months.

</comment></comment><comment><USER26> We are all hoping the following plan will work:

1\. Government supports the economy while vaccines and treatments are developed.

2\. ???

3\. Economic activity returns quickly to pre-pandemic levels.

There's no "guarantee" this plan will work... but we are all acting as if it will, because the alternatives are too unpleasant to contemplate.[a]

So, much of the economy is "faking it until we make it."

The tech sector is no exemption.

\--

[a] We all prefer not to think too much on the possibility that large swaths of the economy could remain under stress for a long while -- office buildings, malls, retail stores, restaurants and bars, movie theaters, airlines, conference centers, etc. These businesses employ a gazillion people, use a mountain of assets, and depend on a ton of software and technology for everything. We all want these businesses to survive as intact as possible so they can thrive in a post-pandemic world and continue to buy technology.

<comment><USER27> I think there's reason to be confident it'll work. In many areas people rushed back to those things even before the pandemic was over. I'm not saying this was an unreasonable concern to have, but it seems to have been disconfirmed.

</comment></comment><comment><USER28> Stocks would say otherwise</comment>


VisualCaptcha for Wordpress released - <AUTHOR> http://wordpress.org/extend/plugins/visualcaptcha/

<comment><AUTHOR> visualCaptcha is an innovative concept (drag & drop existed, yes, but no complete captcha like this one) on Captchas.

Try it out and leave feedback. You have it available for any PHP site (non- Wordpress) on <http://visualcaptcha.net></comment>


Seeding torrents from S3 - <AUTHOR> http://blog.celingest.com/en/2014/03/20/seeding-torrents-s3/?media=HNrgr6may

<comment><USER2> This is probably an incredibly expensive way to seed torrents. There are any number of seedbox providers who will give you several hundred GB of storage, several TB of traffic, and much higher speeds for a flat rate of ~$15 a month.

</comment><comment><USER3>
        The upload speed for S3 seeding was usually between 72 and 80 KiB per second

So not horribly helpful for larger blobs that you expect to have a lot of initial demand for. You'd be better off serving the blob or renting a seedbox / cheap server if you want to do initial seeding for distribution if you were interested in your users experience.

<comment><USER4> The benefit isn't in serving the data from S3. The benefit is that S3 is an indestructible tracker. If you remove public-read from an object, S3 will continue to serve as the tracker for the object for the swarm.

<comment><USER5> Providing an extra seed seems useful too. You can do the initial seed from somewhere faster, but S3 will provide a backstop in case that seed goes down. It might be too slow for the full download, but it can help fill in the last little pieces in case you get into a situation where everybody in the swarm has 99% of the file but nobody has some particular chunks.

<comment><USER4> CORRECTION: It was pointed out by /u/teraflop that the Bittorrent functionality and Requestor Pays functionality are incompatible on the same bucket.

Indeed. S3 also has the ability to have the requestor pay for the bandwidth costs of a object retrieval. You could, for example, get the object free from the swarm, and pay for the last few MB/GB if it was unavailable from anyone else.

[http://docs.aws.amazon.com/AmazonS3/latest/dev/RequesterPays...](http://docs.aws.amazon.com/AmazonS3/latest/dev/RequesterPaysBuckets.html)

[http://docs.aws.amazon.com/AmazonDevPay/latest/DevPayDevelop...](http://docs.aws.amazon.com/AmazonDevPay/latest/DevPayDeveloperGuide/S3RequesterPays.html)

<comment><USER6> "Requester Pays buckets do not support the following. [...] BitTorrent"

<comment><USER4> Corrected and cited. Thanks.

<comment><USER5> I didn't know about the requestor pays functionality, so it's good to know that even if it doesn't apply here.

</comment></comment></comment></comment></comment></comment></comment><comment><USER7> Another idea: you could also use S3 as a web seed for a .torrent you hosted somewhere (or even a magnet link); it seems likely the speeds would be much better as well, since you'd be able to take advantage of S3's load-balancing.

<comment><USER8> +1 for web seeds. You can also avoid having a tracker at all if you use PEX and DHT-only magnet links.

Tangent: I ran into a strange bug with web seeds using Transmission on Debian Wheezy the other day: it does not respect the configured speed limit for web seed sources, owing to a discrepancy in the way libcurl vs libtransmission downloads are handled. It's fixed now but not in Wheezy.

</comment></comment><comment><USER9> Quick question: is anyone here using BT Sync with S3? I'd like to know about the experience, ease of use, access, redundancy, etc.

<comment><USER10> I might be wrong, but I don't think Bittorrent Sync uses the same data or tracker protocols, so S3 wouldn't support it.

I'm sure plenty of people use it on their EC2 instances though.

</comment></comment><comment><USER11> Why? This would work... until the surprise bandwidth bill comes in.You could just do this for free using dropbox though, or another less expensive object storage.

[https://sites.google.com/site/torrenttricks/use-dropbox- as-a...](https://sites.google.com/site/torrenttricks/use-dropbox-as-a-free- webseed-for-your-torrents)

<comment><USER4> Dropbox is going to cut you off much faster than S3 if you're attempting to serve torrents from them.

