Mozilla Plans H.264 Video for Desktop Firefox - <AUTHOR> http://www.webmonkey.com/2012/10/mozilla-plans-h-264-video-for-desktop-firefox/

<comment><USER3> H.264 is not a "proprietary video codec", it's a patent-encumbered codec. The spec is available for free on the ITU website(<http://www.itu.int/rec/T-REC-H.264>) and several open source implementations exist.

<comment><USER4> The spec is useless, even harmful, if 3 years from now MPEG LA decides to start charging content providers a licensing fee for their content, even if that content is distributed for free.

If we start using a codec for which the patents are owned by a company, and that company dictates the licensing terms for that codec, then aren't we handing control to how the content is distributed to said company?

what do we know about MPEG LA?

<comment><USER5> [http://www.engadget.com/2010/08/26/mpeg-la- makes-h-264-video...](http://www.engadget.com/2010/08/26/mpeg-la- makes-h-264-video-royalty-free-forever-as-long-as-its/)

<comment><USER6> That says absolutely nothing about h.264 decoder or encoder implementations, such as the decoders needed in web browsers to handle h.264 in <video> tags; that just says MPEG-LA won't charge people distributing h.264 video files.

<comment><USER5> The parent post didn't mention decoders / encoders, it mentioned free content. These articles[1][2] explain the costs and possible increases[3]. Apple, Microsoft, and Google have bought the license for their libraries on their platforms.

[1] [http://www.zdnet.com/blog/bott/a-closer-look-at-the-costs- an...](http://www.zdnet.com/blog/bott/a-closer-look-at-the-costs-and-fine- print-of-h-264-licenses/2884)

[2] [http://www.zdnet.com/blog/bott/h-264-patents-how-much-do- the...](http://www.zdnet.com/blog/bott/h-264-patents-how-much-do-they-really- cost/2122)

[3] <http://www.mpegla.com/main/programs/AVC/Pages/FAQ.aspx> last question

</comment></comment></comment></comment></comment><comment><USER7> > Unfortunately that dream has failed to pan out. Instead of proprietary > plugins, the web ended up with proprietary video codecs, which has created a > split in browser support for HTML5 video. Firefox and Opera support the open > Ogg and WebM codecs, while Safari and Internet Explorer supported H.264.

Funny, it looks like a major browser was left out there (in fact the #1 browser in usage according to some metrics).

The article is pretty good overall, but is missing a key piece that is important to understand the background.

<comment><USER8> I blame Google for this, too. They should've made Youtube play on WebM by default, with a fallback to Flash in browsers that don't support it. That would've forced the others to adopt WebM.

<comment><USER9> Forcing an inferior codec on users for political reasons is unreasonable.

Have you tried watching 720p WebM compared to 720p H264? The difference is jarring.

<comment><USER10> I watched the Amazing Spiderman trailer[1] in 720p in both formats - <USER2> youtube-dl - and I honestly couldn't tell the difference. The webM file is ~16% larger, though.

[1]: <https://www.youtube.com/watch?v=atCfTRMyjGU>

</comment></comment></comment></comment><comment><USER11> Does anyone have an opinion on whether Google's purchase of On2 makes any sense now with hindsight?

Did it affect the behaviour of the MPEGLA in any way? I know some of the tech has fed into WebRTC but that battle is far from over.

Was On2 worth the cash?

<comment><USER12> Google acquired On2 in February of 2010. In August of 2010, the MPEG-LA "announced that H.264 encoded internet video that is free to end users will never be charged royalties." ([http://en.wikipedia.org/wiki/H.264/MPEG-4_AVC#Patent_licensi...](http://en.wikipedia.org/wiki/H.264/MPEG-4_AVC#Patent_licensing))

So... yeah, I'd say it profoundly affected the MPEG-LA's behavior. If Google didn't have an easy out with (what would become) WebM, their Youtube licensing would be much more expensive.

Whether that patent promise has any bearing on the Mozilla decision is a more complicated issue. People have strong opinions on both sides.

