Cost of Employer-Provided Health Insurance Rises Toward $19k a Year - <AUTHOR> https://www.wsj.com/amp/articles/cost-of-employer-provided-health-insurance-rises-toward-19-000-a-year-1505838600 <comment><USER2> I don't think employers should even offer health insurance.

Leave it to the consumer to buy just like all other insurance. In fact the increase in wages could be used to fund a basic preventative care plan (read not full on single payer) for all Americans.

<comment><USER3> But as an employer in the U.S., you get to write off medical insurance as an expense that isn't counted as income for the employee. It's entirely tax free, and a rational employee will take it into account as part of their compensation package.

If you don't want employers to give it to employees, then we should fix the tax situation.

<comment><USER4> You nailed it. When I started my own consulting business I just about fell out of my chair when my accountant said I couldn't write off my health coverage. I pay about $19K a year and that's after taxes so more like $25K+.

<comment><USER5> Read this [1], then, consider firing your accountant and filing an amended return.

[1] - [https://www.irs.gov/publications/p535/ch06.html#en_US_2016_p...](https://www.irs.gov/publications/p535/ch06.html#en_US_2016_publink1000208843)

<comment><USER4> S-Corp greater than 2% ownership. This means I can sort of write it off, but only after the corporation providing the money through payroll which means paying tax on it upfront. Doing it that way could end up costing me money because payroll taxes are higher than corporate dividends.

In general I think the point is, why can corporations just straight write off premiums for their employees when self-employed types have all these special rules to follow vs just a standard deduction?

<comment><USER6> If you're an officer in an S-Corp, you're required to pay yourself a "market rate" salary for payroll tax purposes, and cannot legally use the salary/draw distinction as a tax avoidance strategy. If you're not paying yourself a salary, the IRS gets very annoyed.

If you're a sole proprietor, the tax impact should be equivalent whether you choose to take draws or salary:

> Sole proprietors and members of partnerships are free to pay themselves — or > otherwise take the profits out of their businesses — whenever they'd like. > Payroll withholdings do not apply, but each individual essentially pays the > equivalent on his or her reported income at tax time.

[https://quickbooks.intuit.com/r/payroll/salary-or-draw- how-t...](https://quickbooks.intuit.com/r/payroll/salary-or-draw-how-to-pay- yourself-as-business-owner/)

<comment><USER4> Paying the health insurance through payroll would be in addition to the fair and reasonable salary. Say I set a fair and reasonable salary of $65,000, then I want the S-Corp to cover my health insurance $20,000 a year then I need to set payroll to $85,000.

Yes, I could continue to pay myself just $65,000, but the IRS could come knocking and say, "you said you paid for health insurance through S-Corp payroll, so that means you only gave yourself a $45,000 salary which is not fair and reasonable.

</comment></comment></comment></comment></comment></comment></comment><comment><USER7> My view: we need price transparency.

Find out a medical code, call 3 different hospitals in your area and try to nail them down on a price for that billing code - the variance will be large; but given they should all have similar price structures and pay wages that are roughly the same, they shouldn't vary by much more than 5% ...

<comment><USER8> Price transparency doesn't really help when you can't factor in all the potential costs and unknowns. It certainly is of no use when there's a life threatening emergency.

A birth might be a flat $4000 but what happens if the mother has high blood pressure and needs to be on a magnesium drip? Or the baby is in distress and there's an emergency caesarean? Are you going to call around for a better rate?

The problem with our medical system is insurance. Insurance companies are always playing games to avoid paying bills and they force medical providers to play games to get paid. Vast amounts of money are wasted in billing and claims departments trying to process or deny claims.

It's gotten to the point where an insurer can fine the insured for submitting a claim with a code that requires prior authorization after seeking care from a healthcare provider. I'm not sure how pricey transparency would help with that.

<comment><USER9> This is a particularly naive understanding of markets.

To restate your argument: there are sometimes unpredictable health care events that arise for which one cannot negotiate, bargain, and price compare in advance. Therefore, price transparency doesn't work.

The problem is you wouldn't make this argument about any other sort of good (for example, an emergency or home car repair) because you know exactly how markets function in those cases.

The answer is: when there's price transparency, and consumers are incentivized to shop around and demand lower prices, prices come down. This benefits not only yourself, but also consumers who don't want to (or are unable to) perform this role themselves.

This is why you pay cheap prices at the grocery store even if you don't haggle, clip coupons, and so on. This is why "emergency" home and car repair (while it may cost more) does not cost an order of magnitude more than "non- emergency" home or car repair.

<comment><USER10> Some reasons why healthcare markets are not nearly as efficient as other well- functioning markets (like car insurance):

\- Prices are extremely inelastic: You'll pay whatever you have to not die.

\- Consumers have far less control over what they purchase: they are told to purchase things by doctors, who may have different incentives.

\- Healthcare isn't a "commodity" that can be easily swapped out. Prescription drugs may be commodities, but doctors are not. People won't easily swap doctors, making the entire system less efficient.

\- There is no "perfect information", in economics speak: people know very little about what the quality of care they are receiving.

\- It's extremely expensive to bring healthcare "products" to market (e.g., new drugs, hospitals, etc.). Like building a nuclear plant, very high capital costs reduce the number of players that can enter.

</comment></comment></comment></comment><comment><USER11> The only solution is for employers to stop offering healthcare. Give the equivalent in salary to employees and let the employee figure it out. When this starts to en masses healthcare will get figured really quickly, i.e. single payer

The Fortune 1,000 won't do this because they can control employees, wages and competition. Getting a small company off the ground is so much harder because only recent grads are willing to take a job without healthcare. I've turned down a dozen companies because of healthcare issues.

I also find it strange that we discuss guaranteed income as a viable solution but not guaranteed healthcare.

<comment><USER12> I know lobbyists are pushing their agenda, but why is nobody talking about the economic freedom of untethering employment to heathcare? So many people are tied to less than ideal jobs or prevented from starting their own business because of insurance. You also constantly hear about companies hiring contractors or cutting hours just under the margin where they owe benefits.

It's funny that I often hear about how expensive COBRA is and how it's not a good deal. That's what your employer is paying for your insurance. (in an ideal world) that is would-be compensation of your's.

I know the actual cost of healthcare isn't pretty, but it does no one favors by hiding it and tying it to your employer with weird tax incentives.

</comment></comment><comment><USER13> Bernie Sanders "Medicare for All" plan makes all the sense in the world. Expand medicare for everyone. Pay the government instead of insurance premium. Medical costs go down. Doctors/hospitals might earn less, but will have guaranteed payments. Medicare, a government program, is considered the gold standard of healthcare, so this isn't the government's first rodeo.

<comment><USER14> If you think government run healthcare is the solution you should talk to any military member or veteran; people are literally killing themselves in VA parking lots because the care is so bad.

<comment><USER15> Isn't a big part of it the huge wait times because VA hospitals are overburdened by the number of vets? If they were covered by any hospital in their area rather than specific VA hospitals, presumably the care would be a lot better.

<comment><USER16> And who controls for the number of vets and the number of VA hospitals? The government.

Do you think they would do better in a bigger version of this for the whole country?

</comment></comment></comment></comment><comment><USER17> Health insurance companies are running out of time and they know it, this is their last ditch effort to get as much money as possible. There is no point to lower prices, why gain market share if there is no "later" when you can extract more profit? Why enter the health insurance market if you are not sure how long it will last?

<comment><USER18> Huh? You think it's the insurance companies who are making the profit? You do realize that ACA caps their margins, right?

<comment><USER19> But only on policies issued through ACA marketplaces, no? Most health insurance in the US comes through employers.

</comment></comment></comment><comment><USER20> About time for someone to start offering an insurance plan where all consultation is via facetime/video chat and expensive non-critical operations are done in Mexico or a ship parked in Int'l waters close to major cities on either coast. Only get an emergency room insurance for the US!

<comment><USER21> That or provide universal health care not tied to employment.

Given my experiences with in-person doctors I think video-chatting with one would be about the most idiotic waste of my time possible.

<comment><USER22> Where I'm from 90% of what a general practitioner does is give out antibiotics. I hate the over prescription of antibiotics but they could easily prescribe that over video chat. This would keep sick people at home and allow doctors to focus on people that actual need to come in to be physically examined.

</comment></comment></comment><comment><USER23> This page has some good data on 2018 rate increases, provider changes, mandate enforcement, etc.

[http://www.kff.org/health-reform/issue-brief/an-early- look-a...](http://www.kff.org/health-reform/issue-brief/an-early-look- at-2018-premium-changes-and-insurer-participation-on-aca-exchanges/)

</comment><comment><USER24> Is there a good breakdown of where those dollars go?

<comment><USER25> You mean once it goes from the employer to the insurer?

Here's an article on Blue Cross that covers profits, claims, etc: [http://www.wral.com/blue-cross-profits-soar-as-losses-on- aca...](http://www.wral.com/blue-cross-profits-soar-as-losses-on-aca-policies- fall/16559789/)

</comment></comment><comment><AUTHOR> Paywall bypass link: [https://m.facebook.com/l.php?u=https://www.wsj.com/amp/artic...](https://m.facebook.com/l.php?u=https://www.wsj.com/amp/articles/cost- of-employer-provided-health-insurance-rises-toward-19-000-a-year-1505838600)

<comment><USER26> Not sure why you've been downvoted, doesn't seem very nice considering most of us are stuck behind the paywall for this article.

Thanks.

</comment></comment><comment><USER27> There are simple answers Health Insurance affordability in the US. Rationing. No NOT via a single payer system where some all-knowing official decides who does and does not get care. Rather, the rationing is done by the buyer. For example, Buyer one could decide to only buy a policy which covers only generic drugs, which would exclude all patented drugs (newer and even superior), Buyer 2 could decide to buy a policy which covers generic drugs and patented drugs in one or more specialties (e.g., cardiac). The theme is let the buyer decide, not everyone wants to live the last 10 years of their life struggling to regain their youth.

<comment><USER28> Are there examples of such a system working anywhere? It sounds plausible, but the fact that it didn't arise pre-Obamacare gives me pause. It seems like the demand for it might not be prevalent enough, or the savings too small.