<comment><USER12> I've heard of dropbox cutting off high traffic files a couple of times, anyone have the specifics on what constitutes high traffic though?

<comment><USER13> [https://www.dropbox.com/help/4204/en](https://www.dropbox.com/help/4204/en)

"For Basic accounts, the total amount of traffic that all of your links together can generate without getting banned is 20 GB per day. For Pro and Business accounts, the limit is 200 GB per day."

<comment><USER4> So $2.50 worth of S3 outbound transfer (for personal accounts).</comment></comment></comment></comment></comment>


Ask HN: Would you fund a lawsuit - <AUTHOR> A lot of back and forth on HN about Thiel funding the Bollea v Gawker lawsuit.  A lot more against the general concept than I would have expected on HN, but also plenty of understanding that outside funding of lawsuits is indeed necessary.
Makes me wonder, how would you feel about a platform where you could review potential/on going lawsuits, get insight from independent lawyers (likelihood of winning at trial and estimate of damages/settlement offers), and the ability to fund the lawsuit for a percentage of the award/settlement (you could also waive your interest in the award and just fund cases based on your sense of justice). It is terrible language but for sake of explanation crowd-funding lawsuits for equity.
Note:  Due to Bar Rules any funding would give funders zero control or influence over the case and/or attorney-client relationship. <comment><USER2> I've seen lawsuits funded on GoFundMe. In particular Adam Carolla raised a lot of money to fight a patent troll. I don't know much About trial processes, but I was curious what would happen if the defense wins. Does the other side pay their legal expenses? If so, would the donations be redistributed to the donors?

The aspect of receiving a percentage of the settlement seems very interesting. I've personally known people who had to give up on settlements because they were bled dry by large, well funded companies' legal teams. This essentially providing a longer run way to these parties in exchange for a part the settlement they may not otherwise be capable of getting. Very curious to see if you turn this idea into something.

<comment><AUTHOR> In the U.S. Fees are award by statute or contract, but there are a few other legal mechanisms to have the other side pay fees (even if just partial, or oddly it is even possible the winning side is liable for the losing side's fees). As a rule of thumb defendants will be liable for their own fees, even if they win, unless (insert specific statute or contract).

So this would be part of the independent case breakdown/analysis on the platform but it can't be done in a vacuum it would have to be on a case by case basis against the specific facts of a given case.

</comment></comment><comment><USER3> One thing I am curious about with this whole Gawker lawsuit and in particular the Thiel funding, is did he really outlay cash to the attorneys or did he tell the attorneys to pursue the case at whatever expense. In many cases like this a court award is going to include attorney fees/expenses, with attorneys working on contingency. Now I understand that in many cases even a "win" does not guarantee the attorneys will get the full amount for their fees/expenses, but often they will get a third of the award. I would be curious to know what the exact fee/expense arrangement was in the case of the Hogan/Thiel attorneys. The impression that I get, and I could be completely wrong, is that Thiel basically associated his name with it to keep Gawker from throwing high- priced attorneys at Hogan and having Hogan submit to a settlement when he could potentially win more. There was no real exchange of money between Thiel and the attorneys though. Again, could be completely wrong, so I am curious.

Sorry to go off on a tangent there, but I wanted to lay out a little context. Since many attorneys operate on contingency, how much of market is there to actually "fund" a lawsuit?

<comment><AUTHOR> I can't answer the specifics of the Thiel/Bollea deal. But there are rules so whatever the deal is, we at least know the boundaries. One of the most important is that any third party funding a lawsuit can not interfere with the independence of the attorney-client relationship (that's a term of art, but there are many examples and actually cases to guide a lawyers behavior).

In Florida our contingency rule is 33% max pretrial and 40% max thereafter. There are other caps on different types of cases (i.e. Class actions).

One of the reasons contingency is so popular, I suppose like healthcare, people can't normally fund large lawsuits out of pocket. So while contingency helps people who otherwise could not afford lawsuits, it also has the consequence of lawyers being more selective on cases (so even winners might get passed, because a lawyer could theoretically lose money winning).

Answer? A platform like mine could really open the door to hybrid contingency/billable cases which is currently rarely used, but would be a great incentive for lawyers to take cases they might otherwise not be able to take financially.

<comment><USER3> Makes sense. The problem I see is that we already have a litigious society. The one plus to lawyers being selective is that while they may miss a few lawsuits, it reduces the number of frivolous lawsuits, which opens a liability to the attorney if they are found the be filing lawsuits just to file.

In a way the idea is kind of a spin-off of structured payment lending which is a proven market. Personally I wouldn't invest, the risk is to great and the investment could be tied up for years with a better than average chance of little to no return.

That said, it is an interesting concept, and part of me does see some benefit. I think the problem to solve would be to sell the platform to potential plaintiffs. There are probably numerous valid lawsuits that do not get brought because the plaintiff thinks it will cost them a fortune to even talk to an attorney in the first place. Put aside healthcare/accident related claims, but I am thinking more employer related lawsuits.

