How $100 Million Really Gets Donated, Mark Zuckerberg Style - <AUTHOR> http://www.fastcompany.com/3004509/how-100-million-dollars-really-gets-donated-mark-zuckerberg-style <comment><USER2> I'm confused by this article. The whole thing is positioned like they are blowing the whistle on some scandal, but what scandal? That a public figure donating a large sum of money wants to make sure it brings some good PR? Is that a surprise?

Or that the money was donated with specific uses already in mind? Shouldn't someone who donates that much money be allowed to condition it on the changes they'd like to see made? If you don't like their ideas, don't take the money.

Or is it that the bulk of it is to pay teachers bonuses? That sounds like a good thing?

Seems like sensationalization of a non-issue

<comment><USER3> _donated with specific uses already in mind_

==Purchasing

<comment><USER2> If they don't like the use they can refuse the donation. I would peg this much more like investing.

</comment></comment></comment><comment><USER4> What a terrible guy Zuckerberg is. He donates 100M to charity. Then he makes a lot of effort trying to get a platform to incentivate others to donate. Finally he convinces other millionaires to donate money and worst of all he tries to push them into donating more. What an awful guy..

<comment><USER5> Damn that Zuckerberg! If only he hadn't donated that money, it would magically have appeared out of the aether so that the Newark school district could attempt this experiment which, if successful, could restructure teacher compensation and recruitment nationwide!

There's a special place in hell for Zuckerberg.

</comment></comment><comment><USER6> There is no story here. They donated money and had it run through PR to get the right amount of public impact, like anyone would do with that amount of money.

</comment><comment><USER7> Amazingly Zuckerberg has people that manage his PR and so on, and they've worked to make him look as good as possible. What a surprise.

I imagine even Gates has people who do things like this even though he's effectively retired now. Doesn't matter if there's a PR spin on it, $100m was donated.

</comment><comment><USER8> New link: [http://www.fastcompany.com/3004509/how-100-million-really- ge...](http://www.fastcompany.com/3004509/how-100-million-really-gets-donated- mark-zuckerberg-style)

</comment><comment><USER9> Innovation is a really scary thing for public agencies. Democracies and public bureaucracies are set up specifically to mitigate risk. Yet risk is an essential factor in the success of innovative companies, many of which are now all dealing with gov't regulations and bureaucracies (think Uber or Airbnb). Here's how New York City Mayor Michael Bloomberg put it in the Aug. 2011 issue of Fast Company:

"The public," Bloomberg says, "insists, and arguably has a right to insist, that it knows where its money's going. [They] have a very high expectation of results." He is talking about how the government spends its funds. "That is not the way innovation works. Innovation--the essence of innovation--is you don't know what you're going to build, what it's going to be called, how much it's going to cost. You cannot use public monies unless you can answer virtually every one of those questions, which is why government tends not to innovate. The public wants that accountability in advance, that justification in advance. But that's not going to work for certain things."

</comment><comment><USER10> Question for Americans: why did Mark choose Newark for this charity money? Is it because Mark grew up there, or is it in a very sorry state compared to the rest of the country, or..?

</comment><comment><USER11> Has anyone found a link to the raw transcript? The editorializing here seems rather pandering, but It would be interesting to read what actually went down.

<comment><USER9> [http://www.nj.com/politics/index.ssf/2012/12/cory_booker_rel...](http://www.nj.com/politics/index.ssf/2012/12/cory_booker_releases_secret_em.html)

<comment><USER11> thanks!</comment></comment></comment>


What Swimming Taught Me About Happiness - <AUTHOR> https://www.nytimes.com/2019/07/27/opinion/sunday/swimming-happiness.html <comment><USER2> Just finished swimming a race from Alcatraz to shore, it's just the best high. I do tons of endurance sports, but swimming is the most reliable in yielding that euphoric feeling.

I think it's due to it being essentially forced mindfulness meditation. Though you could swim with music, I don't and that means it's just my thoughts for 30-60 min (watch the thoughts, can't do anything about them right now). I'm forced to focus on breathing on a set schedule (analogous to vipassana techniques). I'm moving my whole body in a way that requires balance, complex coordination and attention to what my body is feeling (analogous to body- scans, yoga). If you're not listening to music it's also a little like sensory deprivation, there's just neutral water rushing sound.

I know running and biking can get there for some (myself included occasionally), but on a pool swim there's nothing to worry about other than the occasional turnaround at the wall. No obstacles, no dodging others on the sidewalk, no traffic. You're in a controlled, safe environment.

That or maybe it's just the hypoxia ;)

<comment><USER3> That just gave me an idea of circular swimming pool.

<comment><USER4> They exist and they are very annoying compared to regular old 50m lanes. You end up having to constantly overcompensate to one side (obviously) but also you suddenly have to either burn in a constant bias to your technique (bad) or be constantly aware of the boundaries, which ruins the normal flow of pool swimming. They are fun for families and kids who only ever do one or a half round, but if you like swimming just stick to traditional pools.

<comment><USER5> How about a pool in a rotating orbital space station? Just keep swimming forwards and slightly uphill :) Just don't lose the fake G or you could be the first person to drown in space.

<comment><USER6> It's never uphill though, while rotating "halo" looks like it bends upwards, force-wise it feels flat.

</comment></comment></comment></comment></comment><comment><USER7> Can't read the article, but I did want to share that the title resonates with me.

I love running and now run again, but I started learning swimming during a knee injury.

One thing it re-taught me was how rewarding it is to learn or improve a non- work related skill dramatically. I picked up juggling (poorly) and jump rope since.

Two, I knew I was getting a stroke down when I knew when to glide versus to move or exert myself. Maybe a metaphor but practically it makes 40 laps enjoyable instead of torture.

Three, having one hour of somewhat sensory deprived solitude is great therapy.

<comment><USER8> Join the club - could not read the article.

Swimming was not my thing but I had to learn so I could do other watersports.

The Down Syndrome girl and others in her special needs group that were in the pool when I went were incredible inspiration. If she could smile and put in the lengths then I could too.

<comment><USER7> FYI, on iOS, you can just read the story with the reader view. You get to it by clicking on the horizontal lines on the left side of the address bar.

</comment></comment></comment><comment><USER9> We are taught and continually retaught that discipline and hard work are the keys to success in life. Why would we not bring the same level of planning, anxiety and pursuit of excellence to our attempts to be happy? When you spend 40-60 hours a week trying to optimize your output at work it is difficult to not have an anxiety ridden vacation where you try to optimize your happiness.

I am sure many people can relate to the first 2-3 days of vacation being needed just to get into 'vacation-mode' where you can actually start to forgive yourself for 'wasting' a day.

<comment><USER10> > We are taught and continually retaught that discipline and hard work are the > keys to success in life.

Maybe we should work on that presupposition first. If we're talking about career and material success it's probably true, but these very rarely bring true lasting happiness. You also have to look at who's telling you to "work hard" and why it's in their interest for you to do so.

Imho once you go above a very low threshold of income (allowing you to live comfortably without excesses) you should have better things to do with your time than spending 7+ hours a day working.

Vacations are the proverbial carrot on a stick. "Be a good worker this week and you'll get to spend your money and enjoy yourself this weekend", "be a good worker this quarter and you'll get to spend your money and enjoy yourself during the next vacations", "Be a good worker all your life and you'll get to spend your money and enjoy yourself during retirement". Fast forward 45 years and you spend literally 70% of your life either working or sleeping, the rest being divided between distraction that barely keeps you going (daily Netflix or video game, weekly party, quarterly vacations) and chores. You're now physically and mentally a shadow of your past self but you have all the time you want, success!

It's extremely easy to get lost in all the little made up games we play days after days and miss the big picture.

<comment><USER11> If one finds Netflix, video games, partying, and vacations enjoyable; and they spend time pursuing those after becoming financially independent & retiring early, are they missing the big picture?

I understand and agree with the bit about not slaving for someone else throughout your life, but I'm curious what you mean by the "big picture" otherwise?

<comment><USER10> > If one finds Netflix, video games, partying, and vacations enjoyable; and > they spend time pursuing those after becoming financially independent & > retiring early, are they missing the big picture?

Each of us has to define the scope of his life, I personally have a hard time imagining that a fully developed human being will be deeply satisfied by consuming media. In French these things are called "divertissement", which literally means "diversion". There are many other things to explore than mere consumption. It's kind of the junk food of life, it makes you feel good for a short while but not that good in the long run. I doubt anyone will remember binge watching breaking bad as a milestone of there life (Or remember it at all).

I'm not saying these things are intrinsically bad, we should just be careful about how much of our life we dedicate to them, especially when work already takes most of our time already. If your life is work>consumption>sleep and you feel like you're missing something your probably are.

<comment><USER12> What else do you do every evening? For me, its working out, doing chores or Netflix, podcasts and video games. There is nothing else I could do. Too tired to learn new things and I need to recharge.

<comment><USER13> "Too tired to learn new things and I need to recharge." This is the part where optimising for happiness kicks in. I was in a similar situation and it involved investing less energy in things I was doing to open up energy to learn music. Music probably won't help my career or physical fitness, but I'm gambling that it will pay off in happiness down the line.

<comment><USER12> Being able to play music / an instrument is certainly a great skill to have. Can´t do it myself, due to a shared flat, but a great thing to do!

</comment></comment></comment></comment></comment></comment></comment><comment><USER14> In March I started swimming much more due to injury. Swam 250k yards in 3mo. One session was 10k in the pool.

Getting past the boredom is a skill. In my experience it's mostly a symptom of not focusing on your form. Don't use a watch and count yourself to stay focused. Break it up with challenging blocks to force you to focus. For ex: 50yds on 1min will force you to move and then focus on recovery.

I now really love swimming, which is a shock.

<comment><USER15> Did you really mean to say you swam 10,000 yards in one session? At the pace you mention (50yds = 1min) that would take over 3 hours.

<comment><USER16> For competitive swimmers, 10k+ days are fairly common (or used to be), split generally between morning and evening workouts. Sets might be based closer to 1:20/100m, which drops the total time a bit, though 3h in the pool isn't unusual.

A single workout of 5-6k is pretty typical.