I'm interested in new models, but I'm tired of the US thinking it has to be special with its healthcare system and wasting a trillion dollars a year.

</comment></comment><comment><USER29> With Kaiser Permanente Northern California, for a family of 4 $18k buys you a gold plan with $0 deductible, and $20k buys a platinum plan. This is on the open market. I just priced it on their website. Most plans are substantially cheaper.

HMOs are really the way to go, but unfortunately Americans stupidly prefer to pay a huge premium for more choice (or at least one very specific dimension of choice). A family member who is a long-time partner at a law firm forced her firm to purchase a plan that allowed her to keep her doctor of 20+ years. This happened during the nationwide market reconfiguration as the mandates rolled out and insurers aggressively re-architected their plans and provider networks. Now she rants and raves about how Obamacare raised the costs of healthcare, and her partners resent her for forcing the huge premiums on everybody. She's totally unwilling to consider that the problem was entirely of her own making; that her firm could be paying a fraction of their current costs for the same quality of care, just not including that one specific doctor.

HMOs aren't very common, and in many regions they seem to suck. Fortunately, Northern California Kaiser is one of the best hospital systems in the nation. If you live in the Bay Area I highly recommend it. Kaiser aggressively pursues cost-cutting measures and efficient service delivery procedures. Appointments go through a phone bank of nurses with a rotating staff doctor, so minor illnesses like a cold or flu don't require wasting your primary physician's time. For more serious but still common injuries like a broken wrist you're directed to, e.g., their sport injury unit clinic; again saving both the ER and the primary physician's time. Kaiser runs their own labs, and the volume of people their labs efficiently handle is incredible. All the doctors are employees (as opposed to independent, affiliated providers like in many for- profit hospitals), and Kaiser doctors very consistently apply uniform policies on best practices, prescriptions, etc. I think they're large enough that they run their own studies; at least that's the sense I get when I've inquired about why they choose X instead of Y.

All of this comes across to some people as impersonal, but personally I think it's amazing. I've never had an interaction (nor have any of my family members, AFAIK) that left me feeling cheated for attention, even though there's always the sense that everybody--doctors, nurses, staff--is working to keep things moving along at a brisk pace. The way they've balanced conflicting requirements is really laudable. After being with Kaiser for many years, other hospital systems seem downright chaotic.

</comment><comment><USER30> It's cheaper to fly to India, stay in an upscale hotel, meet personable doctors, get treatment, relax and come back.

Not saying this is practical for everything but people really should start considering alternate countries for healthcare.

The US is a mess.

</comment><comment><USER31> Hey, doctors have a lot of shitty real estate investments they need to cover.

</comment><comment><USER32> Currently spending $18,382.32/yr

Math checks out.

<comment><USER33> Bonkers.

If you're a christian you could lower that considerably. Medishare.

</comment></comment><comment><USER34> More paywalled crap. Don't you have a better link?

</comment><comment><USER35> What?! Surely this can't be possible. We already have an _Affordable_ Care Act...

<comment><USER36> _Knock on wood_

</comment></comment><comment><USER37> It genuinely blows my mind that some of the top comments are pro-socialized medicine.

This is a forum populated primarily by hackers and people interested in starting or working at start-ups -- should we also have a single payer of all hackers? The notion is laughable, but it's put forth seriously when it comes to medical care. Like all problems of costs being "too high" this one is caused by artificially restricted supply (govt regulation of medical system) and skyrocketing demand (much of which is driven by the abysmal nutrition advice the US govt has doled out over the past 50 years which has only made 2/3 of the country obese and overweight).

Control economies do not work, how much more evidence do we need before people stop saying "this time is different, we just need the RIGHT people this time"?

<comment><USER28> I'm not in favor of single payer healthcare, but to say there's no evidence that it works is inaccurate. Healthcare in Canada provides the same health outcomes as ours for half the price. If that doesn't interest you because they do it with the wrong philosophy, you're an ideologue. In fact, the evidence that your proposed changes would give a 50% reduction in cost seems a lot slimmer than the case for straight-up single payer.</comment></comment>


Family Tree of Languages Has Roots in Anatolia, Biologists Say - <AUTHOR> http://www.nytimes.com/2012/08/24/science/indo-european-languages-originated-in-anatolia-analysis-suggests.html

<comment><USER2> I think this is a good example of ideas from one discipline (phylogenetic reconstruction of the relationships between species) being applied to a different area, with all the common features - including resistance from the existing community who are used to subjective reasoning over modern statistical inference techniques.</comment>


The narcissism epidemic is dead? - <AUTHOR> http://mindblog.dericbownds.net/2018/01/the-narcissism-epidemic-is-dead.html <comment><USER2> If narcissism is something that has penetrated the popular consciousness as being an "epidemic", then perhaps surveys are showing less narcissism because people have been trained to answer the survey in a way that minimizes the recognized markers.

Certain younger people I know seem to be obsessed with the concept of narcissists being the root of all evil, and defending millennials as a generation from charges of various faults. It seems weird to me because nobody I knew talked in this way about Generation X or mental disorders when I was at a similar age. I suspect the internet and optimized clickbait of reaching some sort of critical mass that may be interfering with the mental functioning of people who would otherwise be reasonably sanguine about the world.

The more people worry about narcissism, the more I would expect them to conceal anything indicative on a survey.

A screed I read on the internet many years ago about narcissism was written by a guy who self-identified as such, and the overriding impression I got was that his issue was vast and malignant self-hatred, to the point where I didn't really believe he was as horrible as he claimed. I was unable to tell whether he resembled the "canonical" narcissist, whatever that might be. It made me wonder if a narcissist can be self aware or not, by definition.

I think the use of surveys to define and monitor mental disorders is a morass of confusion and misunderstandings.

<comment><USER3> As a fairly young guy, I think a lot of the fallout over narcissism is really a kind of sublimated culture shift.

Before about 1975, unemployment was typically under 5%, and underemployment or precarious employment was far more rare. Social safety nets (for white people, at least) existed and were strong. University wasn't terribly expensive, and the chances of getting a job that delivered an acceptable standard of life was really quite high.

This meant that, with their basic needs essentially met, generations born before a certain point tended to concern themselves with ideas like self- growth, fulfillment, and personal goals.

Between 1975 and 2008, those concerns became increasingly displaced by survival-level thinking, as unemployment ticked steadilly up, and jobs generally grew more time-consuming, and less well paid, while commodities and rents of all kinds increased.

I think for a lot of young people, there's a kind of fallacious misidentification between the concerns of older generations, and narcissism. To obsess over abstract personal concerns to the point that basic needs are not met is narcissitic - and if somebody of a generation that went into the workplace following 2008 obsessed over personal concerns to the degree that the older generations do, it would absolutely impact their abillity to cater to their basic needs.

However, because older generations are typically in a good financial situation, having profited both from the pre-80's social contract, and often, from its disassembly - it's not at all narcissitic to care about personal concerns! It's absolutely rational - they aren't going to become homeless if they decide to go on a buddhist retreat, or engage in a messy divorce, or start a new career.

Narcissism gets picked out as a culprit since it's a way to both categorically assert that a different way of life is wrong, and equally, to lay the blame for the current situation at the feat of our proximate frustrators - the boss, the mentor, the parent.

<comment><USER4> > _Before about 1975, unemployment was typically under 5%..._

Between 1945 and 1975 American enjoyed an unprecendented period post-war prosperity owing to the destruction of the rest of the newly industrialized world. This was not the case before and will never be the case again.

<comment><USER3> I'm not the biggest fan of Keynes, myself. I'm assuming that's what you're referencing - since of course, the rest of the industrialized world also enjoyed unprecedented prosperity.

But for my sakes, I honestly think the idea that blowing stuff up just so you can build them again is a bit more abstract than the question demands. After the war, many nations, the USA included, produced large and comprehensive social programs. This undoubtedly wasn't that great for the economy in general (the US share of global GDP steadilly ticked down for the entire period, putting an end to a century of rapid growth). It was however, undoubtedly great for Americans in general.

Between 1975 and today, until a few years ago, American share of world GDP hasn't gone down all that much, indeed, it's descended less than it did in the period between 1945 and 1975. The USA is richer as a nation than it has been at any point in its history. It's simply unwilling to pay for all the New Deal stuff.

</comment></comment></comment></comment><comment><USER5> As with nearly any kind of study, there are many similar ones with opposite results that makes you kind of realize the whole world can't be explained through surveys and studies only.

Mapping the scale of the narcissism epidemic: Increases in narcissism 2002–2007 within ethnic groups - [https://www.sciencedirect.com/science/article/pii/S009265660...](https://www.sciencedirect.com/science/article/pii/S0092656608000949)

Egos Inflating Over Time: A Cross-Temporal Meta-Analysis of the Narcissistic Personality Inventory - [http://onlinelibrary.wiley.com/doi/10.1111/j.1467-6494.2008....](http://onlinelibrary.wiley.com/doi/10.1111/j.1467-6494.2008.00507.x/full)

And then there are those who question whether the Narcissistic Personality Inventory is even a good measure of narcissism at all

Addressing criticisms of the Narcissistic Personality Inventory (NPI). - [http://psycnet.apa.org/record/2011-16529-013](http://psycnet.apa.org/record/2011-16529-013)

<comment><USER6> A lot of these supposed studies can't be reproduced and are just bunk. It's a result of the publish or perish busy body model. And most of these studies show the results that the people want it to show.

If there is an epidemic, it's an epidemic of useless studies.

</comment></comment><comment><USER7> It's pretty fun that "leadership" is correlated with "vanity", "narcissism", and "entitlement". I'm not actually sure what these measure, precisely, but the graph is good for a laugh.

[http://dericbownds.net/uploaded_images/narc.png](http://dericbownds.net/uploaded_images/narc.png)

</comment><comment><USER8> One thing about narcissism is it's terrible AND ALSO horribly annoying / pretentious.

I agree with the commenter's below point that narcissism is definitely not the root of all evil. I don't think Germany or Japan qualified as narcissistic society by any means before and during WWII (where there was lots of sublimating yourself for the state).