</comment></comment></comment><comment><USER4> I would fund some lawsuits for sure. For example I recently helped fund a lasuit against the Dutch government for not following up on the results of the referendum on the EU association treaty with Ukraine (most Dutch people voted against the treaty).

</comment><comment><USER5> At some point in time I would think it runs into US Federal laws regarding money and what might appear, superficially, to be a relative of gambling.

I think the PR push-back would make the platform perhaps a little tabliod-like in public perception. Hence, as you noticed, a passionate reaction by many to both the idea and execution.

Probably the only way I could see such a thing hit the market would be without money changing hands, and setting it up more like a "fantasy sports" thing - would probably be of interest to legal types but otherwise I don't sense a broad appeal.

</comment><comment><USER6> The word for this is called barratry.

Barratry can include "bringing or encouraging acts of litigation for the purposes of profit or harassment".

It's illegal in a number of US states.</comment>


Ask HN: Accepting credit cards as freelancer? - <AUTHOR>

I'm considering starting a freelancing business on the side sometime in the next year, and Stripe has me interested in the possibility of accepting credit card payments. I briefly worked as a subcontractor, and the company head took issue with a client who wanted to pay with a credit card, presumably because of the risk of a chargeback. Is it best to stick to a "checks only" policy, or is the additional risk worth the convenience to clients? <comment><USER2> I typically send invoices via paypal and clients pay via credit/debit or their paypal account. You can obtain a paypal debit card and have instant access to the funds as soon as they pay. Occasionally paypal will hold the funds for 24 hours.

Some companies insist on paying by check and that typically works out as long as it's a company check I wouldn't worry too much. I would avoid personal checks or if you get a funny feeling about a client.

Stripe would be another option, you could even create custom invoice pages on your website for clients with the stripe payment form embedded on the same page as their invoice. (You'll need an SSL certificate (HTTPS://) for your website stripe requires it. You can sign up for Hostgator's Business plan for $15 and they include an SSL cert free upon request.)

I also recommend getting a 25% payment up front and breaking the project into multiple milestones where you receive payments and they review the work incrementally to make sure everyone is on the same page and you won't get left holding the bag waiting for a large payment at the end of the project.

Good luck with Freelancing.

</comment><comment><USER3> It would depend on how often you are charging a customer. If you have several customers everyday, you might want to consider that since it might be a pain point for your customer. But since most "freelance" work takes a little time and you are limited by the number of personal hours in a day, I don't think it would matter too much if you only accepted checks.

On the other hand, Square is extremely convenient and free to use (other than a per transaction percentage charge).

</comment><comment><USER4> During my contracting days, I typically required certified funds (wire transfer, Paypal, money order, cashier's check) unless the client was, say, in the Fortune 500, in which case a business check would suffice.

The one time I broke my rule and accepted a personal check, I got burnt. I'd advise you to only accept certified funds.

<comment><USER5> If you would not take a card then I would not take Paypal, the do chargebacks.

[https://www.paypal.com/us/webapps/mpp/security/chargeback- gu...](https://www.paypal.com/us/webapps/mpp/security/chargeback-guide)

comment for the OP not you _pius

<comment><USER4> I didn't realize that, good information to know.

</comment></comment></comment><comment><USER6> Maybe this is bad advice, but I live on the edge and I'd take the credit card. Maybe use something like Square, though, since it seems less jankey than typing their credit card number in the stripe console.

</comment><comment><USER7> I only accept PayPal. I send invoices to registered PayPal addresses and have them paid that way. Seems more professional than drawing up my own invoice and posting it to the client.</comment>


FreeBSD Quarterly Status Report, January-March 2014 - <AUTHOR> http://www.freebsd.org/news/status/report-2014-01-2014-03.html

<comment><USER2> FreeBSD is a fantastic operating system and this report highlights why. Documentation is something the team takes very seriously; as important as the code itself, so if you're impressed by this high-quality report you'll be even more impressed by how easy it is to find your way around FreeBSD because of the documentation.

<comment><USER3> I too noticed the quality of the report. I know what it is and what it is for as soon as I start reading. Well laid out, succinct, contact details and further links for each item.

It's all very encouraging.

</comment></comment><comment><USER4> Enticing; depth and vision. Coherence is always tricky, but, to my mind, they pull it off.

To be quite honest: Debian/kFreeBSD is still _my_ version of FreeBSD, but that's just laziness.

</comment><comment><USER3> This report has only made me want to try FreeBSD even more at some point.

Some highlights for me were:

\- FreeBSD on Chromebook \- Chromium port \- Improved Wine port

<comment><USER5> I love FreeBSD and was planning on switching some servers from Linux but found that it consumed about 25% more power than my Linux boxes (even after extensive power management tweaks) and in the end didn't have much advantage.

It's not hard to install freeBSD in a VM, set up ssh, run it headless, and ssh in. I suggest you give it a go. It's a great learning experience.