</comment></comment><comment><USER13> This is great news. There will now be a de facto standard codec for HTML5 video!

<comment><USER14> Except it'll be the wrong one, sadly.

<comment><USER15> The wrong choice is Flash.

H.264 vs. WebM is a far more nuanced tradeoff – widespread support and higher- quality implementations versus [hopefully] freedom from patents. Either way, the web wins if there's more <video> and less <embed> depending on an opaque binary blob from a single vendor with a track record of platform neglect.

<comment><USER14> Sure, but it could've been so much better, with almost no extra effort.

In the end, we have the worse of two options for absolutely no gain.

<comment><USER16> In the end patents will expire. 15 years left.

<comment><USER17> And that's one of the biggest problems with software patents. In 15 years, we'll likely be using a different codec (or, at least I would hope we'd make some progress in that amount of time).

<comment><USER5> Probably sooner, H.265 is next on the list <http://en.wikipedia.org/wiki/High_Efficiency_Video_Coding> <http://www.h265.net>

</comment></comment></comment></comment></comment></comment></comment><comment><USER18> How do they plan to defend against vulnerabilities in the system codecs? Especially a GPU-accelerated codec has the potential to wreak all sorts of nefariousness.

</comment><comment><USER19> _crosses fingers_ Please use libavcodec! Please use libavcodec! Please use libavcodec! _reads article and is disappointed_

<comment><USER20> they will use gstreamer (which won't rule ouy libavcodec).

<comment><USER21> gstreamer itself will use libavcodec

<comment><USER20> that's what i was implying (with my typo). but gstreamer might use something else as well.

</comment></comment></comment></comment><comment><USER22> Contrary to the article, h264 is not currently working on Android Firefox (2012-10-11 release), or at least it doesn't for me.</comment>


Optimizing Wikipedia's Fundraising Banner Ads - <AUTHOR> http://blog.wikimedia.org/2009/12/11/annual-fundraiser-checking-banner-results/

<comment><USER2> I've found them far more obnoxious over time, personally. As the first commenter notes, this is also a legitimate concern--but there's no easy metric for obnoxiousness. (Clicks on the "hide" button perhaps?)

<comment><USER3> Yes there is: measure the frequencies each banner is shown to each visitor and add that data to your optimization parameters. Of course this requires you to identify and track each individual visitor, but it's a standard practice in online ad systems.

</comment></comment><comment><USER4> I have written a blog post on this with detailed explanation of the 'anchoring heuristic'.

[http://saperduper.org/post/293243288/wikipedia-donators- anch...](http://saperduper.org/post/293243288/wikipedia-donators-anchoring- heuristic)

I also posted it on HN <http://news.ycombinator.com/item?id=1007587>

<comment><USER5> This made me think to "Predictably Irrational" by Dan Ariely too, quite a good example of the anchoring phenomenon. [http://www.ted.com/talks/dan_ariely_asks_are_we_in_control_o...](http://www.ted.com/talks/dan_ariely_asks_are_we_in_control_of_our_own_decisions.html) Btw, i agree with those that says that is quite hard to come to any meaninful conclusion just using the average and max donation, why not analyze also the median value or the std dev/complete donations distribution?

</comment></comment><comment><USER6> I still don't understand why Google doesn't just support Wikipedia. That whole "knowl" thing didn't work out that well... it would almost be a feel-good thing for them. Hell, google.org could do it on behalf of the parent corporation as a charity move.

</comment><comment><USER7> a) statistical significance?

b) average is probably not as good a measure as median, since I doubt it's normally distributed.

</comment><comment><USER8> Are these banners really better than advertising? (What revenue would half the pixels, devoted to tasteful ads instead of a pledge drive, yield?)

<comment><USER9> It's a non-profit. They're not interested in maximizing revenues.

<comment><USER10> Non-profit has nothing to do with revenue. Every non-profit that survives has to consider revenue carefully and improve efficiencies.