That being said, there is just something sooooo pretentious about narcissism I am driven to hate it while also being curiously fascinated with it. I sometimes wonder if I'm part of the problem in that case.

Regardless, this is why I subscribe to these subreddits:

\- [https://www.reddit.com/r/iamverysmart](https://www.reddit.com/r/iamverysmart)

\- [https://www.reddit.com/r/ihavesex](https://www.reddit.com/r/ihavesex)

<comment><USER9> I can't help but feel narcissism is a requirement to participate in any subreddit devoted to making fun of people.

<comment><USER8> Honestly I can see that / what you mean.

That being said, I think narcissism is like a memento mori with death. It's something you need to remind yourself of daily to keep you humble. Those subreddits can be used for bad / ego-pumping purposes, but I'd like to think it's 1). a reminder to be careful what we say and screen it for narcissistic detachment from reality and 2). a bit of fun in the same vein as late-night talk-show comedy (which is usually some form of trash-talking whichever ppl were involved in the events of the day).

</comment></comment></comment><comment><USER10> An interesting article about "illusory superiority" (people that have it may be perceived as narcissistic): [https://en.wikipedia.org/wiki/Illusory_superiority](https://en.wikipedia.org/wiki/Illusory_superiority)

I think that people that avoid highly difficult and frustrating tasks tend to overestimate their capabilities, importance, etc.

Happens a lot in software engineering as well. Some people learn important, but rather mainstream topics like imperative programming and basic OOP and think they've mastered programming.

</comment><comment><USER11> The Simpson's tv show brought out a lot of narcissism. It was meant to be a joke to laugh at but people started emulating it which encouraged many to believe it was ok to be that way.

<comment><USER12> Can you provide some examples? Any one character in particular?

<comment><USER11> [https://www.youtube.com/watch?v=BA1RgpYS2IQ](https://www.youtube.com/watch?v=BA1RgpYS2IQ) [https://www.youtube.com/watch?v=Av5kuarKmNA](https://www.youtube.com/watch?v=Av5kuarKmNA)

</comment></comment></comment><comment><USER13> Given the obsession with social media and imaginary internet points, I would suggest the narcissism epidemic is at all time high.

<comment><USER14> The very first sentence of this very short linked page is "An interesting piece from Wetzel et al., who find no evidence for a commonly reported narcissism epidemic over the past 10-20 years, based on the perception that today's popular culture encourages individuals to engage in self-inflation" This is literally the exact kind of no-evidence comment the link is meant to refute.

</comment></comment><comment><USER15> It only takes a couple weeks working in any company that has young employees to know that 90+% of those employees under 30 think they're the greatest thing since sliced bread and that all of their amazingness is simply unused and underpaid.

It's really sad actually because it means in 10 years we are gonna have significant work depression levels due to children being raised to believe their reality would be much different than it will turn out.

<comment><USER16> In the last two years I hired 6 college graduating seniors.

None of them knew how to address an envelope... and only one thought to google for the answer.

We had to throw out a ton of (customer conference) literature packets because the labels and stamps were just randomly (and unattractively) slapped on.

<comment><USER17> Truly the height of engineering achievement; addressing letters.</comment></comment></comment>


Is the scientific paper fraudulent? (1964) [pdf] - <AUTHOR> http://blog.thegrandlocus.com/static/misc/is_the_scientific_paper_fraudulent.pdf <comment><AUTHOR> OP here.

I found this paper after a brief reflection on twitter [0] about how we as humans tend so massively to undervalue the power of imagination in favor of pure inductive/deductive logic.

[0] [https://twitter.com/leonardofed/status/1018515656067645441](https://twitter.com/leonardofed/status/1018515656067645441)

<comment><USER2> I recommend to you the book The Romantic Economist by Richard Bronk

<comment><AUTHOR> thank you - ordered it.

</comment></comment></comment><comment><USER3> Disclosure: I don't have any published papers to speak of, though I have some patents. But I write similar things -- technical reports -- within my day job.

I think the scientific paper or report has always been fictionalized to some extent. The earliest scientists may have been more overt about it. It's doubtful that a bunch of soldiers ever tried to burn an enemy ship with mirrors, but that's how Archimedes reported his idea. As I understand it, it's also doubtful what experiments Galileo actually performed on falling bodies before reporting his results.

It seems to me that in a typical paper, one should strive to make the work reproducible, to present the ideas in a form where errors shine out if they are present, and generally to be _useful_ to others.

Using the scientific paper to reveal how science is actually done isn't necessarily a good use of paper or readers' eyeballs. We're bad enough writers as it is, and trying to express a "narrative" in every paper may turn the literature into an unreadable and possibly irreproducible mess. There may be better ways of learning the "narrative" of scientific research, namely by just getting in there and doing it, or at least hanging out with scientists for a while.

<comment><USER4> Part of the problem, I think, is these days there are more people who want to write than there are people who want to read. So it's an endless battle to draw attention to your own writings. "Look at me! Look over here!" Unless you have some sort of "hook", your paper will never be read outside of a very small circle. Because everyone's too busy writing their own papers to look at yours. In some sense, it reminds me of the story of the Tower of Babel. The harder we try to mass produce science, the harder it is for scientists to make their voices heard above the noise.

</comment></comment><comment><USER5> As far as I can tell the solution he offers is merely to put the Discussion section of the paper first, and go logically from there. I don't see how this really helps. I write lots of scientific papers. You don't read scientific papers to understand how the science was conducted as a first goal, usually - you want the results that make the paper worth writing in the first place. You read the abstract and conclusions first, and then decide whether the rest of the paper is worth reading.

<comment><USER6> This is the order I think most of my colleagues read something in their field:

Abstract, results, methods, conclusions.

Experts can glean a lot about the methods from the results, and what not can be obtained from the methods. The conclusions are usually debatable, and mostly in the abstract.

The significance statements are worthless wastes of time.

</comment></comment><comment><USER7> Scientific research papers are meant to be one of the many ways to share what has been done and found, including thought process at the high level. There are many other ways and opportunities, such as seminars, conferences, and just plain talks over the phone, etc., for people in a field to share a lot more details. I am not sure a "yes" or "no" answer to the question is that relevant.

</comment><comment><USER8> Researchers have become so scared of being ridiculed by peers, I believe, that they are afraid to admit this candidly. One perceived bad paper could be career ending.

<comment><USER9> > One perceived bad paper could be career ending.

I don't think this is true. Do you have any data or even any examples to back this up?

Early career researchers aren't well known, so if they publish a bad paper who cares? No one knows who they are anyways and likely won't remember for their next paper. Well established researchers, are well, well established... And can weather these papers by the bulk of the rest of their work.

I don't think i ever judge the quality of a paper by the quality of the other papers the authors have written. I rarely even look to see what other papers that author has written.

<comment><USER10> It definitely is. A grad school student in my grad lab issued an 11 page retraction of some of our lab's seminal work and basically any chance of her being an academe were torched. Luckily, she wanted to go into industry anyways, and at least one company found value in her honesty.</comment></comment></comment>


Why can't you collapse threads on HN? - <AUTHOR> I'm aware that there's a plugin to do that, but I'm curious as to why the devs made this design choice at all?<p>It seems like a reasonable feature for a news site. Is there some advantage to not have collapsible threads? <comment><USER2> It's a basic site with basic features. The login page is just a blank white page with text boxes.

For further reading:

[https://news.ycombinator.com/item?id=7218528](https://news.ycombinator.com/item?id=7218528)

[https://news.ycombinator.com/item?id=8297695](https://news.ycombinator.com/item?id=8297695)

[https://news.ycombinator.com/item?id=1510615](https://news.ycombinator.com/item?id=1510615)

[https://news.ycombinator.com/item?id=10441902](https://news.ycombinator.com/item?id=10441902)

Found with the search box that is at the bottom of the page. Wouldn't it make more sense for the search box to be at the top of the page?</comment>


Hackers breached U.S. defense contractors - <AUTHOR> http://www.reuters.com/article/2011/05/27/us-usa-defense-hackers-idUSTRE74Q6VY20110527

<comment><USER2> Inb4 this throws even more fuel on the whole internet-needs-to-be-regulated path our governments been on.

Useless comments aside, curious as to the motive and who they think did this.

</comment><comment><USER3> Probably faked breach to fuel the need for a regulated net</comment>


Turn Your Computer into Personal Cloud Storage Device - <AUTHOR> https://www.basefolder.com/index.php/features/ <comment><USER2> Open Source ? Or what is the revenue model ?

'File size is no more a concern. Enjoy as much file storage space as is free on your home/office PC' Thats exactly the same problem I have with for example Dropbox: 1 TB ? Sure, but by default you are limited by your disksize... So you guys do not solve my problem.

'Upload or share files in bulk. We take care of the transfer, so you initiate it and forget about it' So you cache the data ? The data is encrypted going 'in and out the basefolder' meaning its encryped and decrypted on your servers before and after ?</comment>


Microsoft lets you upgrade to Windows 10 for free even if it's a pirated version - <AUTHOR> http://www.windowscentral.com/you-can-upgrade-windows-10-free-even-if-youre-using-pirated-version-windows

<comment><USER2> I guess they learned the money is in the application store.</comment>


Audio Super Resolution with Neural Networks - <AUTHOR> https://kuleshov.github.io/audio-super-res/ <comment><USER2> Very impressive. The authors should apply it to the old recordings.</comment>


Try out Ruby in your browser now - <AUTHOR> http://tryruby.org/

<comment><USER2> This is a duplicate of so many other posts, I do not know where to start. Please use the search feature before posting.

</comment><comment><AUTHOR> Every language should have something like this. Let's you play around and see whether you have like the feel of it.</comment>


"Intellectual property" is a silly euphemism - <AUTHOR> http://www.guardian.co.uk/technology/2008/feb/21/intellectual.property

<comment><USER2> Doctorow's article is all well and good. He doesn't like the term. I get that; he's said it before.

But I never quite manage to understand _exactly_ what he proposes to substantially replace the existing legal and semantic structure. If I make something that doesn't have a particular physical manifestation, what rights and obligations do I have to that creation?