<comment><USER6> >I love FreeBSD and was planning on switching some servers from Linux but found that it consumed about 25% more power than my Linux boxes

Wow, I wouldn't have thought there would be such a dramatic difference in power consumption on anything but portable hardware. Did you try to measure the CPU and I/O usage on your servers and compare them between Linux and FreeBSD? I wonder if FreeBSD's greater power draw was due to its ACPI implementation or if the average system load was also higher (ZFS?).

<comment><USER5> I wasn't using zfs at the time and I didn't do much comparison with CPU and IO, I used a wattage meter. I followed the FreeBSD guide ([http://www.freebsd.org/doc/en_US.ISO8859-1/books/handbook/ac...](http://www.freebsd.org/doc/en_US.ISO8859-1/books/handbook/acpi- overview.html)) and tried just about everything. My Linux box was running at about 9watts (idle) and freeBSD started out at around 18, but I got it down to about 12watts after making a lot of optimizations.

I think most of the difference is because FreeBSD is using older more stable software, and the Ubuntu server was running some of the latest software.

<comment><USER7> Do you remember which FreeBSD version and which Linux kernel version was it?

Linux had tickless kernel + CPU scaling for a while. FreeBSD is lagging in this aspect.

<comment><USER8> The FreeBSD kernel is tickless as of FreeBSD 10:

[http://www.freebsdnews.net/2013/09/20/freebsd-10s-new- techno...](http://www.freebsdnews.net/2013/09/20/freebsd-10s-new-technologies- and-features/)

<comment><USER7> Yes, exactly, it only has it for couple of months, that's why I asked about version.</comment></comment></comment></comment></comment></comment></comment>


Iphone 4 GM already jailbroken - <AUTHOR> http://www.perivision.net/wordpress/?p=3055

<comment><USER2> This is a very deceptive title. The "Dev Team" -- the guys who do the iPhone cracks like redsn0w, etc. -- often crack prelease versions of iPhone OS updates well before they go final, but keep the cracks private to prevent Apple from "prematurely" patching them so they can be used when the final (or GM) version is released. This crack was almost certainly not found in the last 24 hours.

</comment><comment><USER3> iOS 4 GM jailbreak, not iPhone 4 jailbreak.

<comment><USER4> 'GM' in this context means... ?

<comment><USER5> Golden Master - pretty much Apple's term for RTM

<http://en.wikipedia.org/wiki/Golden_master>

<comment><USER6> Why Apple's term? I've heard that used with respect to PC games too.

<comment><USER6> I'm actually really curious as to why people are down-voting me so much. Did I cross some invisible line? Are people interpreting my comments as some sort of attack or aggression?

I just made the observation that it seems misleading to call this "Apple's term" since they are not the only ones that use it. Note, that I'm not claiming that anyone is lying or trying to be intentionally deceptive. I'm not making some sort of "No! Apple didn't invent the term! They are non-innovators that steal everything!" comment. I'm just stating that it is a widely used term in the industry, and that calling it "Apple's term" might lead people who have never heard the term before to attribute it as some sort of Apple- specific jargon. Rather than _not_ contributing to the conversation in a meaningful way by just down-voting the parent because I think that he/she is wrong, I just posted a minor correction in the interests of correctness/completeness.

[I can't even believe that I need to specify these things in such excruciating detail lest someone on HN feels that I'm being an asshole by trying to attribute my emotional state to a block of text rather than just reading it for what it is. Really, HN? I thought that we were better than this.]

<comment><USER7> (Meta comment, only because you asked for it at length) To my mind, you're being needlessly pedantic and argumentative. It is Apple's choice of term. Why the comment, "Why Apple's?"? Isn't it obvious that the comment was responding to a question about Apple? It seems like a needless attack on the author, who was providing useful information.

If you'd left the comment with just the interesting part, "I've heard that used with respect to PC games too," you would probably have stayed at 1, possibly gone up to 2.

</comment></comment></comment></comment></comment></comment><comment><USER8> Or, you could link directly to the source:

<http://wikee.iphwn.org/howto:rsbeta>

</comment><comment><USER9> I did it today with iOS 4 GM. Not really recommended as most of the worthwhile apps aren't up to date: biteSMS, MyWi, etc.

Best to hold of until they are updated.

That said, I love iOS 4. Pretty rad.

</comment><comment><USER10> Eek. This seems like a mistake, as iOS 4 has not shipped yet. Apple still has time to fix it.

<comment><USER11> Unless I'm mistaken, the GM has shipped to developers, and is highly likely to be bit-for-bit identical with the public release.

</comment></comment><comment><USER12> "..the iphone 4 or known as iOS4 hits the market.." However, I should add that to the title.. which I will do now. As for crack in 24 hours, its more about the speed of a successful crack, not about a release version. So you know its not final. Here is where I got the info.. [http://www.redmondpie.com/jailbreak-ios-4-iphone-3gs-with- pw...](http://www.redmondpie.com/jailbreak-ios-4-iphone-3gs-with-pwnagetool- bundles/)</comment>


Disk Bottleneck Issues with MySQL - <AUTHOR> http://erpnext.com/scaling-erpnext-with-mysql

<comment><USER2> Looks like you have a lot of writes going on there. Look at the wkB/sec! Massive. Almost no reads at all.