</comment></comment></comment><comment><USER17> I snorkel a few times a week in the ocean and the experience is always surreal. When I see marine life staring back at me through the water, the experience etches itself deep into my mind. So much so that I can pull the experience back out later in the day and play it back with great detail. This connectedness to nature has given me an incredible amount of peace and happiness.

<comment><USER18> Scuba has been the only activity I've ever had a 'life-changing' experience while doing. The ocean is truly a meditative place. Can't be an astronaut? Get under the ocean. It's basically the same thing.

</comment></comment><comment><USER19> >Ever the philosopher of the pool, Igor smiled and said, "You are all confused! Speed is not the goal; it is the result of perfect beautiful technique."

>What really mattered to Igor was excellence — the efficient stroke. Once you mastered that, he argued, speed would follow naturally. Speed was simply the welcome side effect of swimming well.

>I've been thinking lately that there's a lesson here that goes beyond the pool. We all wanted to swim faster and the more hysterically we tried, the more speed escaped us. The same goes for happiness. Everyone wants to be happy, yet the more directly we pursue happiness, the more elusive it becomes.

<comment><USER20> Slow is smooth, smooth is fast.

<comment><USER21> One of my favorite phrases from my time in the service.

</comment></comment></comment><comment><USER22> I swim a lot, but find it quite boring.

I bought a waterproof Ipod shuffle + waterproof headphones from Amazon and it improved the experience 100x.

Note - use vaseline to seal the headphones into your ear, and wrap the extra wire under your goggle straps or you won't have a good time.

Highly recommend.

<comment><USER23> Or give up on the seal and pick songs with huge bass and that are mixed loud and then audio boost them to the max. For instance Lindsay Stirling and fall out boy seem mixed loud and are actually pretty audible through water.

I really only need beat to exercise anyway.

Experience: several hundred hours of swimming with headphones through the aughts and 10s

</comment></comment><comment><USER24> I've been doing masters swimming for the last few years, through waxing and waning levels of commitment and dedication. We do around 3.5 -4.5 k per session. When I'm consistently going 3+ times a week there's no other fitness high like it.

</comment><comment><USER25> I have been interested in swimming for a few years but never found the place to develop the skill to the point of not drowning.

I could try to swim in my apartment's tiny shallow pool which is really better for children.

I could spend $200/mo at a nearby health club.

I could drive to the ocean and jump in.

The first just isn't big enough or deep enough to get anything done.

The second is ... well I want to go swimming but not that bad.

If I just jumped in the ocean, especially the Pacific around the bay area, I would just expect to drown. I can swim a bit but not enough to have confidence with the ocean.

What else can I do?

<comment><USER26> Here's a learning process you can do on your own at your local pool, lake or ocean. The problem with learning to swim is that there are perhaps a half a dozen independent motor skills needed and it's hard to learn them all at once. This breaks it down to one skill at a time. Do all of this is shallow water, say, four feet in depth.

1) buy a mask, fins and snorkel set.

2) throw way the snorkel (not really, store it away for _much_ later)

3) start with a kick board and fins. Do an hour of just kicking with the fins on. Now you've learned the kicking motor skill.

4) Next put on your mask (defog it with your spit, youtube will show you how, yuckky I know but necessary) and now, with fins on, start kicking, as usual, but also start stroking with your arms. Don't bother trying to breath yet, just stand up when you need to breath. Do this for an hour.

5) Repeat 4 above but now try to breath on your dominate side (right side if you're right handed, other side if you're not). It's tricky to learn how to breathe without coughing, definitely practice this for an hour.

6) Take off your fins and repeat step 5. It will feel really weird without the extra power of the fins but your arm strokes should pull you thru.

7) Perhaps the ugliest part. Take of your mask and repeat step 6. Learning to manage the discomfort of having your face in the water does take some effort, but at least you've saved the hardest for the last. Keeping water out of your nose requires a continuous but very low pressure exhaling thru your nose when it's underwater. Your eyes will sting when you open them underwater so only do that for short glances to get your bearings.

8) Repeat step 7 for 32 lengths and bingo! You're a swimmer.

<comment><USER27> Not sure about learning to swim with fins. Haven't used them for ages, but from what I remember, you just cannot move your hands fast enough to match the speed you can get with fins. What I used to as a teen just be on my back and go full-speed.

</comment></comment></comment><comment><USER28> This part struck me:

> "Study after study shows that good social relationships are the strongest, > most consistent predictor there is of a happy life."

I was having a similar conversation with some friends recently. In our parents' generations (boomers), folks tended to cluster in their communities, which were usually religious. As our generation has grown up we've shunned the oppressive religious thinking but ended up losing the community aspect. I believe that's where all this social anxiety and feelings of loneliness come from. I'm mostly introverted but feel happier and refreshed after spending time with friends. I've joined a group of other rock climbers and we do outings monthly. I love climbing but really love the mini-community we've created. I see the author here found the same thing. Being around other folks in a shared bond of movement (swimming, running, etc) fosters joy :)

</comment><comment><USER29> I used to do competitive swimming but it was training that allowed you to switch off and can't beat it. Alas public swimming pool's are a chaos of noise and actions and whilst some have swim lanes, your kinda relieving gridlock and just causes more stress than I can expel.

<comment><USER30> Our local public pool opens at 7:00 and the small group of people who are there every day at that time all come purely to do their laps for an hour.

Personally I can't stand chlorified water though...

</comment></comment><comment><USER31> The only thing that sucks with loving swimming is that the free market has a hard time reacting to the fluctuations in demand. If I want to open a gym I'll buy a big garage or something, buy a lot of equipment and hire some PTs. If I want to open up a facility for swimming there's a hell of a lot more up front costs in building a pool and recruiting life guards and swimming instructors.

In this heat wave over Europe I've been forced to lakes and oceans to get my laps, but it is a bit more challenging to get that to work.

<comment><USER32> happiness is the welcome side effect of the things you do, so do the things you like, and happiness will come in nature.

</comment></comment><comment><USER33> I can't read the article either. I used to go swimming often and it made me feel really good. But for me, something makes it really hard to do it regularly so it always petered out. Which is annoying, because it obviously improved my life. Non-exercise things are so much easier for me to work on and to keep on doing. Playing chess one hour per day? No problem! Swimming four times a week? Eh...

</comment><comment><USER34> I do swim, run and bike all the time. Best thing about swimming is that you are totally by yourself without any distractions. When running or biking you end up getting distracted with music in your ears or other people on road. Swimming is very meditative specifically for this reason. Most of all very little impact on the joints.

</comment><comment> happy-go-lucky I enjoyed reading the article.

> In the end, happiness is a side effect of living well

I find that I get that side effect from any physical activity including but not limited to walking, cycling, running, or swimming.

</comment><comment><USER35> <sarcasm>"That I'm miserable and hate everyone"</sarcasm>

At my Y, the swimmers are not exactly people filled with joy.

</comment><comment><USER36> Disable JavaScript to read the article.</comment>


Apple accidentally confirms the existence of an unreleased product: AirTags - <AUTHOR> https://techcrunch.com/2020/04/02/apple-accidentally-confirms-the-existence-of-an-unreleased-product-airtags/ <comment><USER2> Did they combine the find my phone with the find my friends app? Now this too?</comment>


Differential Computation Analysis: Hiding your White-Box Designs is Not Enough [pdf] - <AUTHOR> http://eprint.iacr.org/2015/753.pdf

<comment><USER2> White-box crypto is a neat idea: in essence, it encrypts the implementation of the cipher, transforming straightforward efficient assembly implementations of AES into huge, difficult-to-analyze sequences of instructions that are themselves expressive of a higher-level cipher. The goal is to ship to customers an implementation of a cipher that bakes the key in, in such a way that it's cryptographically difficult to extract the key and then use it in a different implementation of the same cipher.

This is, cryptographically speaking, a stretch. In 2004 it get much stretchier when Billet broke one of the best known AES white-box schemes; you can google "white box BGE attack" for the details.

Section 2 of this paper is a pretty good overview of white box crypto and the well-known attacks on it.

Worth mentioning: a big application for white-box crypto is DRM and content protection. In a DRM setting, defenders are not concerned with _absolute_ protection against attacks, but rather _economic_ protection: it should cost more to break a DRM scheme than a piece of content is worth. It's still possible that white-box crypto can provide that level of assurance for some kinds of content. For instance, with DRM'd movies, studios are mostly concerned about the new-release window; if it takes 2x the new-release window to break a white-box DRM scheme, the studios are probably fine with that.

<comment><USER3> > This is, cryptographically speaking, a stretch.

Not only that, this transforms any symmetric-key encryption scheme into a public-key encryption scheme---share the obfuscated "white-box" code as the public-key for encryption, and use the deobfuscated code for decryption. (The recent cryptographic obfuscation breakthroughs should also be able to do something close to this, but at a ludicrous computational cost, and who knows what the security of it actually is.)

The news in this paper is the semi-automation of the attacks using side- channel techniques. I wonder how this would fare with a white-box cipher that used standard DPA countermeasures. I suppose that in the white-box setting there is no guarantee of good randomness, so by zeroing the randomness source similar attacks as this paper's could be mounted.</comment></comment>


SL0T0X – A modular penetration testing interface - <AUTHOR> https://github.com/Slotleet/SL0T0X <comment><USER2> It looks like a note-taking app with file attachments. Are there any docs or detailed description?</comment>


Why Web Won't Be Nirvana (1995) - <AUTHOR> http://genius.com/Clifford-stoll-why-web-wont-be-nirvana-annotated/

<comment><USER2> still holds mostly true today</comment>


Ask YC: What do you think of Apple's SDK vs. Open Tool Chain from a business perspective? - <AUTHOR>

So several people seem to agree that the Open Tool Chain allows everything Apple's SDK does and more.  But, if you want to start a company based on the iPhone do you think it's preferrable to use Apple's SDK to remain "offical"? <comment><USER2> Yes, use the official SDK. The problem with the "Open Tool Chain" is that there's no guarantee of backward compatibility and hence you'll always be at risk that Apple breaks your application. If I was doing an app. for business reasons I'd go with the official SDK.