I _think_ that, when pressed, many people who sympathize with Doctorow in this debate would assert that a thing that has no physical manifestation conveys no rights to its creator. But I wish they would come out and say that directly, instead of dancing around the issue while making essentially content-free semantic arguments.

<comment><USER3> I had the same problem. He seems to define the problem quite elegantly (it's use isn't exclusive, so it's not property, and the word 'property' leads to fallacious reasoning), but he never offers any idea what we should do/say instead.

<comment><USER4> I looked at the series this article was written for, and the previous article does make a suggestion, and names a group which is working for it at the WIPO.

Here's the key summary:

 _We need to stop shoe-horning cultural use into the little carve-outs in copyright, such as fair dealing and fair use. Instead we need to establish a new copyright regime that reflects the age-old normative consensus about what's fair and what isn't at the small-scale, hand-to-hand end of copying, display, performance and adaptation._

Hopefully my small extraction here does not fall astray of the copyright laws.

[http://www.guardian.co.uk/technology/2008/jan/29/copyright.l...](http://www.guardian.co.uk/technology/2008/jan/29/copyright.law)

<comment><USER2> I read the second article. It didn't help my understanding of Doctorow's position all that much.

The problem, as always, is in the details. I want to understand what Doctorow thinks are the essentials of this putative "age-old normative consensus" which he finds so compelling.

Just stating that such a thing exists doesn't get me any farther along to understanding the intellectual framework which he wants to use in order to make the trade off between the creator's interests and those of society at large.

</comment></comment></comment></comment><comment><USER5> You need a license to sell whiskey. You need a license to listen [1] to copyrighted music. Both rules hamper behavior for no reason that can be explained by a physics textbook. Rather, they exist because the restrictions are perceived to add value to society. Maybe they don't. But it's not a philosophical dispute.

[1] Or, really, to use the music in a set of contractually defined ways.

</comment><comment><USER6> If the IP laws on the books were followed by everyone, it would be a disaster. Any sufficiently large piece of software violates patents, so our "knowledge economy" would grind to a halt.

To me, the definition of a bad law is one where society prospers only because it is violated en masse.

<comment><USER7> But what if society would be worse off both with a law enforced less and enforced more? Do we have some sort of legal structure for a sort of "optimum statistical enforcement?" Something where someone can be "10% guilty" and pay a 10% fine, or where a certain "penalty" can only be assessed in favor of a given party N times per year, etc. etc.?

</comment></comment><comment><USER8> "Digital property" would be a better term for the stuff Doctorow talks about in this article.

<comment><USER4> "Property" is exactly the word which should not be used for the things Doctorow discusses. The differences between the intrinsic value of knowledge and the intrinsic value of physical possessions are great enough that any attempt to control them in the same way is fallacious.

The treatment of knowledge as property leads to unwise analogies, decisions, and laws. "Intellectual Property" is a loaded term used to mislead people into making decisions against their own self-interest.

<comment><USER8> Yes, IP when used as a catchall moniker for these things just confuses the issues:

\- Ideas vs Expressions

\- Exhaustable vs Inexhaustable resources

\- Property vs Control

</comment></comment></comment><comment><USER9> Intellectual property is neither.</comment>


Ask HN: should I reboot my career at the age 30? - <AUTHOR>

Bio phd + 2 year management consulting experience. Long for start-ups and did two web start-ups before on the side. Admitted into Hack Reactor, a front-end focused 10 week bootcamp. Should I pull the trigger? <comment> bink-lynch I will be 50 on my next birthday and I rebooted this past summer. Left my VP position and about to launch my first startup. Thirty is young. You have a lot of life ahead of you. Make sure you do what you love.

<comment><AUTHOR> that is very encouraging. Good luck!

<comment> bink-lynch Until recently, I was kicking myself for not doing this sooner; like when I was in my 30's :)

I always knew this is what I wanted to do, but I just didn't leave, what I thought was, the comfort of employment. "Let them worry about the business", I always reasoned, "I'll just build it." I realize now, that was the wrong way, for me, to look at it.

Best of luck to you!

<comment><AUTHOR> Thanks. 30 is a magic number.

</comment></comment></comment></comment><comment><USER2> Age 30 is meaningless.

Kids? Health issues? Financial stability? Peace of mind? Quality of your idea? Research and Preparation? Co-founder?

Those are factors that might be more relevant.

<comment><AUTHOR> no kids; no health issues; financially just meeting ends;

I guess I am more concerned about changing career directions to become a developer and less concerned about starting a start-up right now

<comment><USER3> Changing careers at a certain age(that too sth as young as 30) is hindered more by mindset and years of stereotype we have been believing.

How well travelled you are? Around the world. Do you think about such things because as you see you are 30 :-)

 _PS._ Does " _Bio phd + 2 year_ " meant you are a PhD in Biology or related stream or it was supposed to be " _Bio:_ " as in Biography? Just curious as you have mentioned web work and later "no tech background. If yes, why so?

<comment><AUTHOR> Biology PhD. I was doing anything else but coding the last two startups... Have traveled extensively, but no plan to travel around the world yet.

</comment></comment></comment></comment><comment><USER4> Fascinating!

My sister actually decided to reboot her career around that same age (though she is older now). She had to go back to school as her earlier major wasn't a science major. She ended up _getting her bio PhD_ and now works at a great university doing way more interesting stuff than she did before she chose to "reboot" her career. This fascinated me because she rebooted, and moved to the field you're looking to get out of and ended up happier.

Go for it! I think that's a great example of how different people are happy on different paths. If you feel like rebooting, do it.

<comment><AUTHOR> Interesting story.... the good old days of getting a bio phd will help you get a decent professor position. Those days are long gone now... I guess 30 is an interesting age when people begin to reflect on their lives.

</comment></comment><comment><USER5> There's no reason being 30 should stop you from living the dream. What _should_ stop you:

\- Other people rely financially on you

\- You don't have a tech background

\- You're bad at taking advice

<comment><AUTHOR> \- no for the first \- no tech background, hence wanting to do a bootcamp program to become a developer \- not sure about the last piece; what does this mean?

<comment><USER5> Bootcamp program will help but make sure you also have your own projects to learn with. As to the last piece: It's vitally important to be able to take advice from others in a startup.

<http://www.paulgraham.com/word.html>

<comment><AUTHOR> Thanks. I always have ongoing side projects, so I will work more on that. Re- read the article and I guess the inability to take advice is the opposite of "relentlessly resourceful"

<comment><USER5> Good luck! Keep us updated, and don't be afraid to change your idea.

</comment></comment></comment></comment></comment><comment><USER6> I'm 30 and at the top of my game! I'm currently a developer with ambitions of a startup. Honestly, I'm in no hurry. Everyday of real world experience makes me smarter and more prepared for my own startup. Do the bootcamp, unless you have to pay, then forget that.

</comment><comment><USER7> Go for it! Start a bio startup!

<comment><AUTHOR> dear dear, as you might know, a couple of million $$ is absolutely nothing for a bio startup

<comment> bink-lynch btw - I was one of the key engineering members on the team that built Eidogen when it was a startup. Very expensive!

</comment></comment></comment><comment><USER8> Do it if you're stoked on development and you're cool with being the ignorant one for a while. I dropped out of Econ PhD program at Duke after third year cause I thought software development was my dream and its been great.

<comment><AUTHOR> wow. I would love to get an Econ PhD from Duke. How does it feel to change from being pretty knowledgeable in Economics to being completely ignorant in programming?

</comment></comment><comment><USER9> Out of curiosity, was your Bio phd wetlab or computational?

<comment><AUTHOR> systems biology, so half wet lab and half modeling</comment></comment>


To Fork or to PR? The Etiquette of Open Source - <AUTHOR> Hello,
I have recently submitted an open source tool that is based on another two different tools that are open sources. After getting some traction, i received a comment from oen of those tools authors telling me that i should have PRed his original repository instead of creating a new separate fork/repo.
What i want to discuss here and maybe in the end can come out with a manual about "The Etiquette of Open Source" is how to approach such situations. For example, what if there was no license information attached in each of the repos ? will referencing those repo be enough ? A fork indeed can confuse the community and create multiple points to submit issues and collaborate .. but what if that original project is not maintained anymore ?
To summarise, i want to sum up all these thoughts in few questions:

  - What is the best practice to define if you should PR the original repo or fork from it
  - What is the Etiquette to maintain the original authors rights when forking ? How can you define his contribution ? is it based on the code yo exactly copied, the idea, the architecture ?
  - How to handle cases when there are no license information attached ?
  - How to handle PRs/forks when you work merges/combines more than one original repo ?
  - How to handle cases when conflicting licenses are used across repos that you have referenced ?
 I look forward for your comments and insights <comment><USER2> > \- What is the best practice to define if you should PR the original repo or > fork from it ?

It depends the context, if you aim to deeply modify the project by taking another direction, better to fork, in the other hand if you aim to participate to a bugfix or a new feature better to do a PR.

> \- What is the Etiquette to maintain the original authors rights when > forking ? How can you define his contribution ? is it based on the code yo > exactly copied, the idea, the architecture ?

IMO it is a good thing to declare that the base work of the fork is taken from somewhere and is owned by his original author. Then if you plan to make changes you create a file where you list all your own contributions that are owned by you.

> \- How to handle cases when there are no license information attached ?

In that case it is a good thing to ask the author in case there is no license. Otherwise you cannot do anything with it.

> \- How to handle PRs/forks when you work merges/combines more than one > original repo ?

There are some tools that can manage this by highlighting the possible conflicts among all the PRs (Jenkins for example), I don't know for the forks.

> \- How to handle cases when conflicting licenses are used across repos that > you have referenced ?

Unfortunately you cannot really do something, as legally if a license does not allows you to do something you cannot go against. A solution might be to talk with the respective authors of the conflicting repos.

</comment><comment><USER3> > _\- How to handle cases when there are no license information attached ?_

If they have "no" license, it's effectively "all right reserved". You can't legally do anything with the code. Probably it's legal to stare at it, but it's not legal to modify and redistribute it.