Why so many writes? Have you got a lot of small updates and inserts going on? Have you split the transaction log from the data files, preferably on a different disk?

Also, put that slow performance logging on a separate disk. In fact, try to turn it off. It can have a performance penalty in its own right!

If you want best bang for buck, and you want RAID, it's normally recommended to use RAID 10 (or otherwise known as RAID 1+0). Basically it stripes the data, and then mirrors those stripes. It's the most reliable option.

Whatever you do, do NOT use RAID 5, it's just overhead and you telly gain very little in a disk crash due to often lengthy rebuild times.

Good luck!</comment>


Thunderbird 60.0 release - <AUTHOR> https://www.thunderbird.net/en-US/thunderbird/60.0/releasenotes/ <comment><USER2> The list of additions, changes and fixes look impressive! But I'm still worried about Thunderbird's future and the planned rewrite. It's a tough position to be in, (as if) attached at the hip to Firefox and to deal with the obsolescence of XUL extensions and other things that come part and parcel of using a good amount of code from Firefox.

I still believe it was a poor decision by Mozilla to cut off Thunderbird and float it as a community supported project. It now seems partially blessed by Mozilla, but isn't how it was before that separation (AFAIK). The main thing I've felt as a huge missed opportunity with Thunderbird has been the lack of native Exchange calendar integration (no, none of the extensions, past and present, are close to even the experience of using Outlook web access for this purpose).

I'll continue using Thunderbird for at least a few more years and will support the project financially, but I feel Outlook web access is slowly chipping away the need to use a desktop client in enterprise environments that are tied to Exchange or Office/Outlook 365.

</comment><comment><USER3> If you are on verions<52, just know that this update won't be shown on the "About Thunderbird" page that checks for updates.

I was just in the same situation, and simply downloaded the installer from their main webpage [1] (after backing up my data in my profiles folder[2] and closing any running instances of Thunderbird), and it simply worked! I have to say, at least on Windows, the update looks much better, feels quite refreshing! Almost makes me want to actually check all the new emails :)

[1] = [https://www.thunderbird.net/en-US/](https://www.thunderbird.net/en-US/) [2] = [https://support.mozilla.org/en-US/kb/profiles-where- thunderb...](https://support.mozilla.org/en-US/kb/profiles-where-thunderbird- stores-user-data#w_backing-up-a-profile)

<comment><USER4> Also a bit curious on this, Debian and Ubuntu have been on 52 for a long time now.

<comment><USER3> Yeah, unfortunately I don't have Linux (only WSL but I doubt that would really compare since I don't use the GUI environments avilable), so I don't know whether upgrading like this will be safe. I'd personally wait until they the repository developers bring it in, since there's no guarantee of what might happen.

</comment></comment></comment><comment><USER5> > _Thunderbird version 60 is currently only offered as direct download from > thunderbird.net and not as upgrade from Thunderbird version 52 or earlier._

Anyone have any idea about this affects Linux? I am using Mint, and in the past the suggestion has always been "update through your repository" not with a download...

Is it different this time for some reason?

<comment><USER6> I suppose distros haven't packaged it yet.

<comment><USER5> Sure, that is par for the course... normally. But I've never been told. "Don't upgrade from version X to version Y" before, which is why I am asking if I need to do something different this time. (ie, not wait for distro update, because none will be coming...??)

<comment><USER7> I think it's just saying it won't come up in Thunderbird's own internal updater for now.

This shouldn't affect you if you've been installing/updating from a package manager.

</comment></comment></comment></comment><comment><USER8> Something overlooked, but which I have a lot of respect for is properly incrementing version numbers. It's rare to see semantic versioning properly work. Good job TB team.

<comment><USER9> What do you mean? Doesn't the jump go from 52 to 60?

<comment><USER10> I think that refers to the version of firefox/gecko that underlies it.

</comment></comment></comment><comment><USER11> I hope this will finally fix the "XML Parsing Error: Undefined entity"-bug that's been present for nearly a year now. Last I heard RedHat and the Thunderbird team were still bickering over whose bug it was or whether it was a packaging issue. It doesn't seem to be listed in the changelog, so I guess I shouldn't hold my breath.

</comment><comment><USER12> > FIDO U2F support

Sweet, although IIRC several of the email providers with 2FA (Gmail and Outlook come to mind) have the option of providing app-passwords instead, which bypass the need for a 2FA token.

<comment><USER13> Just so you know, an app password downgrades the security of your 2FA+Password pairing, and I never use app paswords because of that. If it was somehow possible to intercept the password used in the IMAP handshake, then that means access to your inbox without 2FA. This is why I am a huge fan of web-based clients and not things like Thunderbird.