Sure, you appear to have lost a few things (perhaps the most significant is that ability to run in the background). I suspect that the biggest benefit of the Open Tool Chain is that it will provide a way for Apple to see what people want in the real SDK and they can cherry pick official additions as necessary. The essentially did that with the entire SDK idea in the first place.</comment>


Ask HN: IT Security - <AUTHOR> I recently have been attending and researching anything and everything about IT security, primarily windows.
Are there any books/resources/etc. that you would recommend for an individual who is passionate about learning? I have seen countless books on the subject, but I would rather not waste the limited time I have reading something that isn't helpful.
I have a degree in Management Information Systems, with a minor in Computer Science, so I'm not a fish within IT (if that matters) <comment><USER2> There was a recent discussion about (free) online training courses [https://news.ycombinator.com/item?id=12786545](https://news.ycombinator.com/item?id=12786545)

P.S. Welcome to HN. Prefix your question with 'Ask HN' and it will go into [https://news.ycombinator.com/ask](https://news.ycombinator.com/ask) which requires less upvotes to get attention

<comment><AUTHOR> Thank you for the tip!

</comment></comment><comment><USER3> There was another good post the other day that highlighted some good security blogs. The best in my opinion were [http://www.schneier.com/blog/](http://www.schneier.com/blog/), [https://threatpost.com/](https://threatpost.com/), [http://krebsonsecurity.com/](http://krebsonsecurity.com/). In addition to these, joining some hacker forums to see the kind of shenanigans and tools they employ could be helpful.

<comment><AUTHOR> Thank you! I appreciate the help

</comment></comment><comment><USER4> Windows Internals: [https://technet.microsoft.com/en- us/sysinternals/bb963901.as...](https://technet.microsoft.com/en- us/sysinternals/bb963901.aspx)

<comment><AUTHOR> Have you read this book? I have seen this book being recommended before, and am curious to see what you would rank it

<comment><USER4> Yeah, it's the text for Windows architecture and internals. Security is ultimately about understanding how things work, so if you're going to delve into that you might as well learn how the system works. The security chapter should be of interest to you at least.

</comment></comment></comment><comment><USER5> If you're after specific advice on how to secure particular resources (e.g. Windows Server 2012), you can have a look at the CIS Security Benchmarks. They are comprehensive resources on the steps you should take to lock down operating systems etc. The windows ones are here: [https://benchmarks.cisecurity.org/downloads/browse/index.cfm...](https://benchmarks.cisecurity.org/downloads/browse/index.cfm?category=benchmarks.os.windows)

</comment><comment><USER6> I was a fan of this one. Lots of expert authors, lots of good information!

[https://www.amazon.com/dp/B01I0QTHYK#nav- subnav](https://www.amazon.com/dp/B01I0QTHYK#nav-subnav)

<comment><AUTHOR> Thank you for your response, but I feel like this book wouldn't really be beneficial to me. I have taken courses covering this material in great detail

</comment></comment><comment><USER7> Can you be a bit more specific about what you are wanting to look at. Is it a broad overview or are you wanting to look into (or become an expert in) a focused area?

<comment><AUTHOR> For now I think a broad overview would be a better option, then I can narrow in on areas that I feel weak in.</comment></comment>


Algorithm Tutorials - <AUTHOR> http://www.topcoder.com/tc?module=Static&d1=tutorials&d2=alg_index <comment><USER2> Design Patterns <http://www.cs.wustl.edu/~schmidt/tutorials-patterns.html>

</comment><comment><USER3> thank you my friend ..

im preparing for an interview and these seem like they could help a great deal.</comment>


Incremental Garbage Collector in PyPy - <AUTHOR> http://morepypy.blogspot.com/2013/10/incremental-garbage-collector-in-pypy.html

<comment><USER2> Impressive work!

Aside: _Please_ never rely on your users being able to tell which colour is which on a graph. Use a different dashing or something.

<comment><AUTHOR> eh sorry, fair point. you can guess from the text that the best one is cpython, the two other are not that different anyway ;-)

<comment><USER2> I'm not colourblind so it didn't affect me, but as a general rule a large number of your readers will be so it's really worth tweaking your standard graphs a bit.

It was fairly obvious, but I kinda feel the need to point this out whenever it's happening :)

</comment></comment></comment><comment><USER3> Thanks for the impressive work! It was hard to dive into "details" paragraphs from fast reading, maybe second try will give more understanding.

As an additional question: are there any more details about Raspberry Pi Foundation collaboration? I mean, are there specific projects / codebases they're interested in using PyPy, or was just general donation as a project that should fit well?

<comment><AUTHOR> as mentioned on the PyPy blog, Raspberry Pi Foundation sponsored partly the ARM port as well as the incremental GC. The reason (as far as I understand) is that PyPy on RPI would provide a fast Python for development of various things, like games.

</comment></comment><comment><USER4> Great! Very good news for a wide range of applications. It sounds like it was done in a very elegant way as well. Congrats :)

Is it possible to call the garbage collection at a certain time? For games, a common place to do these book keeping tasks is when the app is blocking on vsync screen refresh. Or even when the main action has finished. Say between levels in games, or at the end of an animation, or when waiting for a triggered event to happen (say for robots in a factory). Other real time systems do GC in other threads... so maybe this could be a win for pypy too?

Is JIT a similar thing? Does that cause pauses too?

<comment><USER5> > Is it possible to call the garbage collection at a certain time?

         import gc; gc.collect()</comment></comment>


Computer Hacking Made Easy - <AUTHOR> http://www.businessweek.com/magazine/content/09_34/b4144036807250.htm?campaign_id=rss_tech <comment><USER2> This article says nothing you don't already know, but it's worth noting how it's the payoff for a classic marketing department PR strategy: keep conducting "surveys" of some sort and publishing the results in press releases, and eventually someone in the trade press will cite them to write a trend story.

</comment><comment><USER3> There have been script kiddies for a long time. This sounds like more of the same.

<comment><USER4> Indeed. It seems like I trip over one of these "it's easier than ever for the kids to be haxors nowadays! You gotta think like The Bad Guy to stay ahead of them! But we will, so keep giving us security money!" articles about every 18 months or so.

</comment></comment><comment><USER5> What we need is some nonprofit or government maintained list of viruses/Trojans From which all virus scan companies report to draw from and some form of at least basic detection Incorporated into every computer, as opposed to each virus scanner using it's own definition list. I mean this could be an issue of national security.</comment>


Talko's now part of Skype - <AUTHOR> http://www.talko.com <comment><AUTHOR> Congrats to Ray Ozzie's startup, and being back at Microsoft. Full circle ;)</comment>


McGraw-Hill exec: tech will make us rethink age-grouping in schools - <AUTHOR> http://gigaom.com/2012/09/27/mcgraw-hill-exec-tech-will-make-us-rethink-age-grouping-in-schools/

<comment><AUTHOR> It has been known for more than a century that dividing up school pupils by age into lock-step grades is a bad idea:

<http://learninfreedom.org/age_grading_bad.html></comment>


Traffic-busting $100B Bay Area tax plan taking shape - <AUTHOR> https://www.mercurynews.com/2019/06/08/mega-measure-100-billion-traffic-busting-tax-plan-for-the-bay-area-taking-shape/ <comment><USER3> I really like the bendy train in the artistic rendering. What materials would allow for railroad car chassis and bodies which could bend and torque with the curve of the track like rubber? I think you would need lots of wheels or a relatively pointless flex-inducing system on each car to even get it to bend in this fashion.

Perhaps it just made for a pretty picture, and a completely impractical reality :)

[https://i2.wp.com/www.mercurynews.com/wp- content/uploads/201...](https://i2.wp.com/www.mercurynews.com/wp- content/uploads/2017/12/ebt-l-2ndtube-12xx-11.jpg)

<comment><USER4> The artist just doesn't understand physics. Even if it was possible, you'd be losing huge amounts of energy to constant deformation.

<comment><USER5> I don't think this is correct as a general statement. Imagine if the walls were made of canvas fabric with appropriate amounts of slack, just as an example of a material that can easily bend.

You would need a cleverly designed frame, but I'm sure there is something that would work. Perhaps many smaller segments joined together.

<comment><USER4> Canvas can bend more easily than rubber or steel, but deforming it still requires some energy. And while canvas would work for the walls, it wouldn't work for the bogey, and anything rigid enough to work as a bogey would take lots of energy to bend.

</comment></comment></comment></comment><comment><USER6> Seattle is actively _removing_ places for cars to drive, including lanes on streets and parking at curbs, to make way for transit. It's positively, magnificently car hostile, and precisely the model I would like to see in the Bay Area

<comment><USER7> Seattle has a functioning local government that does things like approve building permits, an idea considered insane in the BA. I'll never understand how restricting building is meant to "preserve neighborhood character," when it actually results in pushing out long-term residents.

<comment><USER8> I wouldn't be so certain Seattle is truly different. It's called the Seattle process for a reason.

[https://en.m.wikipedia.org/wiki/Seattle_process](https://en.m.wikipedia.org/wiki/Seattle_process)

Honestly, I don't know why the transit politics are working so well here. Partly because Sound Transit has been unusually courageous for a political entity. They have successfully stared down the two richest areas in the region Bellevue and Mercer Island when faced with opposition.

Maybe it just comes down to propaganda. Quite a bit of money was spent to market ST3 to voters. Which is the most recent and most expensive transit oriented ballot initiative.

The whole time there has been a tremendous amount of work done to oppose the improvements. Many in the area will be familiar with the near constant efforts of Tim Eyman to defund transit projects

You might chock it up to uber lefties in Seattle but other liberal priorities have not faired nearly as well on ballot initiatives.

</comment></comment></comment><comment><USER9> They talk briefly about housing at the end, but that strikes me as absolutely core to the success of any initiative to decrease congestion. People tolerate absurd commutes because the jobs are better here, increasing transportation bandwidth in isolation will just increase the distance people are willing to travel. Only solution is either more housing here or better jobs elsewhere, and we can't control the latter.

<comment><USER10> >> They talk briefly about housing at the end, but that strikes me as absolutely core to the success of any initiative to decrease congestion.

Public transportation only works to connect high density areas. It's critical to take that into account or systems will fail.

<comment><USER11> It also works to transport people in narrow corridors across geographic barriers. Like the Bay itself, or the fact that both sides of the Bay are long and narrow.