<comment><AUTHOR> interesting .. thanks a lot for the pointer</comment></comment>


Newegg stores your password in plaintext - <AUTHOR> http://ashercodes.com/fyi-newegg-stores-your-password-as-plaintext <comment><USER3> This comment stream is a great example of HN going downhill. It's literally ten threads of the same half-informed claims with half-informed stock counterarguments.

We have the: completely unverifiable reversible encryption defense, followed by the complaint that reversible is just as bad, followed by every manner of hypothetical baloney. Then we have the dismissive password generator users, followed by the complaint that this is an irrelevant solution. And of course the smattering of people wanting to publicly shame sites that store in plaintext, like more than 0.01% of the Internet will ever care.

tldr, you no longer have to read these comments, screw the karma this will cost me.

<comment><USER4> I notice you left out what a 'good' comment stream would consist of.

What is the ideal we're failing to live up to?

<comment><USER3> People with direct experience with the elements of the OP (Newegg's security or lack thereof) voicing their fully-informed opinions. Maybe a Newegg CSR or security admin. Everybody else is just piling bullshit on top of more bullshit, because we really don't know anything beyond the alleged experience of one customer with a blag.

It was said better in another recent comment thread (I forget where): HN comments these days are full of people trying to sound like experts when they have no idea what they are talking about. I post about twice per day, max, and I think that's already more than I deserve to be able to say. Maybe that's what could be enforced here, so that people would really think hard before wasting a comment on hypothetical asides or repeating the same thing ten other people said.

<comment><USER4> I'd rather read the other comments than musing by some 'old timers' about how far HN has gone downhill. Not sure whether I need to mention Eternal September or not.

Your perspective reminds me of some people on Stack Overflow who have a particular concept of how everyone else should post. If the people here don't live up to your ideals, maybe you should invite someone who works for Newegg to come comment. Hoping everyone else is going to stay quiet until the commenter of your dreams drops by probably isn't much use.

</comment></comment></comment></comment><comment><USER5> That doesn't necessarily mean that the password is stored as plain-text. The customer support agent may have simply had the ability to initiate a process that decrypted it and sent an email notice to the customer.

Granted, it's always alarming to learn when companies either store plain-text or store reversible encrypted passwords where they hold the key, but it's not surprising. Sometimes, usability, convenience and customer experience are more important than IT security, thus mgt decides that these things are acceptable risks.

<comment><USER6> Passwords that can be decrypted reliably are isomorphic to passwords stored in plaintext. That is very undesirable. Even assuming they are encrypted with a strong key, anyone with access to the decryption key and the database can trivially recover any password stored by such a system.

Password hashes are not isomorphic to plaintext passwords, because there can be collisions. That means there is no function to reliably take the stored passwords and turn them back into plaintext passwords; therefore, while reversing some/most passwords through complex iterative functions (e.g. brute force) is possible, the amount of work (particularly for bcrypt, pbkdf2, or other many-round hash+salt schemes) on average is many, many orders of magnitude greater than applying a decryption key. For good passwords, the amount of work is not quite unbounded, but might as well be.

It's true that plaintext passwords and singly-hashed md5 passwords are both quite bad, but at least with the md5 hash nobody can (I think?) currently crack a 32 character random string since there are no rainbow tables for such long passwords. (Assuming the password is vetted for common weaknesses, since "random" alone does not guarantee anything. "aaaaaaaa" is a random 8 char password, after all.) Functions that attempt to reverse non-isomorphic mappings end up being complex and, even in the case of rainbow tables for (unsalted) md5, are much slower than not having to recover the unencrypted password at all, or having some master key that decrypts all passwords.

<comment><USER7> When we're talking about passwords stored "encrypted" on customer-exposed applications, I agree.

When we're talking about passwords "vaulted" in non-exposed systems used for customer support, I have a harder time getting upset about it. I don't like systems that work this way, but I see the support/security tradeoff and it's a valid one.

It is likely but not certain that the site in question here did not go through the trouble of setting up a non-exposed secure password vault system for customer support people to use under supervision. Probably they do just store passwords in a column somewhere. But you don't _know_ for sure whether they do.

Nobody needs rainbow tables to crack passwords.

<http://codahale.com/how-to-safely-store-a-password/>

<comment><USER6> If you're implying that Newegg or any public-facing authentication system could be implemented with a non-exposed password vault, then I don't see how.

If user passwords are encrypted with symmetric encryption, either the application must have access to the key in order to compare your provided password to the password stored in the DB, or the DB has to have a stored procedure with access to the key.

Therefore it's not -only- customer support that has access, but anyone who hacks the production system also gains access to the key. Of course there are ways to obscure that if it's kept in memory and required as input before the server starts up, but theoretically it's available to anyone who compromises the relevant server.

(And even if there were a system that were implemented as you describe, with access allowed only when a support staffer and a supervisor provides an asymmetric key each, who supervises the supervisors?)

(edit: The offered suggestions show that I wasn't considering non-symmetric or non-software approaches; in any case, at best those seem like complicated band-aids for a situation that should not exist.)

<comment><USER8> It could either:

      A) Have a traditional hashing scheme independent of the vault
      B) Use public-key encryption, and give the production
         system only the public key.  The server could encrypt
         the provided password for decryption by the private key,
         and then compare ciphertext.  The vault simply has the
         private key.

Neither of these systems are ideal, especially the latter, but they do get around the one particular issue of a hacked frontend.

<comment><USER9> Why is (B) not ideal? Sounds like you get the usability (recoverable passwords) without the security issues (assuming that you properly separated the keys, etc.)

I ask because I am writing an app currently that stores an SSN. The data are downloaded for later use on non-public facing machines, and the SSN needs to be decrypted at that point. I am saving the data using PKI, and will be able to decrypt it later (but anyone without my keys won't be able to).

<comment><USER8> The main reason I was thinking of is that it's very difficult to do public-key encryption correctly. The normal advice is to just use GPG (or a similarly battle-tested library). The way these work makes ciphertext comparison meaningless. That's a good thing for almost all applications, but not for this one. The alternative is to use code that has not been so thoroughly battle- tested.

Your application is a much more straightforward application of PKI. You don't need to compare ciphertext, so you could just use GPG. (Please consult someone more expert than me, though. I am not responsible if there's a security problem, etc, etc).

As a secondary reason, public-key encryption is "fast by design", while password hashing techniques are hopefully not. This makes brute-force attacks easier. This actually applies more strongly to SSN's (only a billion possible combinations? Simple!). This can be worked around by adding a properly secured password hash of sufficient length to the plaintext, essentially adding the additional computation of the password hash.

<comment><USER7> Read this survey paper, particularly the very basic RSA attacks:

<http://crypto.stanford.edu/~dabo/pubs/papers/RSA-survey.pdf>

and ask yourself how comfortable you feel about directly using RSA in any context other than encrypting a randomly generated (semantically void) binary encrypting key under secure padding.

<comment><USER8> Very interesting skim; I'll have to make a few passes and digest it fully when I get the chance.

Is there a particular attack you're looking at here? I assume it's one based on Coppersmith's theorem, as that section was complicated enough that I'll need a few passes to digest it.

Of course, the plaintext could be voided of any semantics by using still more encryption. The simplest way would be to apply a "public" one-time pad to the plaintext. (edit: Different for each plaintext, of course; otherwise, it's not one-time)

The answer to the question I'm asking myself, of course, is "Not at all." _I_ would use a dual-stacked hash/vault system built on high-level libraries if I were implementing something with these requirements. This involves the least new code, limiting both the time and number of mistakes involved.

I treat that as a different question than the purely-theoretical question of whether such a system could be secure.

</comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER10> Regardless of how they're stored, people should be worried that they're sending passwords via email. Passwords (especially ones that can cause financial harm) are considered PII and sending it via email (unencrypted transmission) is illegal in Massachusetts and probably a few dozen other states.

<comment><USER11> Newegg doesn't save your credit card number. So I guess your newegg password could lead to financial harm, but only very indirectly.

<comment><USER3> Um, what. I most certainly have checked out of Newegg without re-entering my card number. Even if they store the numbers off premises for PCI certification reasons, if a Newegg password lets someone log in and buy a hundred flat screens on my account, that sounds like financial harm to me.

<comment> X-Istence You need to at least enter your CVV number to make a purchase using a stored credit card.

</comment></comment></comment></comment><comment><USER12> As a user, I assume the site is not going to do the right thing with my password. That's why I securely generate a new password for each site using a master passphrase. Oplop is a good, zero-install tool for doing this. <http://pauladamsmith.com/blog/2010/12/oplop.html>

</comment><comment><USER13> I'm developing a site right now in which I capture plaintext passwords on sign up within a separate table and then offload that data on an hourly basis to backup so that in case I ever need to change from BCrypt to some other encryption scheme, I have the plaintext passwords to easily make the switch. The passwords are never going back into the production db and someone would need to get physical access to my in house backup server to get these passwords.

From a customer service standpoint, I don't plan to ever let people know I am doing this because they will try to call me out on being evil about it.

<comment><USER14> Why not just authenticate against the existing encryption scheme and then encrypt into the new scheme on the next log in?

<comment><USER15> I second this. Storing plaintext passwords seems like a huge liability, especially since you just announced it on a public forum ;)

</comment></comment></comment><comment><USER16> They obviously don't store a one-way hash if they just regurgitated it to you, but is this really enough information to conclude the password is _stored_ in plaintext?

This just means the password is easily convertible to plaintext - <USER2> because it's stored in plaintext or because it's encrypted and their support folks are able to decrypt it. The former is completely indefensible, the latter is "just" very very bad.

<comment><USER17> There is no real difference between plain text and a recoverable encryption. If a password can be returned to a plain text state it can be considered as bad as just storing it in plain text.

<comment><USER16> I almost entirely agree, the difference is minimal (especially if a support agent can easily recover it, that's a pretty low bar). Encrypting passwords and keeping the key in an offline (or hardware-protected), highly secure location helps manage your risk but "don't ever do it" should still be standard response when considering a system which lets you recover passwords.

I can think of two situations where design dictates you _need_ passwords to be recoverable, but even though they exist you can (and I do :)) argue the design is wrong:

\- Online aggregators like Mint/Yodlee/etc. that pass through your credentials and use screen scraping to get your data. Obviously a faulty design but in the financial aggregator case it's kind of your only choice and many customers are willing to accept the tradeoff.