<comment><USER14> IMAP authentication is done within SSL, so you'd have to start with an SSL MITM to be able to access the password login anyways. If you're scared about people having access to that, there are quite a few password authentication schemes baked into IMAP that don't leak your password over the network (SCRAM- SHA-256, anybody?). That said, all IMAP servers in practice implement only plaintext auth, or maybe NTLM and Kerberos.

<comment><USER15> Or a brute-force attack guesses your app password.

One of the major benefits of TOTP is that you have only a certain time window (usually, 30 seconds) to guess a password before the thing you're trying to guess changes and you have to start over.

With HOTP, you only get one guess before the goalposts move. The downside is that it's more vulnerable to DoS attacks when configured that way.

An app password has no brute-force resistance, so it lowers the security of your otherwise-2FA account overall.

<comment><USER16> > One of the major benefits of TOTP is that you have only a certain time > window (usually, 30 seconds) to guess a password before the thing you're > trying to guess changes and you have to start over.

This is, again, wrong. Guessing a 6-digit number will take, on average, 500,000 tries; if the answer changes with each guess, it will take only twice as much (same as when picking random guesses instead of iterating through all possibilities in order).

In fact, you might as well try "000,000" over and over every said 30 seconds, and your guess will eventually be correct after about the above-mentioned 500,000 tries.

[https://run.dlang.io/is/0A467x](https://run.dlang.io/is/0A467x)

<comment><USER15> I don't think you've understood what has to be guessed. It's not the OTP alone; it's the OTP and the password, together.

If the OTP "000000" is correct with 50% probability after 500,000 attempts, you've just increased the number of attacks necessary to brute-force a password against a live server by (conservatively) 50,000,000%.

<comment><USER16> Sorry, that part I understood. Your comment said something else. There are no moving goalposts, at least not in a way that matters.

<comment><USER15> If you are attempting a brute force attack against a particular password, you either need to know a single OTP and complete the attack before it changes ("the goalposts move"), or try every password with every possible OTP, or compromise the OTP secret.

<comment><USER16> Yes, that's the part that's wrong/misleading (or at least one interpretation of it). See my earlier comment.

<comment><USER15> Let's describe the attack in detail.

You know:

\- A username

In order to gain access to this system, you must supply:

\- A username \- The corresponding password \- A TOTP code valid for the time you make the attempt

If any piece of information you give the server is wrong, you get an "auth failed" message which reveals nothing about which part(s) you got wrong. It is an oracle which answers only "yes" or "no".

Assuming you can guess (ask the oracle) once per second, that there are 52^8 possible passwords and 10^6 possible OTPs, and that every thirty seconds the valid OTP shifts to a new totally random value within the valid range, estimate the number of guesses necessary to find (with 50% probability) the correct combination of information. Now repeat the exercise, with the changed situational parameter that you no longer need to supply a correct TOTP.

I think you will find that the estimated time to crack is increased by much, much, much more than a factor of two by having the OTP. I would be interested to see any alternate answer and the reasoning behind the same.

<comment><USER16> Assuming the attacker has neither the password nor the OTP seed and must brute-force both (which is what 2FA is all about), the OTP doesn't add more security than the bits it has (about 20 for a 6-digit decimal number), plus the 1 bit because it's not constant. For this reason, I think it's misleading to say that there are moving goalposts or such. Neither the entire attack nor any part of it must be completed within 30 seconds or whatever the refresh interval is of the OTP token. Cracking both is still a classic brute-force attack.

</comment></comment></comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER17> Anyone knows how to convert all mbox mailboxes to maildir? Just enabled "mail.store_conversion_enabled" but can't see any UI do make the conversion.

Update: found here - [http://forums.mozillazine.org/viewtopic.php?f=29&t=3039509](http://forums.mozillazine.org/viewtopic.php?f=29&t=3039509)

</comment><comment><USER18> I downloaded this while it was in beta to see whether they'd fixed the scaling issues with mixed DPI setups in XWayland, or better yet, moved to native Wayland. Alas, this is not the case.

<comment><USER19> Firefox hasn't been ported to wayland, yet. So I wouldn't hold my breath for thunderbird

</comment></comment><comment><USER20> Thunderbird is a great email client but I don't trust it when it comes to calendars and contacts.

Syncing with CalDAV/CardDAV or Google Calendar/Contacts has always been problematic and apparently this is the very first version where you can edit single entries of an recurring calendar event. This does not help in building confidence in Thunderbird as a PIM.

<comment><USER21> Yep, same experience. I use Thunderbird for many years, and tried to migrate my calendar workflow to it many times, and it just does not work. I really like it as an email client, and I'd like to use it as scheduling tool too, but currently it's way too clunky to be of any practical use. Sync issues, UI issues, all kinds of issues. Hopefully they'd get their act together sometime.

</comment></comment><comment><USER22> I was hoping that Thunderbird would become a unified desktop equivalent of Mail/Calendar/ToDo of the apps we have on the mobile that can handle all the major providers (exchange, gmail, icloud, yahoo, pop, imap, etc...).

But it doesn't support a good chunk of these, which makes it difficult to adopt in my life.