<comment><USER11> Particularly ones that require a lot of infrastructure and maintenance to keep running. (servers)</comment></comment></comment></comment>


An analysis of the Nomx secure communications device - <AUTHOR> https://scotthelme.co.uk/nomx-the-worlds-most-secure-communications-protocol/ <comment><USER2> Wow. The title kind of gave away that this was going to be a fun read, but I did not expect it to be _that_ bad.

Even if the vendor did not make those bold claims and simply sold it as a hassle-free email appliance for home users and small businesses, it would be borderline fraudulent. _With_ the bold claims attached it almost looks like performance art to ridicule all the snake oil-peddlers out there.

<comment><USER3> It's unlikely to be performance art, and if this isn't fraud it's gross negligence. Does anyone know of any British legislation that refers to the sale of these types of products?

<comment><USER4> Advertising Standard Authority is likely who you want: [https://www.asa.org.uk/](https://www.asa.org.uk/)

</comment></comment></comment><comment><USER5> I read through the patent application cited in the article [1] so I can explain what the device is supposed to be doing.

The "secret sauce" is it can send email between two Nomx devices without using DNS or other third party servers, avoiding DNS attacks. The handshake between two devices sets up DNS records on each device so they can locally resolve each other. There's a mechanism so if a device changes IP address, it informs the other paired devices, with some sort of authentication.

So, it's not just a standard email server running on a RasPi, but does have something new. (To be clear, I'm not defending this device, just explaining what I learned from the patent.)

It's suspicious that the article's author didn't see any network traffic between devices when the handshake was set up, which makes me wonder how much of this is implemented. A couple followup experiments the author could do: a) verify that the device doesn't do an external DNS after the handshake. b) see if changing one device's IP address causes the other to get updated.

[1] [https://patentscope.wipo.int/search/en/detail.jsf?docId=WO20...](https://patentscope.wipo.int/search/en/detail.jsf?docId=WO2016160957)

<comment><USER6> > There's a mechanism so if a device changes IP address, it informs the other > paired devices, with some sort of authentication.

Except there appears to be no evidence that there is such a mechanism.

and as i336_ here stressed:

"The device is designed to send TLS-encrypted mail from nomx device to nomx device on port 26, BUT IT IS ENCRYPTING USING THE DEFAULT Postfix "snakeoil" TLS CERTIFICATE."

</comment></comment><comment><USER7> Calling your product 'the most secure' and 'ensuring absolute privacy' should already set off alarm bells for anyone interested in either security or privacy. It's the kind of marketing that no one in their right mind would use if they knew much about either.

Not surprising, this device does everything wrong and provides neither of those things.

</comment><comment><USER8> I find these kinds of stories infuriating (and just a bit frustrating). Charlatans repackage, rebrand, and repurpose FOSS, then sell them at an unrealistic markup to unsuspecting dupes. Anything from PABX or VoIP systems based on Asterisk, through overly complex CMS's based on Wordpress. I'm not sure what riles me more: consumers being ripped off by these products, or the fact that my strengths lie in tech rather than sales.

<comment><USER9> The FSF has always made clear that they don't have any problem with people selling Free Software; it's about freedom, not low low price.

(What infuriates me about this story is that it reminds me of how far companies like Google have destroyed Mail as a protocol usable without their intermediation. Use Googlemail or get your mails spam-binned.)

<comment><USER10> It's a broken federated system with a huge DOS vulnerability (spam). That's not Google's fault.

<comment><USER9> Is the "solution" of pushing everybody onto a handful of centralized platforms entirely dictated by the nature of the problem?

<comment><USER11> Of course not! A decentralized, federated solution where everyone running a service takes responsibility for their service and ensures high standards are adhered to is preferable, desirable, and possible.

So preferable, in fact, that professionals have tried! Extensively, exhaustively, and at great length. New standards have been devised. New protocols designed. Newer, more clever ideas pioneered and deployed.

Several decades of trying that approach with results being somewhat below what could be hoped for led users and administrators alike to look for alternatives.