\- I've heard policy enforcement (e.g. "Your current password must not contain any of your N previous passwords and must meet [set of strength criteria]") used as an excuse but I don't really buy it. Not having access to the original password limits your choices for future policy enforcement (to what you could derive from the password when first set) but with a little foresight and extra work you can do fine just with hashes.

<comment><USER18> The "n previous" is trivial to do with hashes. The problem is the policies like "you can't add a number to a previous password". With those, you must have a reversable password.

Ironically, those policies make you significantly less secure. First, you are storing previous and current passwords in a reversible format. Second, the more difficult your policies, the more likely your users are to treat the password insecurely (PostIt note on the monitor, etc).

<comment><USER19> Absolutely incorrect. The system stores not only the hash of your password, but also the hashes of the forbidden variations, at the moment the initial password is processed.

<comment><USER18> "A password can't begin with another password." (meant to capture _password_ , _password2_ , _password3_... Are you going to hash every permutation? Seems like an _awful_ lot of disk space.

Another policy I've seen is "passwords must differ by at least N characters". Again, how many hashes do you need to store for a 16 character password?

For any trivial policy ("don't add numbers to the end", storing the extra hashes will work. All the password policy systems I've seen allow too many axes of freedom for that.

</comment></comment></comment></comment></comment></comment><comment><USER20> It's definitely possible that they're storing the passwords using reversible encryption. However:

1) In my experience, it's often harder to set your app up to use reversible encryption instead of hashes, especially if you're using an existing authentication library. In a case like this, I would assume the path of least resistance is more likely.

2) Storing passwords as reversible encryption is almost as bad, as the person who compromises your security would likely have access to your application code (and therefore the key to decrypt the passwords), and the negligible benefits of being able to retrieve passwords are not usually worth the potential liability.

<comment><USER21> The key doesn't have to be stored on the server. It can be on a private computer that is not connected to any network at all. Still vulnerable, but much less so.

<comment><USER22> > It can be on a private computer that is not connected to any network at all.

So you're saying the support tech gets up from his desk, walks over to the computer with the key, gives the computer some command to produce the key, prints the key or writes it down on a piece of paper, walks back to his computer, types in the key, and finally shreds the piece of paper?

<comment><USER21> Unlikely, perhaps. But definitely possible from a technical perspective.

<comment><USER20> Sure, it's also possible that they store the encrypted passwords in a handwritten ledger and decode them when you log in. I was talking about what Newegg is most likely doing in real life.

</comment></comment></comment></comment></comment><comment><USER23> My experiences with Newegg lead me to believe their security policies are severely lacking and have been for years. Many years ago I sent them an email asking whether they offered any type of affiliate program. At the time they didn't ... but instead they sent me a login providing access to many of their back-end systems. More recently, my credit card number was compromised and I've narrowed the leak down to Newegg with almost complete certainty. It's not a site I trust with protecting my information based on those experiences.

</comment><comment><USER24> really? so you guys think they are rigid enough with security and willing to do all that extra work in order to two-way encrypt the password (and credit card data, theoryetically) just so their $8 an hour customer support reps can decrypt it for you?

c'mon. really?

no. put my vote in the box marked 'plain text.'

m3mnoch.

<comment><USER25> Nobody said their customer support rep would be the one doing the decrypting. All it would take is an 'email the user their password' function in the app that decrypts the password and sends out the email.

I think you're misunderstanding their argument.

<comment><USER24> or, you're thinking the support rep doesn't have the power to change the email address on the account.

m3mnoch.

</comment></comment></comment><comment><USER26> I still dont get how you concluded that Newegg stores password in plain text.

All you did was talk to a Newegg rep, you said he mis understood you and email you your Newegg password. What evidence do you have and in what logical reasoning does that lead to Newegg storing passwords in plain text?

He could have used your info and looked it up in the Newegg system, probably clicked a check box that says "email password" the system could have decrypted it and sent you the password.

I've seen many sites that actually send you your username and current passwords if you forgot. It doesn't mean that when it's stored on their system it was not encrypted.

Edit: to clarify, my whole point is in reference to how the password is _stored_ in plain text.

<comment><USER27> If your password is stored in a "decryptable" format, it might as well be stored in plaintext. Secure systems simply do not have this capability.

</comment></comment><comment><USER28> "is there a public site / wall of shame for web-services that store your auth info in the clear? we need one."[1]

Can we make one?

1: <https://twitter.com/#!/igrigorik/status/69120340063825920>

<comment><USER29> <http://plaintextoffenders.com/>

</comment></comment><comment><USER30> And an fyi, tigerdirect.com does this too. I don't know if it's reversible or plain text, but I'd still prefer to reset my password on the site rather than it being sent back to me.

<comment><USER31> hostgator.com does this as well. They even display your password in their online dashboard.

</comment></comment><comment><USER32> As a service (<http://infostripe.com>) we generally only store public information but we still encrypt most of it to make it less valuable as a whole in case our db got stolen somehow.

Whether the password was plain text or decrypted by a tool both are bad practice. The only person who should have any means to make sense of the hash gibberish in any db is the user who created the key.

</comment><comment><USER33> Whether or not it's stored in "real" plain text is not the issue here. The real security issue is that they email you your password at all. So anyone who has access to your inbox, even for 5 minutes while you step out of the room, now has a way to find your newegg password. And for a significant percentage of people that will be the one password they use everywhere.

</comment><comment><USER34> I wouldn't have a real problem with a password encrypted reversibly via salted/IV'd RSA public key, with a well-protected, generally offline private key for recovery in the event of some bizarre necessity. Provided there were some legitimate reason to reverse it... Still all the other benefits of a one- way hash, eh?

</comment><comment><USER35> Newegg has earned my trust - in my book they can do whatever they want.

If they leak my info, then I'll care.

<comment><USER16> Leak? Your comment only really makes sense if you trust all current and future Newegg employees to (1) never make mistakes with security impact (2) be completely incorruptible.

This article strikes down (1) almost by definition.

<comment><USER35> You seem to imply the employees have access to the password as was discussed above at length. This has not been proven.

My passwords are unique - If my newegg password is compromised I supposed people can order some computer parts and ship them to one of my addresses. Pretty sure changing delivery address of stored CC requires card info re-entry like amazon. And I'd just report it stolen and get re-imbursed. BFD.

</comment></comment></comment><comment><USER36> I use the +tags format for testing email on my website. As a consequence it's supported completely across the board. It's very useful for testing.

</comment><comment><USER37> Same for bluehost. They once told me my password over the phone.

</comment><comment><USER38> A much bigger issue is the lack of encryption for HTTP logins.

</comment><comment><USER39> so does Safari books online. in fact they emailed it to me.. in plain text.

</comment><comment><USER40> I blame the French: <http://bit.ly/hjxHZQ>

<comment><USER41> This is terrible.

Question, under that law, do you need to store plaintext passwords if you hash the passwords on the browser side, since you don't "collect" the actual password from the user, as it never leaves their computer?

<comment><USER19> Unless you have some sort of server-trusted hardware system running on the client, hashing on the client is equivalent to not hashing at all, since you cannot force a client to hash before sending a password guess.

</comment></comment></comment><comment><USER42> Don't see a mention of Pwdhash in the comments. That Firfox/Chrome extension would have protected you. <https://www.pwdhash.com/>

<comment><USER43> > Don't see a mention of Pwdhash in the comments. That Firfox/Chrome extension > would have protected you.

Your statement is misleading. That website is essentially creating a hashed password of the original password. But the target website will still consider it your password in which case it will not protect you once the 'password' to the website is known which the author is talking about.

To put it another way, if your password is 'abc' and hashed it becomes: 'ABCDEFG'. The website stores it plaintext as 'ABCDEFG' to which a hacker has it. Then if anyone later accesses the website, they would be able to just type in 'ABCDEFG'.

Pwdhash is just another form of a password manager.

<comment><USER15> If it incorporates the domain into the hash (which it sounds like it does), this is still useful. If a hacker gets you password 'abc', they can log into any other website for which you use the same password. If they get the hash 'ABCDEFG', they only get into that one site.

</comment></comment></comment><comment><USER11> Yeah, that's bad, but it's a bit tough to get worked up about.

There are many available solutions that make it easy to have a different, secure password for each site you visit.

<comment><AUTHOR> So I am "worked up" about it, because it's Newegg. If it were Mom & Pop computer store, I'd probably shrug it off. But Newegg can and should have just as good a security as an Amazon or Walmart.

</comment></comment><comment><USER44> Stories like this come up every couple months. The true story should be titled _Jerry Asher doesn't understand basic security_. It's pretty worrisome that developers don't understand the difference between encryption and hashing, and then symmetric vs asymmetric key encryption.

Of course, Newegg should adopt a strong hash policy since they've introduced a single point of failure.

<comment><USER44> You're defending your post pretty strongly, and you can downvote me all you want, but you specifically said

"That must mean that Newegg stores your passwords in the clear, as plaintex"

I didn't add the word _must_ there.

<comment><AUTHOR> I have not yet achieved or unlocked "downvote". :(

I'm not sure I want to just get into rewriting a post, but I did update it to reference the discussion and I did mention the more correct (unlikely) theory that there is a two way encryption involved and everything is hunky-dory.

<comment><USER45> Even if there _is_ 2-way encryption involved, I don't find that an acceptable means of password storage. If the original password is retrievable by anything other than painful (hopefully infeasible) brute-force means, it's bad.

<comment><AUTHOR> I agree. Up above it was pointed out that it's bad because a) people use the same passwords across sites, and b) by not allowing peeking at a password, bad employees are forced to use mechanisms that are more likely to create audit trails, like mechanisms that change a password in the database.</comment></comment></comment></comment></comment>


Show HN: Hacker Reads, something I made for fun. - <AUTHOR> http://www.hackerreads.com/

<comment><USER2> I love the design, it is clean and clear. How long did it take you to make this website and what did you use?

<comment><AUTHOR> It took about a day to do it, I guess around 8 or so hours. I'm using Ruby on Rails(pretty much just for the free hosting on heroku). The majority of the work is in Javascript.