<comment><USER23> I'm hoping that addons will spring up due to the renewed development efforts. As it is, I'm just using Nextcloud (Calendar & Contacts) alongside Rainloop for mail.

</comment></comment><comment><USER24> Looks good but not seeing too many performance improvements unfortunately.

Which is a shame, I much prefer Thunderbird to Kmail UI wise, but when processing thousands of messages (deleting, moving, filtering, etc) it slows to a crawl then freezes. Kmail stays responsive.

This on 16 core 32 GB machine. But it doesn't look like the cores are used very effectively by TB as opposed to Kmail.

For normal usage though it's great. Maybe the next release will focus on performance optimization, in particular multicore.

</comment><comment><USER25> I currently have Thunderbird installed from apt but pinned to an ancient version that allows Lightning (the calendar tool) to work. (Newer versions broke Lightning on Linux, although I can't recall the failure mode.) Maybe I'll try out Thunderbird 60 on my work computer to see if it works better now...

It's funny, I actually only use Thunderbird for its calendar these days, not for email.

<comment><USER26> I vaguely recall a point when Lightning wasn't working but that has been aaaaaaaages. It has been working fine for years on Linux.

<comment><USER27> I can confirm that Thunderbird and Lightning work fine on a CentOS 7 desktop. I use them every day.

</comment></comment></comment><comment><USER28> Does anyone know the last Thunderbird nightly build that's okay to use if you don't want all your extensions to be disabled?

</comment><comment><USER29> Excellent work! I've been using Thundirbird for years now and enjoy all its features.

The only thing that it lacks is the native support of Tray, I just use the discontinued extension FireTray.

Anyway, just checked the new version and installed it, it looks fresh and nice, great job!

</comment><comment><USER30> Has anyone had trouble accessing gmail from thunderbird in the last few weeks? Both my work and personal accounts have been intermittently syncing and I have no idea if this is a thunderbird problem or something i have to change in my gmail settings.

</comment><comment><USER31> Anybody know if the line-wrapping has been fixed? In either this version or anything since <checks what I have> 52.9.1? The messed-up line-wrapping and quoting is easily my biggest problem with Thunderbird.

</comment><comment><USER32> If you have any add-ons that you like a lot, better check into whether they're compatible with TB60. (I was glad I had backups after I tried it.)

</comment><comment><USER33> wow, that is nice, go thunderbird!

</comment><comment><USER34> Great news! I wonder when it will make it into the Ubuntu repos?

</comment><comment><USER35> Gee I'm still on version 11. I tried updating once, got a ton of useless crap like calendars and shit and reverted back. Email is one of the few things that I want something very basic and crude.

<comment><USER36> If you're using Thunderbird 11, you are using a mail client full of security issues.

[https://www.mozilla.org/en-US/security/known- vulnerabilities...](https://www.mozilla.org/en-US/security/known- vulnerabilities/thunderbird/)</comment></comment>


Cryptocurrency Financial Spreadsheet - <AUTHOR> https://docs.google.com/spreadsheets/d/1lnE260-F7TSs6onegSVYgRAP0ZZeuUy2YsfO2Ww_eJY/edit <comment><AUTHOR> Found this while I was trying to learn how to import data from an API into Google Docs:

[https://github.com/bradjasper/CryptocurrencySpreadsheetUtils](https://github.com/bradjasper/CryptocurrencySpreadsheetUtils)</comment>


Ask HN: Is this iPhone app too trivial/commonplace to promote? - <AUTHOR>

Movie here:
http://basketeerapp.com/
It took about ten tear-downs and do-overs just to make it as simple as possible.  I might have simplified it so much that nobody will take it seriously.
I wrote this app mostly for myself as a companion to go with my first iPhone.
My problem is - I don't have a good understanding of the iPhone market, or even the common needs of iPhone users.  I have no idea if I should just keep this to myself and just let it disappear into the back hole the appstore apparently is.
Encouragingly, I've already had two anonymous people tell me its something they have been looking for.  But how to evaluate a large percentage of a very small selection of users saying its something they have been trying to find in an app?
Should I drop some promo codes here?  I have a bunch left but I'm not sure of promo code etiquette on HN. <comment><USER2> I think for a vast majority of people it's a solution in a search of a problem. Grocery shopping is an uncomplicated matter and the pen and paper list covers the need for a memory aid in those (rare) cases when it is needed. It is also much easier to operate as it can be kept in the shopping cart in front of the eyes at all times, it is easier to glance over and it is easier to strike items off the list (by tearing through them). All in all, the paper list is better than the app on a device. Don't get your nerdiness blur your perception of reality of common folks :)

<comment><AUTHOR> Grocery lists don't help you figure out what you need to put on that list, that's why it often fails me and why I created a list with "tags". Maybe I'm the only one, but its already helping me to not forget things.

</comment></comment><comment><USER3> I use Listary (friend's app) for the same thing but it's a paid app. GroceryIQ is a good free app for that.

I think your app adds complexity where it isn't needed. Tag tags? Hard to get. The whole terminology is not clear. If you want to group items, call it Group.