The nature of the problem at hand is that in a highly decentralized system where the cost of use is borne by the receiver and breaking backwards compatibility isn't acceptable, it is extremely difficult to stem abuse. Measures that could stop or diminish abuse will not be taken by abusers, and the need to preserve backwards compatibility prevents cutting off both them and legitimate users on less modern services.

It's a shit scenario. _It didn 't have to be this way!_ Yet, there don't seem to be other options on offer that deliver equivalent or better benefits for equivalent or better costs in time and treasure.

</comment></comment></comment></comment></comment><comment><USER12> Their response (on their homepage) is awful: [http://nomx.com/](http://nomx.com/)

"nomx Passes Security Tests After Blogger Claims to Have Penetrated nomx

\- UK blogger makes false claims he can access nomx remotely

\- UK blogger fails to access nomx remotely"

<comment><USER13> Three sentences into "Security testing" section and you have to wonder if they have ever heard of an evil maid attack. Along with outdated kernels that have remote execution bugs, CSRF / XSS bugs, outdated versions of PHP, etc. You really have to wonder if they have any real world security knowledge or skills.

<comment><USER14> > You really have to wonder if they have any real world security knowledge or > skills.

I wouldn't even be the least surprised if they turned out to be genuinely honest and convinced about their own skill.

I've talked to a guy that could tell you right in the eye that a HTTP redirection never hits the UA and goes straight to the second server so it's safe to pass plain credentials in there.

Another one goes out of its way to (please follow through) derive an AES256-CBC key from a user's password using PBKDF2, said key that ends up being sent over HTTP(not S) _right along with_ the encrypted payload that turns out to include said password, but we're safe because that goldberguesque non-encryption is base64-encoded as a second layer. In a flash of foresight, as additional defense in depth, within that encryption the password is actually hashed by the client using plain SHA256, sent on the wire and compared as is with the db record. Please note the irony of using PBKDF2 nearby for the noop key. Well, when viewed as a whole the thing is ironic on so many levels and whatever the angle you look at it that at some point you have to convince yourself this is just an elaborate joke to keep any manner and composure.

Some people just don't _get_ security. Or logic. Or computers. Yet they're being trusted into writing software and building systems, sometimes critical ones, sometimes _medical_ ones. That, defies the mind.

</comment></comment></comment><comment><USER15> I don't understand the point of this, even if it worked correctly.

If I understand correctly what it does is create some kind of secure tunnel between two nomx devices if you tell it to. But doesn't starttls do that already if you configure your mail server that way? And it already just works with any compliant email server?

So unless I'm missing something there's absolutely no doubt in my mind that this is a scam. Kudos to the author for bothering to find flaws in the admin interface but honestly at this point I'd just have reflashed the raspberry pi and used it as a media center.

Even the first picture with the case open is already a huge red flag, not because of the raspberry pi but because of the botched glue gun job.

<comment><USER16> The software side looks like someone just executed an ancient Postfix + Squirrelmail + Dovecot tutorial[0] and cobbled together a horrible UI for it.

[0]: [https://www.exratione.com/2012/05/a-mailserver-on- ubuntu-120...](https://www.exratione.com/2012/05/a-mailserver-on- ubuntu-1204-postfix-dovecot-mysql/)

<comment><USER17> Is it squirrelmail, or just IMAP(s)/POP3(s)?

I guess, at least it isn't running it in conjunction with sendmail [https://threatpost.com/no-fix-for-squirrelmail-remote- code-e...](https://threatpost.com/no-fix-for-squirrelmail-remote-code- execution-vulnerability/125151/)

</comment></comment></comment><comment><USER18> > The only good thing I can say about this product is that it does not create > an MX record for your domain, upholding the "no MX" in the name.