</comment></comment></comment><comment> dfeojm-zlib All of said money should be spent on public transport. Spending on single- occupant personal transport, mostly SUVs, commuters act like a gas: it will expand to fill the container: more traffic, more commuters, and more climate change. It won't do any net good to waste money on more highways.

<comment><USER12> Bay Area just needs an underground centralized subway and interconnected light rail. It's so simple and so ridiculous how power NIMBYs just always shut any progress down. Would be such a boon to the quality of living here, it's absurd we can't make this happen.

<comment><USER13> There are only a few places in the Bay Area as dense as the European and Japanese cities that have mass transit.

I've been to a number of cities in Europe and Japan with the population density of the Bay Area. They don't have subways. They have a couple of train stations that link them to major cities. Most people who live in these places drive cars, ride bicycles, or take the bus.

The kind of public transit you want is only sustainable in very dense cities. Outside of downtown San Francisco and Oakland, the Bay Area is a suburb. The amount of money it would take to subsidize a reasonable subway system would bankrupt the state.

<comment><USER14> But the density is being suppressed by zoning limits on building heights, parking requirements, mandated road improvements to handle additional traffic, and a building permit process that is heavily influenced by NIMBYs. Pass SB50 and watch the upper peninsula become viable for subways.

</comment></comment></comment></comment><comment><USER15> > asked registered voters, among other questions, whether they would support a > 1-cent sales tax to fund transportation projects in the Bay Area. Seventy- > one percent of respondents answered, "Yes."

 _facepalm_

Please stop with the regressive sales taxes. These things should be paid for in property or progressive income taxes instead of a tax on being poor.

<comment><USER16> Sure put the tax on those who'd be commuting on this new infrastructure. However for those that live within a few miles of their job, what exactly are they gaining?

It's the same reason Bridges have a toll vs getting funds directly from property / income tax.

<comment><USER17> Not everyone is privileged enough to be able to afford to live close to their job. This is about raising quality of life across the board. People who have the "I've got mine, so fuck you" attitude are a blight on society.

<comment><USER16> Sounds like it should be funded by Sales Tax / Income tax vs Property Tax.

Property Tax should be about using the land & making improvements to nearby areas. Not about funding things far away.

</comment></comment></comment></comment><comment><USER18> "The farther people travel, the more demand there is for bigger solutions," he said. "There is no question this region has to address housing, but how we do that, that is still to be discussed."

No, it's a _prerequisite_ to solving the transportation problem. How else would you know what to design the system for?

</comment><comment><USER19> Lack of affordable housing near work is creating a lot of traffic in the San Francisco Bay Area. A lot of cities are adding more offices than housing.

To eliminate congestion: Either you have to fix housing or add more toll to roads.

<comment><USER20> When jobs disappear and we have more automation/AI filling in for people..what are we doing to do with congested cities with decaying infrastructure.

I think the govt should focus on what will happen when we reach a post-jobs future instead of ways to tax people more now. Invest in technologies and some form of universal basic services(like food, medical) and take care of infrastructure and schooling etc. they should particularly come clean and fix the unfunded pension liabilities of public sector employees in CA which is where most of the taxes are going.

The biggest expense is public schools and education. Figuring how to deliver education effectively to young minds(likely with parents who won't work because there will be fewer jobs) by disrupting education is better than trying to appease unionized teachers who are focused on inflating pensions rather than their students who suffer during strikes and walk outs.

<comment><USER21> Ever been to a city? There is a reason NYC has everything one could ever want to experience because it takes very few interested people to have a lot of people in NYC interested in a thing.

<comment><USER20> It's really not helpful to enquire if I have 'ever been to a city?'

</comment></comment></comment></comment><comment><USER22> Start by getting rid of the street level single car parking garages that literally define every single residential neighborhood in San Francisco.

<comment><USER23> Couldn't agree more! Banning single car garages and mandating that all construction include two garage stalls per dwelling would free up massive amounts of street parking and all us to add desperately needed lanes on many streets.

<comment><USER22> Very funny.

</comment></comment></comment><comment><USER24> I believe that, if we work together, the Bay Area has the ability to raise $100B in taxes.

I don't believe for a second that our ruling class will be able to do anything useful with it. And I say this as a mass transit user and supporter.

<comment><USER17> It's not even that. Even if the governments could use it effectively, they'll get hit with lawsuits by NIMBYs not wanting rail or a new station too close to their house, which eats up valuable funding.

</comment></comment><comment><USER4> $100 billion sounds like a lot, but note that it'll cost $5-10 billion just to bring Caltrain to a downtown station from its current location: [https://sf.curbed.com/2018/9/12/17850744/pennsylvania- avenue...](https://sf.curbed.com/2018/9/12/17850744/pennsylvania-avenue-route- caltrain-extension-transbay-high-speed-rail). I think everyone will be shocked at how little new infrastructure San Francisco actually gets for the money.

Consider what it'd take to get a transit system comparable to say Chicago's. (The two areas aren't that dissimilar in size and population. Chicagoland has 9.5 million people in 10,500 square miles; the Bay Area has 8 million people in 7,000 square miles.) Chicago has 500 miles of commuter rail plus 100 miles of rapid transit. San Francisco has 70 miles of light rail (Muni), plus ~180 miles of commuter rail (BART + Caltrain). And it's not clear that Muni even counts as a rapid transit line. Most of it isn't grade separated, so it's got an average speed of 8 miles per hour. (The D.C. Metro, a typical heavy-rail system, averages 33 miles per hour including stops.) The LRVs go about 5,000 miles between failures, versus 200,000 miles for a 7000-series D.C. Metro car.

So even to get to Chicago levels (where most people still drive!), you're talking about building a whole new subway system, plus building hundreds of miles of commuter rail across the Bay Area. It's a trillion dollar project, not a $100 billion project.

So what would it take to finance all that? Let's be charitable and say you can do it for $500 billion. California is currently issuing 25-year general obligation bonds at 5% for 25 year maturity. That's $35 billion per year in annual payments, divided by 2.6 million Bay Area households. Or about $13,500 per household per year.

If that sounds unaffordable, let's hypothesize we just have "rich people" pay for it. The top 5% of households in the San Francisco metro area make an average of $600,000 per year. Applying that to the whole Bay Area, you're looking at 130,000 households making $78 billion per year total. So the tax for transit would have to be the other 50% of income that California doesn't already tax those folks.

Okay, surely billionaires have the money. Last year, US billionaires made $470 billion. So we are talking about less than a 10% billionaire's tax, right? Well the Bay Area is just 3% of the country's population. Hardly seems fair to give it such an outsized portion of confiscatory billionaire taxes. 3% of 470 is about $15 billion, not close to enough!

Oh, and here's the kicker. _Everyone_ would pay for that new transit, but most people wouldn't be able to use it! In Chicago, only 12% of commuters take public transit, because the system, as extensive as it is, really only is good for getting people into downtown and back out. Even if San Francisco manages to double that, you're talking about everyone paying what would be in the rest of the country a mortgage on a house for a transit system 75% of people can't use.

<comment><USER25> "Oh, and here's the kicker. Everyone would pay for that new transit, but most people wouldn't be able to use it!"

You are being a bit shortsighted. Even if you don't use it, you'll benefit from less road congestion. The average speed on roads keeps decreasing.

Remove 25% of the cars and driver's commute times will also improve. Fewer accidents, etc

<comment><USER4> It would be much cheaper to just widen the congested roads by 25% instead. (And before you say "induced demand"—removing cars from the road will also create induced demand. Induced demand results from the fact of reduced road congestion, not the specific means by which you reduce congestion.)

More broadly, urban congestion is something that only affects a subset of people. The average American commute is 26 minutes, but a staggering 16 miles. People are cruising to work! The US has among the fastest commutes in the OECD: [https://economix.blogs.nytimes.com/2011/10/14/world-of- commu...](https://economix.blogs.nytimes.com/2011/10/14/world-of-commuters).

<comment><USER25> That's what people said 50 years ago.

And when we have another 200 million Americans, we just make the roads wider again?

Because we didn't build the proper mass transportation systems 50 years ago, it's incredibly expensive to build now. It won't be easier in another 50 years with millions of more people

<comment><USER23> Freeways _are_ mass transportation, it might not be the kind you like, but they are pretty effective at getting large numbers of people from origin to destination.

The peak capacity of a mile of track will always be less than that of a mile of highway. But we don't have anywhere to put either because we refuse to build up and ruin a bunch of NIMBYs views.

<comment><USER25> Where are you getting your numbers? Are you making them up?

How many passenger cars can you get down a mile of highway per hour?

I love freeways. It's just that during rush hour (and holiday weekends), they're extremely congested. We've got local lanes, express lanes, and Waze to help figure out which one to take.

Roads don't scale very well.

Mass transit would more acceptable if we can increase the speed. China has low-medium speed maglevs, for example, that will travel 100-120 miles per hour.

[https://www.cnn.com/travel/article/china-driverless- maglev-t...](https://www.cnn.com/travel/article/china-driverless-maglev- trains/index.html)

<comment><USER4> To use some example numbers. VA7, which goes from the Dulles area where many DC-area data centers are located, through Reston where many tech companies' offices are located, to near DC, carries 50,000-100,000 vehicles per day, and is congested pretty much all day. The Metro Silver line, which follows roughly the same route, theoretically destroys that. An 8-car Metro train carries 1,400 people. With 8-minute headways, that's 7.5 trains per hour, 90 trains over a 12-hour commuting day, or 126,000 people.

Except the actual ridership of the Silver Line is just about 17,000 people per day, and declining. Why? Because it's useless for most people. It takes you to DC at one end, and the airport at the other, and a few places that happen to be on the way. But most people who live in that area don't commute to DC. People take VA7 to go from say Sterling (where there is no metro station) to Tyson's Corner. They have to get in a car to use Metro anyway, and by the time they do that, it's faster to just drive to Tysons instead of getting on the Metro for the segment of the trip Metro covers.