<comment><USER3> Am I missing something? It's a blank page! I'm using Google Chrome.

<comment><USER4> Unable to duplicate. I'm using Google Chrome as well.

Is reddit blocked?

> Hacker Reads

> This is a simple app that brings in popular articles into a single digest. > Currently the sources are

> r/programming, r/science, r/technology, and r/webdev.

<comment><USER3> Good call, yes, reddit is probably blocked.

Thanks!</comment></comment></comment></comment></comment>


Evolving "nofollow" – new ways to identify the nature of links - <AUTHOR> https://webmasters.googleblog.com/2019/09/evolving-nofollow-new-ways-to-identify.html <comment><USER2> It's the crisis of the hyperlink: It's diminished to the point where Google is afraid of losing it's previously dominant signal for good.

Personal publishing has moved almost entirely to platforms that `nofollow` links. And commercial sites do whatever it takes to avoid linking anywhere but back, deeper into their own site.

There have been some cases where I think people are behaving somewhat irresponsible with "nofollow": the German Wikipedia, for example, does it to all outbound links.

That's understandable from a spam-fighting perspective. But, if search engines actually implement it draconically, it deprives the search index of vast amounts of collaborative filtering.

I actually just checked, and couldn't find nofollows on either HN or Reddit links. Are they somehow setting them via some method other than the actual link tag?

In any case, I was going to suggest that nofollow makes sense for the "new" queue, but it wouldn't hurt and possibly help to remove it once user generated content has reached certain milestones, i. e. user karma, or hitting the front page.

<comment><USER3> A related source of great frustration: put some good stuff on the web. Lots of people link to it but almost entirely from social media platforms where every link is a nofollow. Somebody else working on gaming the system with SEO makes a less valuable and useful thing, but obtains (by subterfuge or diligent direct asking) some non-nofollow links. Your high-quality content will be outranked in search results by the other less-high-quality quality content.

A reasonable improvement to this, to reinvigorate the hyperlink: social media platforms could stop using nofollow for links put in by users who themselves have built up a degree of reputation.

<comment><USER4> It really does seem hard to get visitors these days, even for original niche content. The first page of Google search results is half social/video/news carousels instead of genuine long-term content, and a lot of the other links point to repetitive articles published by generic big-name websites that never really add anything new.

<comment><USER5> This is the point of nofollow, to get rid of small websites and to prevent them. The spam story is nonsens, it does nothing spam protection related.

</comment></comment></comment></comment><comment><USER6> I don't plan on implementing these, and neither should you, unless they get added as part of an official HTML specification. Maybe they are, but I don't see them on this list of link types [0]. Until they get formally specified, to me this is just Google doing Google things and fragmenting the web.

[0] [https://developer.mozilla.org/en- US/docs/Web/HTML/Link_types](https://developer.mozilla.org/en- US/docs/Web/HTML/Link_types)

<comment><USER7> It feels like yet another way for Google to offload the hard work of indexing the web into other people.

See also; microdata, and the monthly alerts I get from Google about the content of my sites being malformed, yet they validate just fine in a dozen other tools.

If this keeps up, eventually we'll have to log in to Google to provide it with with the URLs of new content, and fill in all of the meta data about each page. All in the name of whatever buzzword Big G comes up with that month.

<comment><USER8> Dare I say that a better indexed web is a public good that we all benefit from immensely.

Logging into Google and providing it with the URLs isn't analogous because that only benefits Google, it provides a barrier to the entry of competition, which isn't good for us users.

<comment><USER9> > Dare I say that a better indexed web is a public good that we all benefit > from immensely.

Sure, if it were used for the benefit of the public, rather than the benefit of Google.

</comment></comment></comment></comment><comment><USER10> I run large forums and mark my links "nofollow". I see no reason or benefit to me to change to or add "ugc".

It's not clear that there's any benefits for me.

And it's vague enough that I don't know that there are not downsides.

Seems best to do nothing.

<comment><USER11> Complete agreement. Furthermore, bad actors out there will abuse "ugc": they will mark terabytes of robot-generated content as "user-generated". It will not be possible to rely on it as an indication of organic content or anything of the sort. Search engines won't be able to use that for ranking, for instance.

<comment><USER12> This change is not for you. This change allows them to treat facebook/twitter/reddit links with weight if the other signals are present.

<comment><USER11> If I know that I'm traversing and processing facebook/twitter/reddit links, doesn't "nofollow" already indicate user generated content? (Even if some "nofollow" links do not do that, I can probably separate those based on their position in the documents.)

If you're going to treat specific sites specially, then go in all the way and be prepared to have your logic understand any/all aspects of their structure. Or else, don't bother.

</comment></comment></comment></comment><comment><USER13> So... this is pretty much saying they will now analyze _all_ links now, irregardless of "nofollow". Previously they outright ignored "nofollow".

<comment><USER14> Nitpick: There's no such word as "irregardless". _Escorts myself out_

<comment><USER15> For every word in existence, there was someone who used it first.

<comment><USER16> I don't think it's that simple. There's a chicken & egg paradox at play.

</comment></comment></comment></comment><comment><USER17> From the Article:

 _rel= "nofollow": Use this attribute for cases where you want to link to a page but don't want to imply any type of endorsement, including passing along ranking credit to another page._

This means the meaning of 'nofollow' is changing? That seems a horrible idea. Previously 'nofollow' meant exactly that - "don't follow this link please googlebot", now it will mean "follow this link, but don't grant my site ranking onto the destination." \- Thats a VERY different use case, I can't see all the millions of existing 'nofollow' tags being changed by site owners to any of these new tags. Surely a 'nogrant' or somesuch would be a better option, and leave 'nofollow' alone.

</comment><comment><USER8> Question that wasn't answered: Should user generated content links, that may or may not be sponsored (suppose the site owner neither knows nor cares), be marked "ugc" or "ugc sponsored" or "ugc nofollow"?

<comment><USER18> I think just "ugc" from Google's perspective, but they mention that you can use "ugc nofollow" for other services that don't understand "ugc".

<comment><USER12> Ugc: It's basically someone I didn't know posted this. Treat it as neutral.

Sponsored is someone paided/trade for this. Treat it as distrustful.

Both is someone I don't know posted this and I made money. Treat as fake-

</comment></comment></comment><comment><USER19> Nofollow has and it's interpretation have always been interesting. Professional SEO's analyze sites as to their "link profile" the number of nofollow, follow, anchor'd, raw etc. type URLs that point to your site.

Consider a super-spammy site that eschews any like but a "follow", well that's weird - that may be an indication they're a spammer.

So while this (quite likely correctly) states that "nofollow" links have not search rank weight, it's not the entire story.

</comment><comment><USER20> Not sure that many sponsors will be happy to keep sponsoring the content if they'll get "sponsored"(pretty much nofollow) link.

<comment><USER21> Seems like a net win.

<comment><USER22> It's not a win, it just means nobody will use that tag.

<comment><USER23> I also propose a semantic <ad> HTML tag, which would behave like <section>, to represent parts of a document that are an ad.

With an optional do-not-block attribute.

<comment><USER24> > With an optional do-not-block attribute.

Which would be honored just like Do-Not-Track? Seems only fair.

</comment></comment></comment></comment></comment><comment><USER25> I'm curious if any attempt was made to submit this as a standard inclusion to the IANA link relations registry:

[https://www.iana.org/assignments/link-relations/link- relatio...](https://www.iana.org/assignments/link-relations/link- relations.xhtml)

</comment><comment><USER26> I appreciate nofollow and ugc. I run a site with user-generated content, and worry about spammers over writing the site with junk content. Having a way to indicate that the link is from someone else is useful for eliminating the incentives for spammers.

</comment><comment><USER9> "Do more work so that we have more info. No, it doesn't give you any benefit."

</comment><comment><USER12> Nofollow made sense but if everyone is using it for all links there is no value in it and the tag should be ignored.

I like the change it allows them to ignore nofollow for facebook/twitter/reddit or smaller sites that nofollow all links.

<comment><USER27> I'm pretty sure google has already been treating some nofollow links as if they weren't nofollow for some time now.

</comment></comment><comment><USER5> It makes organic indexing impossible, there is no point making your own website like this. Its even insulting calling hardworked content spam.

</comment><comment><USER28> nofollow is 15 years old? Holy crap I'm old!!!</comment>


7 Ways To Be A Healthier Programmer - <AUTHOR> http://successfulsoftware.net/2008/10/26/7-ways-to-be-a-healthier-programmer/

<comment><USER2> Step 8: Get some sleep! You're much more productive as a programmer - and much more able to solve tough problems - when you're well rested.

Step 9: Get some exercise! Ditto for exercise: -you're much more clear-headed, confident, and productive when your body feels in good shape.

</comment><comment><USER3> So, basically: Do more then code for 8 hours a day nonstop.

Does anyone even do that anymore? Or in the first place?</comment>


Ask HN: Is this industry stuck in a bugtracker? - <AUTHOR> I'm not against using Jira, but I feel like using it too much leave too little space for taking responsibility and getting things done in general (ex.: «There is no Jira task, so it's not my job»). Creating a Jira task for every small incremental improvement is a PITA. Work outside of Jira is where we get most NEW things created, because we are not trapped in Jira bureaucracy. In the long term, out-of-jira work can bring more value than fixing bugs and closing tasks. The act of measuring work slows it down drastically from my experience.
While you close 100 small bugs per day and feel productive, another business can appear with a new vision/approach and make a better overall solution. Jira makes you reach local maxima. Vision and priorities bring you to the global maximum.
There could be a tool or method to pass down priorities and goals instead of tasks to developers. Developers with goals accomplish things towards this goal.
Have we become the slaves of a big bugtracker? Does your company work 100% of the time in Jira or a smaller percentage? <comment><USER2> Jira is pretty flexible, so it could be used for priorities and goals as well as bug tracking</comment>


After the Social Web, Here Comes the Trust Web - <AUTHOR> http://techcrunch.com/2015/01/18/after-the-social-web-here-comes-the-trust-web/

<comment><USER2> I am currently building a peer to peer finance platform and I have had the opportunity to talk to a large number of market participants. We are in the honeymoon phase of peer to peer finance (crowdfunding/crowdinvesting) where investors are simply excited to have access to investments that were impossible at the minimum invested dollars offered today.