Haha

</comment><comment><USER19> The real story here, is that if you try to set up your mail server so that you can send mail to a microsoft email server such as live or hotmail, you eventually end up here where they ask for a bribe: [https://returnpath.com/solutions/email-deliverability- optimi...](https://returnpath.com/solutions/email-deliverability- optimization/ip-certification/#)

Nomx may be terrible, but it's not their fault you can't send mail to hotmail.com

Edit: here is the price list for sending mail to hotmail.com [https://returnpath.com/wp-content/uploads/2015/06/Return- Pat...](https://returnpath.com/wp-content/uploads/2015/06/Return-Path- Certification-Pricing-US.pdf)

<comment><USER20> That's strange: I have my own hosted mail server (on a static home IP) and I haven't had a problem with hotmail (but I've got DKIM, reverse DNS, and SPF configured)

<comment><USER21> Can you prove this? I've also set up DKIM, reverse DNS, and SPF, but Microsoft places mail sent from my AWS box straight into the spam folder. Every other email provider that I've tried has been able to receive my email correctly. Microsoft is the only one asking for a bribe to do so.

I've even tried to contact them by phone and their support forum. On the phone they told me that this is a "feature": all mail goes to spam folder until the client whitelists the sending address. This is false, and on their support forums I was told that my static IP from Amazon "is not eligible for appeasement" or something like that.

When you look at what Microsoft has done with Skype and Windows, it's fairly obvious that they don't care about security. Even so, I find it especially egregious that they are offering a "pay to spam" service while at the same time knowingly blocking legitimate email.

<comment><USER22> Are you sending from AWS SES?

You should not be able to originate any mail from EC2.

<comment><USER21> I'm sending from EC2. Why do you say that?

<comment><USER23> A LOT of spam originates from EC2, to the point that many major email providers have blocked all of EC2.

<comment><USER21> This is not true. I can mail everywhere except Microsoft.

</comment></comment></comment></comment></comment></comment></comment><comment><USER24> From the nomx respone:

> Contrary to the blogger's claim that this was an easy, simply hack, in fact, > the blogger couldn't make the code work and requested other participants to > support his attempts and publicly stated so on his blog. The "payload" he > developed was from a third party named Paul.

That's embarassingly bad logic. The fact that this particular guy wasn't an expert at XSS doesn't make the hack hard, and the fact that it exists _at all_ is the issue. What a bunch of fuckin' jokers.

</comment><comment><USER25> If i understand this correctly, the device is (apart from being the least secure thing ever) basically useless at it's function, since it doesn't support SPF/DKIM/DMARC and you can't get it to use HTTPS and as such will bounce off every single correctly configured email server in the world?

If i remember correctly, when i tried to setup my own email server with my domain on a VPS box, i had to go through the whole nine yards of getting a letsencrypt cert and setting up lots of voodoo stuff before i could send mails to anyone but myself.

Also, how are you supposed to use this at home at all, if most residential ISPs (at least here in germany) block any Port 25 traffic?

<comment><USER26> Yes to everything you said.

D:

Australian ISPs kill anything outbound on port 25 also.

</comment></comment><comment><USER27> I really can't tell whether this is an outright scam, or an earnest attempt by someone completely unqualified (and completely unaware that they're unqualified, per Dunning and Kruger).

<comment><USER28> At the very least there was bad faith from trying to stall and making false claims about updates and disclosure to costumers in the e-mail chain between Scott and them.

I'd also doubt they "had two of the largest security firms provide remote and "in hand" vulnerability assessments on nomx", or else they just completely ignored their advice.

</comment></comment><comment><USER29> > "We've advised them that they should not use the nomx admin while surfing > any other sites which contain malware or were otherwise compromised"

That's so hilariously misguided I don't even know where to start!

<comment><USER3> They ripped that straight out of the OWASP CSRF cheat sheet, under "Personal Safety CSRF Tips for Users". Yep, clearly nomx's issues are all just user education issues.

[1] [https://www.owasp.org/index.php/Cross- Site_Request_Forgery_%...](https://www.owasp.org/index.php/Cross- Site_Request_Forgery_%28CSRF%29_Prevention_Cheat_Sheet#Personal_Safety_CSRF_Tips_for_Users)

</comment></comment><comment><USER30> "30 March 2017 22:28: Will claims to have a sent a response and has forwarded the same email to me again which doesn't arrive."