On the other side of DC, the Maryland suburbs are served by no fewer than 37.5 trains per hour (15 on the Green/Yellow, 15 on the Blue/Silver, and 7.5 on the Orange). That's 50,000 people per hour! But the cars are pretty much empty in Maryland, because few people commute into DC. In the height of irony, Metro is moving one of its main employment centers to Lanham Maryland, located on the terminus of the orange line. That means it's not actually commutable by Metro for most part. Folks who work for WMATA aren't living in DC and doing a reverse commute. They're living in Bowie or Largo or College Park or Hyattsville (the surrounding towns). Taking Metro would involve going all the way to DC, switching from the Green/Yellow or Blue/Silver to the Orange, then going back all the way.

<comment><USER25> Hang on...

you're giving me confirmation bias.

You're cherry picking one example that confirms your bias. No first principles reasoning.

You're giving some specific example about a setup in Washington DC.

This has _absolutely nothing_ to do with how well mass transit can do versus cars. It's one specific implementation.

In NYC, for example, 5.5 million people take the subway per day. How much highway will you need to carry that many people?

<comment><USER4> "How much highway would you need to move 5.5 million people into and through a dense downtown core" is a question almost no city in the US besides New York needs to ask.

NYC is uniquely dense: [https://www.austincontrarian.com/austincontrarian/2012/09/th...](https://www.austincontrarian.com/austincontrarian/2012/09/the-50-densest- american-metropolitan-areas-by-weighted-density.html). The weighted population density (the density in the parts of the metro area where people live) is 30,000 people per square mile. LA and SF, the next most dense, are less than half as dense, at 12,000. DC, at 6,400, is about 1/5 the density of New York. Portland and Seattle are even less dense, at 4,000-5,000, which is about the national average.

The Silver Line example is much more illustrative of a typical place in the US. In these places, the higher theoretical capacity of rail is irrelevant, because the commuting pattern isn't about bringing a large number of people along a few major paths to a downtown job center. It's about shuttling people between job clusters spread out among the suburbs: [http://www.robertmanduca.com/projects/jobs.html](http://www.robertmanduca.com/projects/jobs.html) (scroll over to Northern VA, west of DC). There might be heavily used corridors like VA7, but the commutes both start and end in suburban locations. You couldn't pick out a few key paths where being able to move 100,000 people a day from point A to point B and intermediate points would really be all that helpful.

<comment><USER21> SF should be NYC level density.

<comment><USER4> It's not just SF. 85% of the Bay Area lives outside SF. The area's key industry is not only outside SF, but mostly scattered among random suburban office parks in the South Bay. Densifying SF won't do it. You have to get the jobs out from the big suburban office parks into downtown, or at least in transit accessible locations in a handful of South Bay cities.

</comment></comment></comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER26> Not interested in waiting. We're moving out of the Bay Area next week.

<comment><USER27> Just moved from the Bay Area to the Greater Bay Area[1]! Join, it's nice here, except for the weather. There's a real energy here in HK!

1: [https://en.m.wikipedia.org/wiki/Guangdong-Hong_Kong- Macau_Gr...](https://en.m.wikipedia.org/wiki/Guangdong-Hong_Kong- Macau_Greater_Bay_Area)

<comment><USER28> Isn't the property price even worse there?

<comment><USER27> Rentals are cheaper. I can get a nice 1br in mid-levels for ~20k HKD (i.e. $2.5k). In SF these days, I'm not getting a decent 1br in a desirable location under $4k. My $3.5k rent was considered way under market.

</comment></comment></comment></comment><comment><USER29> At very least increasing taxes is a great way to make more people leave, and thus help with congestion on way or another. ;D

</comment><comment><USER30> This feels so misguided to me. This is going to cost ~$35k/household and the govt is generally terrible at spending money.

It also dodges the real issue in the bay area, which is housing. Commutes are long because most people can't afford to live next to their jobs. If we stopped restricting new housing and taller building, then the number of cars on the road would decrease.

Furthermore, there are innovations coming that might shorten commuting (e.g. things like Hyperloop, although I have no idea if that's viable) and self- driving cars (which let you read/work/etc while commuting). The government is not going to be able to deploy $100b better over the next few decades than the private market.

Finally, the rise of remote work might mean a lot of professions commute less in the future. My prediction is this just going to be an exercise in setting $100b on fire.

<comment><USER31> Has there ever been a time in modern history where building new housing in a large city like SF or SEA has actually decreased housing prices with evidence that no other economic factors at the time played a role?

<comment><USER28> Yes, Tokyo.

<comment><USER32> That's only because Tokyo's long term population trend is _negative_ , unlike most cities.

<comment><USER28> Uh, no. That's not it at all.

</comment></comment></comment></comment></comment><comment><USER33> Yikes that sounds bad. Will need to see the details to be sure though.

So here is how Santa Clara County handles the same issue already: every 10 years, they put on the ballot a one-cent sales tax. Along side it, they put a list of the projects to be funded. There is a clear link between the tax and projects, local control, a deadline, and a 10-year reckoning. Alameda County has also started a similar project.

Consider the alternative: the new Bay Bridge eastern span. It cost way more than it should have. Why? Because the mayors of Oakland and Berkeley demanded a pretty bridge instead of a simple one. It was paid for not by Oakland and Berkeley, but by the state which charges tolls on all the bridges -- including the Dumbarton, San Mateo, and Antioch bridges which were of the exact same "simple" type that Oakland and Berkeley complained about.

When the projects are paid for out of big, faceless funding, then there is no incentive to make it work for the people paying the tax. For example, link up Caltrain closer to downtown? That's not really a benefit to anyone other than SF and the Penninsula.

<comment><USER32>
      they put a list of the projects to be funded

... which is _not legally binding_.

Seriously, the VTA is the absolute poster child for _worst_ return on infrastructure investment in USA history. Its operating costs (alone!) are 85% subsidized with nothing going to fixed costs.

</comment></comment><comment><USER20> [https://www.latimes.com/local/california/la-me-bullet- train-...](https://www.latimes.com/local/california/la-me-bullet-train- cash-20190610-story.html) : the high speed bullet train to nowhere that ripped out farms and destroyed business in the Central Valley have still not paid the farmers.

Why handing over $100 billion dollars to these 'authorities' would be an ill advised move.

</comment><comment><USER34> Fremont/Newark to Palo Alto Transit line, theres already a rail line out. Can make it stop in Menlo Park near Facebook, take some funds from the Zuck.

</comment><comment><USER35> The responses to this post illustrate perfectly why California has the infrastructure crunch it does. As it turns out, constantly making Utopian proposals and decrying anymore who disagrees doesn't actually solve any problems. But that's all anyone does in California, which is why the state can barely manage to allow the owner of an obsolete laundromat to turn it into a modest apartment building.

</comment><comment><USER36> How about allowing housing construction near where people work, instead of forcing soul-crushing, expensive commutes?

<comment><USER32> But that has no beneficial effect unless you limit access to those residences to people who work there (including evicting them upon job change) and limit jobs to those who live locally. Neither is legal.

<comment><USER17> This ends up not being a problem in practice as long as you just simply have enough housing.

</comment></comment></comment><comment><USER37> Article sounded good, but I don't agree with sentiment that many small independent agencies providing public transportation is a bad thing.

I'd prefer many independent agencies (public and private) working together (See: Tokyo) than one big monolith. We need competition.

<comment><USER21> Do you live in the bay? The transit agencies have territorial fiefdoms rather then compete. BART and Muni force customers of both to go up and down to transfer at the stations they share.

<comment><USER38> BART uses wider than standard gauge, Muni uses standard gauge. They don't share track because it's physically impossible (though it would be logistically problematic even if it was possible, given the pack frequency for each at those stations), not because of "territorial fiefdoms."

<comment><USER39> It is true that Bart doesn't use standard width track.

However, Caltrain, Muni, VTA, ACE and Amtrak all use standard width track, and none of them cooperate with the others in a meaningful way.

When I gave up on the train commute, they didn't even bother to arrange timed transfers where they happened to have adjacent stations.

These agencies need to be combined under an umbrella organization with the authority to make unilateral decisions for the subagencies to implement.

<comment><USER38> > It is true that Bart doesn't use standard width track.

> However, Caltrain, Muni, VTA, ACE and Amtrak all use standard width track, > and none of them cooperate with the others in a meaningful way.

Part of the reason it might seem that way is different federal regulatory regimes between the light (Muni, VTA) and heavy (Amtrak, ACE, Caltrain) rail lines, which makes many naively simple kinds of cooperation difficult in practice.

> These agencies need to be combined under an umbrella organization with the > authority to make unilateral decisions for the subagencies to implement.

Yes, the best way to make bureaucracy more efficient and responsive is to make it larger and more distant from the community served.

<comment><USER21> What regulation forbids timed transfers or unified fares?

</comment></comment></comment></comment></comment></comment><comment><USER40> More like taxpayer-busting plan, like that train to nowhere.

</comment><comment><USER20> I really am not confident that the 'think tanks' and the govt has even two brain cells behind this idea.

1\. In 50 years, I predict that automation will erase many jobs.

2\. The notion that we need to live near where we work is going to become outdated and useless.

3\. This is just another way for the govt to get it's claws deeper into the tax payers wallets.

4\. High density is incompatible with affordability. Any affordable housing is subsidised housing with monies that is redistributed.

5\. We need more local governance rather than tyrannical regional governance in California with Sacramento dictating everything for everyone.

<comment><USER17> 1\. Assuming you're correct (which is certainly up for debate), what do we do for the next 50 years? Suffer?

2\. Service jobs will always exist. Restaurants, bars, shops, museums, schools, etc. need people present to make them work. Even in cases where people aren't _strictly_ required, people will still _want_ people around. People will always need stuff that will need to be delivered to wherever they are. People also don't want to just stay in their homes all day; transit demand is not solely shaped by work commutes.

3\. You draw the line in one place, other people draw it in others. Such is life.

4\. There are quite a few cities in the world that will disagree with you, and be right.

5\. We need people who will actually cooperate for the greater good. In the US that seems to be a rarity, as our culture is centered around individualism and competition, unlike many other places in the world. If we leave it up to a bunch of local governments cooperating we... oh, right, end up in the exact situation we're in now.

(I agree with you in principle on #5, but a solution that has as a prerequisite, "change the deep-seated culture of millions of people over a relatively short period of time", isn't something I see as doable.)