A good feature would be to recognize items as you type them and add to specific aisles (produce, bakery, etc). That way you won't need groups.

I also think the icons are not very clear and the delete function should be a simple swipe sideways.

<comment><AUTHOR> I didn't think groups would be appropriate because the same item could be in multiple groups. I think most people think of groups as _containers_ and having the same item in multiple groups is confusing, but they do understand that a single item can have multiple tags.

The tags are for your own use. They can be for meals, ingredients, isles, pets, etc. I would not impose a "use case" for them upon the user.

There is a swipe delete, its just not shown in the movie. I'm not sure why you say its not there. It would also not be used very often so its not a big deal.

</comment></comment><comment><USER4> This too complex for me to use.

For a shopping list I want what I have on paper. A list of items that gets crossed out when I put it in my cart.

Trying to revolution the shopping list with technology (tags and tagging tags) is a losing battle. Try to mimic the tried and true, hundreds of years old shopping list. Complicating it by adding technology seems like a recipe for disappointment.

<comment><AUTHOR> I used it today like this -

On my way home I decided I wanted a baked potato with dinner.

I already had a baked potato tag, and it contained 3 things

      Potato
      Butter
      Sour cream

I selected the potato and sour cream items, knowing I already had butter.

What happened far too frequently to me was that I'd forget to even remember sour cream and just get potatoes. That's what tags are for, a memory tool. Don't use them if you don't want. I find them extremely useful and are the main reason I created this app.

I also have baked potato tagged with dinner, so on my way home, I could have scanned through the "dinner" tag and decided what I felt like eating.

You see, I wasn't trying to mimic the shopping list, I was wanted a tool that helped me the way I grocery shop.

<comment><USER4> If that's how you use it, advertise it that way.

That is a neat way to use the app and is way more interesting than telling me I can tag tags. If I can scroll through what is essentially a menu on my phone, pick the items I want for meals, and the ingredients automatically get added to my list - that's pretty useful.

I still wouldn't use it, but I think that angle of usage would appeal to more people.

<comment><AUTHOR> _If that's how you use it, advertise it that way_

I made a movie showing that, but I guess it wasn't clear enough.

<comment><USER4> Dude really? Be less snarky in your replies and I'm sure people will be more willing to help you.

<comment><AUTHOR> I just meant that because you didn't get what I intended out of the movie that the script wasn't good enough and I should rewrite it, I didn't mean to be rude.

<comment><USER5> You weren't.

</comment></comment></comment></comment></comment></comment></comment><comment><USER6> I have no use for this because I never carried around a shopping list in the first place. I also don't own an iPhone, but I would imagine the app store is already saturated with shopping list apps.

</comment><comment><USER7> I like the checking-off of items as I go round the supermarket.

I doubt I'd use the Tagging (grouping?) feature.

<comment><AUTHOR> I called it "grouping" until I realized that items could be in multiple groups, so "tag" seemed like a more accurate metaphor.

</comment></comment><comment><USER5> I also want to add in that this seems complicated -- I mean, I get the purpose of tags and the like, but the UI steps to get there are unintuitive, and the video doesn't do a great job of showing me why I would want to.

I see elsewhere in this thread that you present a use case -- make that clearer.

It was surprising to me that the ONE thing this had the potential to offer over pen and paper isn't a feature -- the thing I hate about pen and paper is that when I scratch out something I've put in the cart, it doesn't go away.

See tadalist for what I mean -- when I check something, it is grayed out AND pushed to the bottom of the list. This is a huge feature that I think you're missing (for me at least).

<comment><AUTHOR> Thats interesting. My first 4 or 5 attemps had a checked item disappear (actually animated it to go back to the main list). Then I found myself accidentally checking items off by mistake and being annoyed I couldn't recheck them easily. So I decided since my lists were always short, I would just grey them out so the unchecked ones would stand out. At least thats my reasoning at the time.

Oh, and as a compromise, to remove checked items from the list, you just cycle the list button, and that cleans up the list, so I was hoping you'd get the best of both features. 1. A less twitchy list. 2. The ability to clean up the list.</comment></comment>


We Should Embrace Our Age of Nuclear - <AUTHOR> https://quillette.com/2019/05/24/why-we-should-embrace-our-nuclear-era/ <comment><USER2> > In their decision, the AWG scientists are implicitly recognizing that > nuclear energy is a permanent feature of human civilization

How do we know what they _implicitly_ recognize. They simply voted to "declare the invention and testing of nuclear weapons as the beginning of the Anthropocene"</comment>


Nokia employee working on MeeGo: "Commited to Linux" - <AUTHOR> http://blog.mardy.it/2011/02/committed-to-linux.html

<comment><USER2> One of the major reasons that Nokia lost to the iPhone is that Nokia never respected their external developers. Its the apps that really give the iPhone its staying power against Nokia phones.

Nokia (at least internally) acknowledge that mistake, but it seems like they've learned nothing since they've essentially done it again. Which is a huge shame because they have made some great products and MeeGo looked like another one.</comment>