In order for the market to expand beyond early adopters, platforms will need to focus on providing transparency, risk controls and most importantly removing moral hazard where possible.

Moral hazard is the biggest issue right now as investors in most crowdfunded transactions have highly divergent financial goals from the people they are investing money in and the platforms facilitating those investments.

Solving that issue will be the biggest challenge for the industry and the one that I believe will really help it grow beyond the early adopters.

</comment><comment><USER3> > _To say that bitcoin and its sole blockchain hold a monopoly on the future > of cryptocurrency-based implementations is like saying in 2006 that LinkedIn > was the only social network needed when it was barely leading, and when > Facebook, Twitter and many other social platforms were still babies._

But why would anyone (especially David Cohen?) think that LinkedIn is entirely open-source software? And why would he think that Facebook was a fork of LinkedIn's source code? I don't understand this analogy at all.

</comment><comment><USER4> I own lots of Bitcoin and love the Blockchain, but the obvious cynical point is that this was written by a Techstars guy who is trying to pump the cause while its in a crisis state.

I really don't think Bitcoin has uses that people care about, e.g., privacy, micropayments for digital content, yada-yada.

Please I'd love to be wrong. Tell me how I'm wrong. I'm actually dead serious as I don't want to lose money and have my "baby" startup, Onarbor, in this space.

</comment><comment><USER5> The reddit thread has no discussions. Here's the link to original article: [http://techcrunch.com/2015/01/18/after-the-social-web- here-c...](http://techcrunch.com/2015/01/18/after-the-social-web-here-comes- the-trust-web/)

<comment><USER6> Thanks.</comment></comment>


Why I'm founding a startup I don't really care about - <AUTHOR> https://www.kapwing.com/blog/founding-a-startup-I-dont-really-care-about <comment><USER2> How do you make money though?

<comment><AUTHOR> Subscriptions for power users. $10 for unlimited video without watermarks: [https://www.kapwing.com/blog/skipping-our-paywall-with-an- ap...](https://www.kapwing.com/blog/skipping-our-paywall-with-an-apology)</comment></comment>


Go Circuit – Distributed Go Programming Framework - <AUTHOR> http://www.gocircuit.org/ <comment><USER2> <https://github.com/tumblr/gocircuit>

</comment><comment><USER3> For those who, like me, were looking for a more in-depth _"About"_ page, the _"Big picture: problems and solutions"_ link under _"Research"_ is what you want:

<http://www.gocircuit.org/big.html>

(also, to the maintainer: the "Ideal architecture" header at the bottom is on the wrong column)

</comment><comment><USER4> Sounds like Go adding more Erlang style features. Off the top of my head, some nice things that Erlang lacks in that department might include:

* A bit more security by default. Erlang was built for something where they presumed they were walled off from bad stuff.

* Some kind of routing mechanism, so that you could have A connected to B, and B connected to C, and the system would be able to send messages from A to C. I have no idea if this is actually a good idea, as this is not the sort of thing I use Erlang for myself. But it seems like it might be cool.

<comment><USER5> > Sounds like Go adding more Erlang style features.

Nitpick: this is simply an independent 3rd-party package / external lib for Go developers. Not a language or runtime feature or addition.

<comment><USER6> So maybe like erlang's OTP ?

</comment></comment></comment><comment><USER7> _This application is temporarily over its serving quota. Please try again later._

Seems to be running on AppEngine by the look of it. AppEngine has the limits far too low for basic stuff like this, they should really re-look at their service offering if they want to actually compete in the market.

<comment><USER8> When it comes to GAE it really doesn't seem like Google's heart is in it.

Which given their history is a bad, bad sign.

<comment><USER9> I'm guessing like everything else google, it will be shutdown leaving many developers stranded. We built an entire site around GAE and it was the biggest mistake of my professional career!

<comment><USER10> You have a great opportunity to start a GAE-compatible service provider! I imagine a decent percentage of people would migrate just for insurance.

(Yes, I suspect this would be the new biggest mistake of your professional career. :-))

</comment></comment></comment></comment><comment><USER11> Can someone explain how `Spawn` ships the closure for execution to a remote host? I'm quite curious to know. I had a grep through the source, but I only found one [1] implementation of `Spawn` accepting a function as a parameter in the code base. This hides the true implementation, which I'm struggling to find. Any hints?

[1] [https://github.com/tumblr/gocircuit/blob/master/src/circuit/...](https://github.com/tumblr/gocircuit/blob/master/src/circuit/use/circuit/bind.go#L84)

<comment><USER12> <http://www.gocircuit.org/spawn.html>

<comment><USER11> I found that earlier - unless I'm missing something, it doesn't actually explain how the closure is packaged. Does the worker need compiled-in knowledge of what the master wants to execute in advance, for example? It's not clear to me.

<comment><USER12> It looks like at this time Spawn doesn't support the closures yet. <http://www.gocircuit.org/lang.html#worker-functions>: "The need for boilerplate will be removed in an upcoming Circuit Compiler"

From [https://github.com/tumblr/gocircuit/blob/master/src/circuit/...](https://github.com/tumblr/gocircuit/blob/master/src/circuit/use/circuit/bind.go#L75): "The worker function fn, whose type must have previously been registered with RegisterFunc"

And it looks like only function type id is communicated to worker: [https://github.com/tumblr/gocircuit/blob/master/src/circuit/...](https://github.com/tumblr/gocircuit/blob/master/src/circuit/sys/lang/func.go#L115)

</comment></comment></comment></comment><comment><USER13> This looks like tumblr took their hand at making "netchan" (and more). Pretty interesting; I'll have to check this out. I like how they tried to make it similar to Erlang. However, the way they've organized the source isn't "go- get"able which is a pet peeve of mine.

</comment><comment><USER14> Quick popularity like making it to the front page of HN, Reddit, Slashdot, etc. can become quite the curse when you're running a small app on App Engine. Of course, after throwing a few buckets of money down the well, you'll quickly learn to start optimizing for the platform. I don't know what this framework does, but it might be useful to link to a static page in the interim and then have people click through to your app.

<comment><USER15> > I don't know what this framework does

Excerpt from my browser cache:

"The circuit extends the reach of Go's linguistic environment to multi- host/multi-process applications. In simple terms, the Go Circuit was born from the desire to be able to write:

        feedback := make(chan int)
        circuit.Spawn("host25.datacenter.net", func() {
    	feedback <- 1
        })
        <-feedback
        println("Roundtrip complete.")

The Spawn operator will start its argument function on a desired remote host in a new goroutine, while making it possible to communicate between the parent and child goroutines using the same Go code that you would use to communicate between traditional goroutines. Above, the channel feedback is transparently "stretched" between the parent goroutine, executing locally, and the child goroutine, executing remotely and hosting the anonymous function execution."

<comment><USER16> Though interesting, it brings back up the age old question if this is the right thing to do? Should an RPC actually look indistinguishable from a local call?

I have heard arguments from both sides starting from the days of CORBA and DCOM. But never had a convincing answer either way. It usually boils down to 'depends on use case'.</comment></comment></comment>


A comic about how IE failed to support XHTML for a decade - <AUTHOR> http://i.imgur.com/LzcFT.png

<comment><USER2> Whatever. I can't blame them for not supporting XHTML for so long; it's a useless standard if you ask me.

<comment><AUTHOR> Except they finally did recently in IE9.

</comment></comment><comment><AUTHOR> Not to mention how long it will take for IE8 to die.</comment>


How do you bug track on personal projects? - <AUTHOR>

I'm working on a couple personal projects now, and I find that I'll forget bugs/ features I want to work on if I don't record them somewhere. I've tried using a few bug tracking systems, but a lot of them had too many features designed for teams for my needs. What application, or recording system do you use to keep track of bugs/features in personal projects? <comment><USER2> I use FogBugz for a few personal projects. They have a free version for up to two users, and it includes bugs tracking and git/hg repository. <http://www.fogcreek.com/fogbugz/StudentAndStartup.html>

I just ignore the features for more users, most of the time it's easy. (Sometime it's a little funny, for example, the messages: "Bug#83: oppened by <gus> and assigned to <gus> by <gus>")

</comment><comment><USER3> For personal projects,I just use the "Issues" feature of Github/Bitbucket. Any feature/bug etc. goes on my issue list. This way, i can quickly take a look.

<comment><USER4> Seconded. Github issues is the perfect balance of simplicity / power for a single-person team.

</comment></comment><comment><USER5> I just make an Asana checklist for each project I'm working on - it's a great way to track bugs, add lists of features, see how you're doing, etc. It's also easy to add collaborators if you add a partner to the project and want to manage features in one place.

</comment><comment><USER6> Honestly, for personal projects, I just use the Apple Reminders app. It syncs across devices and is easy to get to/add to. For anything that is read by people other than myself though, I use Github issues or Youtrack.

</comment><comment><USER7> I use a command line program bugzyrb for personal projects. <https://github.com/rkumar/bugzyrb>

You could also try taskwarrior.</comment>


The startup playbook: A guide for employees and founders, made by founders - <AUTHOR> https://www.slideshare.net/ToucanToco/startup-play-book-for-founders-amp-employees-written-by-toucans-founders-3 <comment><USER2> Happy to get your feedback to make it more comprehensive

</comment><comment><USER3> Niiice</comment>


Today's AI's Are Dangerously Lacking in Artificial Understanding - <AUTHOR> https://www.forbes.com/sites/cognitiveworld/2019/02/18/not-good-as-gold-todays-ais-are-dangerously-lacking-in-au-artificial-understanding/#67b94a6a536d <comment><USER2> I work at Doug's company, Cycorp. I've only been there for a couple of years, but they definitely have something truly unique.</comment>


Is artificial intelligence set to become art's next medium? - <AUTHOR> https://www.christies.com/features/A-collaboration-between-two-artists-one-human-one-a-machine-9332-1.aspx <comment><USER2> (2018)</comment>