<comment><USER20> 1\. We don't have to suffer. We also don't have to hand over 100 billion $ to the govt because they want it. Many of us may not even be around in 50 years. It is essentially paying for the next generation and also agreeing to pushing them into debt.

Millennials will then be blamed not unlike baby boomers are blamed by millennials for 'messing up the next generation future'. Where in fact, it's agreeing to unrealistic long term plans like this and signing carte blanche whenever the state decides that we need to shell out without them being accountable.

2\. I disagree that we will need to have service jobs. Or that people need to travel to be 'around other people' who want them around.

Having said that, we do need public transport. We don't need to lump affordable housing with public transport costs. Just like part of the gas tax was set aside to train prisoners to make them employable. It's necessary but what's with the shifty shenanigans?

The public are lured into supporting housing and affordable housing imagining that it benefits them but that's a marginal side effect. The real purpose of random and especially questionable rezoning to keep building is to create a stream of income through property taxes. Ditto with job creation. Jobs have an inflationary effect.

An unemployed person in the rural area can still have avocado toast if he has a garden. He doesn't need $10.00 to buy an avocado toast. However he can't participate in the same economy as a 6 figure earning Silicon Valley resident of CA. However do note that all of them will be paying the same tax for public transport. As will their children over 50 years.

3\. Sure. I will vote as inspired by my line.

4\. I disagree. I literally don't know any affordable city that is high density. If you include Mumbai's slums or Hong Kong's coffin apartments or NYC rent controlled and subsidized projects, I reject them. It's not affordable. The cost of expensive living morphs from currency to something else that can be quantified in currency terms. There is a cost to cramming people in resource restricted areas which is also a fixed land area.

5\. It's such a general statement to say ' we need people to cooperate for a greater good'. It's a feel good statement that means nothing unless we get down to specifics.

The US is a better place to live in than most parts of the world. We don't have tribal wars or bloody religious uprisings or bomb threats everyday. I disagree with you. I don't know what cooperation you are talking about in 'other parts of the world'.

Admittedly there are other parts of the world where people cooperate and set aside individualism, but I am willing to bet that they are low density population areas where people have enough space. Cooperation thrives when everyone has the opportunity to make things work for everyone without just one group shouldering the burden. It is another way to make sure everyone carries equal responsibility. Cooperation is NOT co dependency.

</comment></comment></comment><comment><USER41> I'm personally excited about two transit projects in the bay area - <USER2> electrification and the Dumbarton Rail Corridor.

<comment><USER33> The Dumbarton Rail Corridor seems like a good idea, but it's not going to work. The problem is that Dumbarton commuters have a large "fanout"; that is, they come from all directions in the east side, and commute to locations in all directions in the west side. A single point-to-point link between Redwood City and Union City isn't very useful because of all the connections that would need to be made. Yes, there are connections to Caltrain, BART, and Amtrak, but those services are also linear and don't fan out well.

Two easy fixes to the Dumbo would do a lot more to reduce idling in traffic: (1) direct connection to 101 on the west side which was originally blocked by the city of Palo Alto, and (2) increase the capacity. But while there is plenty of appetite to charge bridge commuters exorbitant tolls, there is no appetite to do anything that helps them.

</comment></comment><comment><USER42> interesting. if they can do this then they can create a regional housing authority. then we can fix the density problem.

</comment><comment><USER43> Glad to see Delta Coves finally being built.

</comment><comment><USER44> 100b is a gdp of my country...

<comment><USER45> $800b is the GDP of the Bay area..

</comment></comment><comment> 33MHz-i486 just upzone where the jobs are and let the capital markets solve the problem. people would rather walk to work anyway.

100% of this money will be wasted on:

a) rebuilding few dozen graded crossing of rail

b) acquiring land at insane values (same land thats inflated by restrictive zoning)

c) backfilling unfunded pension liabilities of 9 different agencies

<comment><USER46> I wish they would do this in Los Angeles, or provides incentives for companies to move their companies to where people live. Instead, they are building out more in areas away from the jobs causing more and more congestion as everyone tries to get to work. Its mind boggling.

</comment></comment><comment><USER47> Hm, another tax? No, thank you.

</comment><comment><USER48> Or they could mandate remote work. Or tax companies that require employees to commute when it isnt required by the business/role.

<comment><USER49> Yeah, then every role will require it and the tax does nothing.

</comment></comment><comment><USER50> Give $100B to Boring company. At $10M/mile, they can dig 10,000 miles of tunnels.

<comment><USER51> And not solve transportation at all. Tunnels for individuals with primarily single-occupant vehicles are counter-productive. We need more public transit. Parking is expensive, insurance is expensive, the vast majority of the bay area public will be left out by this plan.

Either way tunnels aren't particularly expensive, stations, on-ramps/off-ramps are.

<comment><USER52> Why is there an assumption that the tunnels have to be for cars? Create tunnels for bicycles instead: \- Tunnels don´t need to be nearly as big, and would still have higher capacity \- The friction of ¨I won´t ride a bike because it´s dangerous¨ is reduced or eliminated \- Weather as a factor in commuting by bike is eliminated \- Like a railway grade, you can basically eliminate any significant elevation ascents/descents</comment></comment></comment>


The JavaScript Pipeline Operator - <AUTHOR> https://yanis.blog/the-pipeline-operator-in-javascript/ <comment><USER2> You don't need lodash or a new operator for the example provided:

      departments
        .flatMap(d => d.employees)
        .map(e => e.salary)
        .reduce((p, v) => Math.max(p, v), 0)

That said, the pipe operator is nice because it allows similar chaining patterns on subjects that are not arrays, as shown in the proposal's README: [https://github.com/tc39/proposal-pipeline- operator/blob/mast...](https://github.com/tc39/proposal-pipeline- operator/blob/master/README.md#introduction)

<comment><AUTHOR> Good point. Is flatMap already supported by browsers or is it a proposal?

<comment><USER3> Both flat[1] and flatMap[2] are unsupported in Edge, IE and Node.

1\. [https://developer.mozilla.org/en- US/docs/Web/JavaScript/Refe...](https://developer.mozilla.org/en- US/docs/Web/JavaScript/Reference/Global_Objects/Array/flat#Browser_compatibility)

2\. [https://developer.mozilla.org/en- US/docs/Web/JavaScript/Refe...](https://developer.mozilla.org/en- US/docs/Web/JavaScript/Reference/Global_Objects/Array/flatMap#Browser_compatibility)

</comment></comment></comment><comment><USER4> If you want to see how the operator "feels" in practice, I recommend trying out F#[0] or Elixir[1]. Hint: it's pretty great!

[0]: [https://www.microsoft.com/net/languages/fsharp](https://www.microsoft.com/net/languages/fsharp)

[1]: [https://elixir-lang.org/](https://elixir-lang.org/)

</comment><comment><USER5> ES6 was needed, but I think js should hit the breaks for new language features for a while.

<comment><USER6> I disagree. ES6 made JS much more palatable but it's still behind most modern languages in terms of number of features _and_ in velocity of new features getting introduced. Javascript has actually been extremely slow to get new features compared to other languages.

Since ES6 (3 years ago), the only major, mainstream feature that has been added to JS has been async functions, which are awesome, but in that time Python (a language of similar age and global use) has gotten an optional type system, async/await, and _hundreds_ of standard library modules, classes, and functions.

In my opinion, JS badly needs more functions in it's standard library, which should move through the proposal policy quickly. However, common sense standard library functions like flatMap have been in the pipeline for _years_ are still not in the final stage. We may not get flatMap, import(), trimStart, or trimEnd in ES2019, they are all stalled in Stage 3. There's no good arguments not to have these in the standard library, but we still have to wait years.

In addition to that, JS could really use some language features that make it's core paradigms, functional and object oriented, simpler, and have been in other languages for years. The pipeline operator would make functional programming much easier, and decorators would make object oriented programming easier. These are, in my opinion, common sense features since they are so well received in other langauges, but they get stalled out since they are seen as "bloating" the syntax, or making javascript "too opinionated on how to do something". Meanwhile, people are compiling full fledged functional languages (Reason, Elm, Purescript) to Javascript, because Javascript isn't keeping up with them on features. It could, but the TC39 review process is so slow that it's not worth waiting on. For those reasons, in my opinion, we should really be releasing new language features much quicker.

<comment><USER7> > I disagree. ES6 made JS much more palatable but it's still behind most > modern languages in terms of number of features and in velocity of new > features getting introduced. Javascript has actually been extremely slow to > get new features compared to other languages.

JS has been adding features at a tremendous rate. Several major features land every year. Adding something like async generators is a huge change that affects large parts of the language.

If the Go, Ruby, or Python guys want to add a feature, they just code up a proposal and add it if the maintainers like it. JS has 4 major implementations and a dozen or so other reasonably popular implementations. Adding a feature in a way that works with all of them (without breaking 25 years worth of applications) is hard.

Reason, Elm, and Purescript are _not_ good comparisons. The features they add (especially the type system) aren't likely to ever be JS features (if they are even possible in the language).

<comment><USER6> You say "Several major features land every year.", but you don't back that up.

In 2018 the major features we got object rest/spread and asynchronous interation. Rest/spread is a big feature that I forgot to mention, but async iteration is only useful in a few situations, I'd call it a minor feature.

In 2017 we got async/await, and shared memory/atomics. Only a few fringe code bases will use shared/memory/atomics, so I'd call async/await the only major feature.

In 2016 we got 0 major features. The only things in the entire spec (an entire year of language progress) was Array.includes and an exponent operator ( __). Both of those are very clearly "minor" features.

So in the last 3 years, I'd say we've had 2 or 3 major, mainstream features, that's very far from "several major features every year". Especially 2016 where there were 0 major features.

<comment><USER7> In 2016, browsers were still working on implementing es2015 (I'm still waiting for proper tail calls on non-Safari engines).

Atomics is a huge feature (especially in the amount of work required). getOwnPropertyDescriptors is also a big addition.