"31 March 2017 16:52: Asked for confirmation of receipt of earlier email given apparent email issues.

4 April 2017 11:13: Asked for confirmation of receipt of earlier email given apparent email issues. "

Wonder why...

</comment><comment><USER31> GCache: [https://webcache.googleusercontent.com/search?q=cache:3TT35M...](https://webcache.googleusercontent.com/search?q=cache:3TT35Mz0PgMJ:https://scotthelme.co.uk/nomx- the-worlds-most-secure-communications- protocol/%2Bhttps://scotthelme.co.uk/nomx-the-worlds-most-secure- communications-protocol/&client=firefox-b-ab&hl=en&ct=clnk)

</comment><comment><USER26> While I have a summary post elsewhere in here, at the risk of being a bit spammy I'm double-commenting the following bit:

The device is designed to send TLS-encrypted mail from nomx device to nomx device on port 26, BUT IT IS ENCRYPTING USING THE DEFAULT Postfix "snakeoil" TLS CERTIFICATE.

</comment><comment><USER32> Can't wait for their $10k bounty program to go public.

That will be an easy win for whoever submits first.

<comment><USER16> The article mentions that the bounty private key(s) would be embedded within the device, so I don't think a submission would be necessary.

<comment><USER33> Now that's just double stupid. Just dump the flash and done.

</comment></comment></comment><comment><USER34> Many years ago, I've been working on similar (but better ?) SMTP security device [1], that was doing on-the-fly email encryption by catching outgoing SMTP connections and encrypting their content. One only had to setup some keys and stick in in the outgoing network and it worked - like PGP, but without the need to setup it on every device. But, they are already out of business now...

[1] [https://www.scmagazineuk.com/securecoms-launches-sme- encrypt...](https://www.scmagazineuk.com/securecoms-launches-sme-encryption- products/article/562199/)

</comment><comment><USER35> This (statistics on the nomx rebuttal pages) must be coming from some kind of alternate universe:

 _> For Media - Some statistics:

Number of nomx accounts that have been compromised since inception: 0

Number of Gmail accounts that have been compromised in the United States (from 2014): About 5 million to 24 million depending on source_

How about the TOTAL number of (respectively) nomx accounts and gmail accounts (from 2014)?

I mean, 0/(something) is undoubtedly a smaller number than 5-24*10^6/(a very HUGE number), but maybe the (something) is so little that the target in itself is irrelevant...

</comment><comment><USER16> This is great! I've always wanted a step-by-step guide on how _not_ to do things.

</comment><comment><USER36> Interesting findings. Though I didn't get why the author concentrated so much on the security issues of the UI while the real issue is that the whole thing is snake oil. I mean - what if the UI was great, had https and there were no CSRF vulnerabilities? Would this be considered a secure product?

</comment><comment><USER26> I STRONGLY recommend reading just the first bullet point below.

I'm wondering whether this is someone running a scam or whether they don't fully understand technology and some evil tech has taken _them_ for a ride. It's that bad.

Some paraphrased/elided highlights from the article:

\--

Practicality as a secure mail device:

\- The TL;DR of the "unbreakable security" is that the device sends TLS- encrypted email on another nomx device listening on port 26... _USING THE DEFAULT "snakeoil" Postfix TLS CERTIFICATES._

\- _The device sends from port 25._ Or rather, it tries to - it worked for the post author, but I can personally say this would not work for me; my ISP blocks port everything outgoing on port 25.

\- _The device tries to relay mail from a residential IP._ Predictably, all commercial email systems shut this down the moment they see it. Hotmail has the decency to actually kick the email back; other providers seem to just silently drop it.

\- _The device will immediately put your IP on DNS blacklists because you are sending mail that looks 100% like spam._ These blacklists are used by a variety of online services so this is likely to catch up with you in a big way eventually (one thing I just wondered is whether Google checks your IP this way when deciding how complicated to make the captchas it sends you).