Async iteration is a very big deal that can potentially affect things like reading files in node. Object spread seems big, but is actually far more simple as it is a syntactic special case of Object.assign(). In contrast, the far reaching repercussions of adding async iteration and the implementation are both large things. Given the level of optimization for JS regex, adding a bunch of new features there is also a big job. Promise finally is also a big update (though combining map and flatmap in promises automatically is the biggest issue with them).

This year, there's integers, working imports, and big class upgrades in the works. The list of major proposals is rapidly shrinking.

Is there another major language adding that many big features in the past three years? Keep in mind that most stage 3 proposals already have at least one implementation already done.

</comment></comment></comment></comment></comment><comment><USER8> Been using this in LiveScript for awhile (ls also provides it in the opposite direction <| ). Very useful for chaining functions in a logical order and without unnecessary () nesting. Absolutely needs to be paired with partial application though for multiple argument functions.

<comment><AUTHOR> Yeah, partial application is also a stage 1 proposal now. But for now I guess you could also do with auto-curring functions ([https://ramdajs.com/](https://ramdajs.com/) or something like that)

</comment></comment><comment><USER9> FWIW, several language communities call this "the Thrush combinator"[0]. Armed with that term, searching the web for background/info/theory on this topic will be easier.

0 - [https://debasishg.blogspot.com/2009/09/thrush-combinator- in-...](https://debasishg.blogspot.com/2009/09/thrush-combinator-in- scala.html)

<comment><AUTHOR> Thanks! Sounds a bit too scientific to my ear but good to know

<comment><USER9> It is what it is, and what it is in JavaScript is this:

      Object.prototype.pipeTo = function (functor) {
        return functor (this);
        };

      function inc (input) { return input + 1; }

      // this will write out "2" to the console log
      new Number (1).pipeTo (inc).pipeTo (console.log);

HTH

</comment></comment></comment><comment><USER10> Interesting. This proposal would for the first time allow any javascript to be written in just 5 characters:

      []+|>

Down from the 6 that jsfuck requires:

      []+!()

</comment><comment><USER11> > "Expressions Math.sqrt(64) and 64 |> Math.sqrt are equivalent. The > difference is in how we read it. With pipeline operator data flows from left > to the right, and thus making it much more comprehensible"

Ugh, no, that's a very subjective statement, 64 |> Math.sqrt is not "much more comprehensible" assuming especially for beginners.

<comment><USER12> I agree that this example isn't convincing, I also prefer the "vanilla" Math.sqrt(64).

It's more convincing (IMO) when chaining calls, eg:

Math.sqrt(Math.ceil(Math.sin(64))) VS. 64 |> Math.sin |> Math.ceil |> Math.sqrt

<comment><USER13> I used to feel that way until I got comfortable with Elixir and its pipe operator. I think without prior knowledge the latter, which is interpreted left-to-right, is more intuitive: "take some data, do x, do y, do z"

</comment></comment></comment><comment><USER14> >The difference is in how we read it. With pipeline operator data flows from left to the right, and thus making it much more comprehensible without the need to introduce extra variables.

Why you need operator? Can't it be done with a function?

        pipe(64,Math.sqrt)

<comment><USER15> Your example falls apart when making multiple function calls.

<comment><USER14> Please explain.

<comment><USER16> 64 |> Math.sqrt becomes pipe(64, Math.sqrt)

64 |> Math.sqrt |> Math.sin becomes pipe(pipe(64, Math.sqrt), Math.sin)

Assuming pipe was smart and took varags we can make this better.

64 |> Math.sqrt |> Math.sin becomes pipe(64, Math.sqrt, Math.sin)

<comment><USER7> A pipe operator compiles directly into the AST and completely disappears before execution.

        64 |> Math.sqrt |> Math.sin
        Compiles in the AST to
        Math.sin(Math.sqrt(64))

        //curries variables away from functions
        var realPipe = (a, ...args) => (...initParams) => {
          var acc = a(...initParams);
          for (var i = 0; i < args.length; ++i) {
            acc = args[i](acc)
          }
          return acc;
        }

        //if first parameter is a function, curry to delay execution
        //if first param is not a function, curry, but call immediately
        var pipe = (a, ...args) =>
          (typeof a === "function")
            ? realPipe(a, ...args)
            : realPipe(...args)(a)

I'd note that this pipe implementation also bleeds its abstraction. JS has first-class functions, but this will never treat a function as data. You must be aware of how it works so if you are passing a function (for example, a getter function), you must manually curry it afterward.

This complication is why most pipe implementations don't actually mess with that data attribute part (they just skip to the realPipe implementation), but since the pipe operator can handle it, I figured I'd try to as well to show the issues.

<comment><USER16> I see no reason our function form couldn't do the same magic behind the scenes. Really no different from a lot of C compilers in this respect and with the bonus of an absolutely trivial polyfill.

</comment></comment></comment></comment></comment></comment><comment><USER17> Piping is relatively easy to write a function for. Here [0] is a package that I wrote that has a few trivial functions (including pipe) for things such as this.

0: [https://www.npmjs.com/package/afpf](https://www.npmjs.com/package/afpf)

</comment><comment><USER18> He was whining about lodash but still used it till the end.

His lodash and pipeline operator version looked more noisy than the lodash only version.

</comment><comment><USER19> My only real criticism, is it would be nice if it supported generators/promises as an alternative to for-await syntax.

<comment><USER20> IxJS [1] already has pipeable functions for working with AsyncIterable (the underlying interface for the proposed for-await-of syntax).

[1] [https://github.com/ReactiveX/IxJS](https://github.com/ReactiveX/IxJS)

</comment></comment><comment><USER21> rxjs is already available and allows to perform chained transformations by using wide variety of methods.

<comment><AUTHOR> Good point. I've heard about it but never could quite understand if it's useful enough. Can you share some public repos where it's being used?

<comment><USER21> the official web-site is pretty informative and has a ton of samples..[https://rxjs-dev.firebaseapp.com/api](https://rxjs- dev.firebaseapp.com/api) \- take a look at operators section for example. as for public repos - nowadays any modern front-end app that is built with Angular is using rxjs - it's de factor standard for data processing in angular world.

<comment><AUTHOR> Thanks sir. Will take a look

</comment></comment></comment></comment><comment><USER22> You could just use ramda [https://ramdajs.com/docs/#pipe](https://ramdajs.com/docs/#pipe)

Not quite as seamless and it would be nice to have |> but ultimatles introduces a lot of complexity.

The only good reason I could see is if there is a performance benefit a JavaScript JIT could take advantage of by having the |> operator?

<comment><AUTHOR> Honestly, I don't think so. More likely this will be just a syntactical sugar.

<comment><USER20> Performance benefits likely depend on which side of the partial application / currying coin the operator ends up landing on. Some of the partial application proposals would potentially reduce the needs for currying in the language, which would reduce the needs for a lot of variable closures in some libraries.

The biggest potential benefit is to typing (in Typescript or Flow), which potentially can provide potentially much better or at least much simpler typing and type inferencing with an operator versus many of the alternatives (such as variadic pipe() functions).</comment></comment></comment>


ASK HN: Software Apprenticeship or Software Bootcamp? - <AUTHOR> TLDR;
On handing in my notice at work, my company offered me a pretty awesome opportunity to rotate into a web development position with complementary training courses and a mentor.
Since I'm simply trying to optimise my learning (and not my financials), do you think I'd learn more full-time at Lambda School (a 9-month bootcamp) or working in a sort of apprenticeship model at a company?
For some additional context, I'm currently enrolled in a part-time course in software engineering (covered C & Java), but have only built console applications (~1000 LOC) so far.
Thanks a million to those who respond! <comment><USER2> Apprenticeship should be better. Bootcamps later ask to build prototypes using the framework you learned. In my opinion tt's more satisfying working on a real product together with others than yet another prototype. If you're enrolled in a part-time course you've shown that you have the motivation/dedication to catch up on any CS theory/books if needed.

</comment><comment><USER3> Apprenticeship - you'll learn exponentially more working alongside someone.</comment>


'; CREATE TABLE `Capture the Flag`;' -- Stripe's Web Security CTF is Live - <AUTHOR> https://stripe.com/blog/capture-the-flag-20 <comment><USER3> Shameless: Enjoying this challenge? You'd enjoy working with us. We're hiring in Chicago, in Mountain View, and in Manhattan. This stuff is our day-to-day, plus reversing, custom protocols, tool development, and exotic applications. If you've never done appsec work professionally, but find these challenges fun and straightforward, we'd love to talk to you:

We've hired more people off HN than from any other vector.

www.matasano.com/careers

(Or, you know, ask Stripe for a job. I'm sure they're hiring too!)

<comment><USER4> Matasano also likes interns! I worked with them for the past two summers and can't say enough good about the experience. You will learn (or get to practice) the things tptacek mentioned above as well as web apps, mobile, ruby, a staggering amount of crypto, and whatever else you find interesting to work on or ask about. If you're into this stuff, check them out!

</comment></comment><comment><USER5> Shameless, following tptacek and borski's examples: Having fun finding broken code? Want to get paid without going to the effort of writing exploits? You might want to look at the Tarsnap (or scrypt, or kivaloo, or spiped) code and see if you can win some bug bounties: <http://www.tarsnap.com/bugbounty.html>

(Or, you know, ask Stripe or Matasano or Tinfoil Security for a job. They'll pay you far more than you'd ever get from Tarsnap's bug bounties.)

</comment><comment><USER6> Disclaimer: _Also shameless_

A lot of people have fun with this kind of challenge, as well as network security in general. Over 10,000 people went to DEFCON this year (I've seen estimates between 13,000 and 16,000). Hacker IRC rooms are constantly buzzing. Security is fun, and while building software is immensely satisfying, so is breaking it.

So why is the information security industry so tiny?

For one, it's competitive, but I think that many, _many_ qualified security guys don't realize that there's a thriving industry around this kind of stuff.

If you want to work in security, these CTF-style challenges are a great way to show that you're self-motivated and clever. I'm always hiring application security engineers, and honestly it's pretty difficult to find people who are new to the field. People seem to either have a decade of experience and bounce from company to company, or no experience at all and assume that they "aren't good enough."

If a company can't take some raw talent and refine it, they don't deserve raw talent in the first place. We call that training.

If you like this kind of stuff, apply at Stripe, or Matasano, or Tinfoil Security -- or even my engineering team at Redspin. If you mention "HN" or "Hacker News" in an email to jobs at redspin.com, I'll know exactly where you came from :)

PS: Redspin hires all kinds of security engineers, from policy & procedure specialists to network infrastructure guys to appsec experts. It's better to apply and have a conversation than to be too afraid to try!

</comment><comment><USER7> Shameless, ala tptacek: Enjoying this challenge? We do similar things on a daily basis over at Tinfoil Security. We develop tools to attack websites in a lot of similar ways to this Stripe CTF. We're hiring in Palo Alto, and even if you've never done appsec work before, we'd love to chat.

<https://www.tinfoilsecurity.com/jobs>

(Or, you know, ask Stripe or Matasano for a job. They're both crazy awesome, have a ton of respect from me, and are also hiring.)

</comment><comment><USER8> Huge kudos for the design of the site - it definitely gives off a Tron-like feel. I can't imagine the attention to detail to what amounts to just a game.

<comment><USER9> > I can't imagine the attention to detail to what amounts to just a game.

Game, marketing exercise, recruitment tool.

<comment> grey-area It serves an important purpose for them no doubt, but it is surprisingly polished and addictive. Just shows you that it's worth putting time into perfecting even activities which might seem peripheral - I'll bet they'll find some good people via this game (the ones who finished it really quickly and with clever solutions).

I'm totally stuck on Level 7 after getting some waffles and have no time to continue though, oh well.

<comment><USER10> You nailed it on the addictive bit. I got home from work around 6pm and started the game. I glanced at the clock after a bit and realized it was almost 2am. Oops!

</comment></comment></comment></comment><comment><USER11> My favorite part is watching the captures in real time at <https://stripe- ctf.com/leaderboard>.

<comment><USER12> Looks like someone has found the egg.

<comment><USER13> Easter-egg? There's menu link on every the main page.

<comment><USER13> That was in English when I thought it :-)

</comment></comment></comment></comment><comment><USER14> I was looking forward to verifying the P = NP proof on level 3, but sadly I don't have access to DARPA's 1000-node testbed, nor does my phone have any optical storage space. Sigh :(

Anyway, love the challenge, the attention to detail is awesome :)

</comment><comment><USER15> Definitely wish time wasn't a factor - on Level 3, but just don't have the time to commit to it :/ Maybe later tonight

<comment><USER16> Ditto. I would totally spend a few hours on this if I didn't have work to do :/

Maybe after you complete a level you could get the choice of "Pause the game" or "give me the next challenge" ?

<comment><USER17> Don't worry -- even if you don't get to play this week, we'll be releasing the levels afterwards so you can run them yourself at home.

</comment></comment></comment><comment><USER18> It seems like no matter what screen name I pick, the settings claim that it is unavailable.

<comment><USER19> Fixed! Sorry about that.

<comment><USER20> I put my screenname in, had not checked "show...". Then, I went back to check that, and now am getting the "screen name is unavailable" error.

<comment><USER19> This is what I get for editing code on the fly. Should be really fixed now.

<comment><USER21> Unit tests! ;)

</comment></comment></comment></comment></comment><comment><USER22> This is suprisingly fun. At first, you feel like a badass, reading the documentation for every function call, googling for exotic bugs. Then you feel like a total idiot when you notice how simple it actually is. Finally, you laugh at people in the IRC because you know exactly how stupid they feel.

<comment><USER16> Yeah... I can't believe I spent time looking for something wrong with the HMAC used for session cookies. Also, I'm pretty sure I solved #5 the "wrong" way since it didn't actually involve the hint they gave.

<comment><USER23> I didn't use the Level 2 server for #5 either (although I did for #8) - so I suspect that many people solved it the same way.

</comment></comment></comment><comment><USER24> I really enjoyed this until I got stuck on level 3. I have a bunch of ideas about what the solution might be but I'm not good. Are there any websites with challenges similar to this that are more geared towards someone that isn't so great at this sort of thing? A "beginner" at security stuff?

<comment><USER19> You may want to check out the Reading Materials section on <https://stripe- ctf.com/about>.

</comment></comment><comment><USER25> Stopped at level 3, for a break, and because I couldn't see the exploit so easily. But still, amazing site design and great fun.

Would love to sit down with it for a bit longer and crack on.

</comment><comment><USER26> I finished first three levels. I will continue with the rest tomorrow.

I think if they didn't provide code, it would have been really difficult. Is everyone feeling same way?

</comment><comment><USER24> unrelated to the game, but on the social network question:

> $url = "<https://upload.wikimedia.org/wikipedia/commons/f/f8/> . > "Question_mark_alternate.svg";

can't someone edit the image on wikipedia and change the image displayed to everyone else here -- or is the wikimedia image system only accessible by admins?

<comment><USER27> [http://commons.wikimedia.org/wiki/File:Question_mark_alterna...](http://commons.wikimedia.org/wiki/File:Question_mark_alternate.svg)

I believe it is very editable once login.

</comment></comment><comment><USER28> Seriously love this ctf, the style and everything is quality. Hope I have some more time tomorrow to slash away at it. THANKS STRIPE!

</comment><comment><USER29> What scares me about this is they want you to authenticate via github with an app that's going to be hacked at.

Is this not dangerous?

<comment><USER19> We just ask for your publicly readable profile information. For exactly that reason :).

</comment></comment><comment><USER30> Gah, I'm stuck on level 4. I've never really dealt with security in ruby / sinatra / sequel applications.

<comment><USER31> ... Yeah, me too. If you check out the "about" page [1], there's IRC info at the bottom [2], so there may be hints there.

1: <https://stripe-ctf.com/about>

2: irc://irc.stripe.com:+6697/ctf

Edit: the IRC helped. the issue isn't ruby, sinatra, etc.

<comment><USER32> I was stumped by disbelief. Well, now I know that Stripe isn't lazy.

</comment></comment></comment><comment><USER33> Is the "502 bad gateway / nginx" page after signup submission part of the challenge?

<comment><USER34> Sorry 'bout that: scaling issues. Should be fixed now!

<comment><USER33> In now, thanks! :)

</comment></comment></comment><comment><USER35> I'm now really looking forward to work finishing for the day. The first thing I did was email all the developers at work and challenge them with a race to the finish :p ....I'm a grad halfway through my year of QA.

</comment><comment><USER36> Have had a lot of fun with this so far even though I'm only at level 4, kind of went off on a tangent on level 3 and after getting a partial solution I realised that there was a much easier way of approaching it

</comment><comment><USER37> I can't wait until the very last challenge just says: "SURPRISE, you typed in your password when you started this event, which is the most common way that someone's password will get stolen."

<comment><USER9> I just authenticated with Github (public info, read-only).

</comment></comment><comment><USER38> Don't know if I'll have time (or the skills) to finish Level 8 (it looks pretty intense), but the other levels were a lot of fun. This was done really well - thanks for doing it!

<comment><USER23> Level 7 is actually harder technically than Level 8, although Level 8 had problems at their end when there were too many people trying for it, overloading the Level 2 and Level 8 servers and making it hard to get a successful exploit. Once they fixed that, it was easy.

</comment></comment><comment> brown9-2 The public URL for the Secret Safe given to me in Level 0 doesn't actually return a response when I get request it, the connection just sits open - <USER2> this expected?

<comment><USER19> Nope -- scaling issues. Should be fixed now.

<comment><USER39> The site's down again. 502 Bad Gateway.

</comment></comment></comment><comment><USER40> Level 2 is just giving me timeouts. Joined IRC channel to report bug, and somebody gave away the answer for level 2. Bummer, I had been enjoying myself.

</comment><comment><USER41> Aww, I wish I had the time to participate this time. I had a blast with the first one! I proudly wear my stripe ctf shirt :)

</comment><comment><USER10> Thanks for the great game, Stripe guys. There were a lot of fun challenges and I learned quite a few things in the process!

</comment><comment><USER42> Title of this HN post is great example of how to get attention of hacker minds.

</comment><comment><USER43> WOW, that went better than expected. tptacek can expect an e-mail ;)

</comment><comment><USER44> Just finished level 8!

</comment><comment><USER45> I wonder when level 4 will be back up.

</comment><comment><USER46> love it! bummed different parts keep going down; although I'm sure servers are getting slammed :)

</comment><comment><USER30> Woo, Finally got level 8

</comment><comment><USER47> Level 3 timing out :(

<comment><USER48> I'm having this issue as well.

</comment></comment><comment><USER49> extremely awesome. just what i like

</comment><comment><USER50> Thanks!</comment>


Diffie Hellman Parameter Validation Attacks Explained - <AUTHOR> http://chargen.matasano.com/chargen/2007/9/25/adam-bozanich-did-not-uncover-an-nsa-ipsec-conspiracy-diffie.html

<comment><AUTHOR> I don't post my own stuff often, but I just rescued this old blog post from our database dump, read it, and kind of liked it. It's short, tight, and is a pretty good example of why it's hard to build good crypto (and why you shouldn't use SRP as your authentication protocol).

<comment><USER2> _headdesk_

I really need to add matasano's posts to my regular reading. Every time I get it in my head that I learned something new about security, I discover that I really know nothing about it at all.

Assuming that I have a good reason for not just implementing SSL for account authentication -- systems of distributed content, for example -- do you have a recommendation for anything else?

EDIT: I don't necessarily mean implementations in Javascript, which is silly pretty much no matter what you do. These would be objective-c or Java implementations, and the authenticating bits are stored already in the application which is distributed through trusted sources.</comment></comment>


MSN down? - T-A http://www.msn.com/ Has been displaying a single line of raw text for hours, at least for me... I'd be getting a little embarrassed by now if I were MS. <comment><AUTHOR> LOL, no.

<comment> T-A Or? [http://www.isitdownrightnow.com/msn.com.html#commentstop](http://www.isitdownrightnow.com/msn.com.html#commentstop)

<comment><AUTHOR> Hold on... You said it was down! I know how can check if a site is down.

<comment> T-A You make an interesting semantic point. :) If the site is responding to HTTP requests, but all it's returning is an unintelligible line of raw text, is it up or is it down?

<comment><AUTHOR> It's barely up..?</comment></comment></comment></comment></comment>