\- When you set up a link to another nomx device (it calls this a "handshake"), you have to do it by IP address. There is no mechanism to autoupdate the remote IP (I do acknowledge such a system would be mildly nontrivial to put together, but I think this is already at the "doing it wrong" stage and this type of solution is not what is needed here).

\--

Security considerations:

\- The default credentials are "firstname.lastname@example.com" \+ "password" and there is no requirement to change this upon login.

\- The device is so full of vulnerabilities it's possible to pwn it by simply visiting an arbitrary malicious Web page (from any web site on the Internet) that scans your network to find the device - once that's done the malicious page can fire off a series of form submissions (probably also doable via XHR) to gain a login cookie, _create a new admin user that will not be visible because the device is only capable of listing one admin_ , and then...

\- With the device pwned, it's possible to take it over completely, create arbitrary incoming email addresses, and attempt to send mail from the device, from your IP. Your computer doesn't even need to be on for this to work, obviously. I say _attempt to send mail_ because most of it will be blocked, but you could easily take someone down by sending highly offensive mail to a provider that let the email through - bam, your IP is on file as having sent the email.

\- Thunderbird required repeated manual verification of the device's TLS certificate (something the device purports not to require!).

\--

Software versions:

\- Raspbian GNU/Linux 7 (wheezy) - last updated 7th May 2015

\- nginx version: nginx/1.2.1 - released 5th June 2012

\- PHP 5.4.45-0+deb7u5 - released 3rd September 2015

\- OpenSSL 1.0.1t - released 3rd May 2016

\- Dovecot 2.1.7 - released 29th May 2012

\- Postfix 2.9.6 - released 4th February 2013

\- MySQL Ver 14.14 Distrib 5.5.52 - released 6th September 2016

The author received no response to his requests for updated versions of the software.

The device also has no autoupdate mechanism, and there is also no mention of such a mechanism being in development.

\--

Other thoughts:

\- The device uses GoDaddy for dynamic DNS. I'm curious why this is so bad; is it because GoDaddy DNS doesn't update rapidly?

\- This kind of reminds me of [http://thedailywtf.com/articles/The-Expert- System](http://thedailywtf.com/articles/The-Expert-System)

</comment><comment><USER37> Website appears to be down as of now (10PM GMT+1)

</comment><comment><USER38> TL;DR:

It's $199 to $399 for a plastic case literally just containing a Raspberry Pi 3 Model B, running an outdated Raspian, and the software stack is extremely poorly developed. eg: their "secure handshake between devices" is basically two devices serving SMTP on port 26 instead of port 25.

<comment><USER39> Its port 26 enforces TLS though.

<comment><USER13> But doesn't bother to check if the certs (local and remote server) have been signed by a trusted authority. Nor does it attempt to pin these certs.

It provides encryption, but no authentication nor authorisation. In short an ever so slight improvement over normal SMTP.

<comment><USER26> It's actively ten thousand times worse than that. From the article:

> _The device uses self-signed certs throughout and they aren 't even device > specific. It's using the default ssl-cert-snakeoil.pem and ssl-cert- > snakeoil.key in the Postfix config._</comment></comment></comment></comment>


"Software Engineer" vs. "Member of Technical Staff" - <AUTHOR> I've been trying to figure this out for a while now and I haven't been able to really find an answer to these questions.
Is there any implied differences between "software engineer" and "member of technical staff"?
Is there any hierarchy of roles for software engineers? <comment><USER2> I believe in some companies, when you first join and they don't yet know how well you will do, your title is "member of technical staff"

Then after a specific period (e.g. 6 months), after the first performance review cycle, your level gets decided, and you become a "software engineer"</comment>


We could build something revolutionary: how tech set underground music free - <AUTHOR> https://www.theguardian.com/music/2017/nov/22/we-could-build-something-revolutionary-how-tech-set-underground-music-free <comment><USER2> Absolutely nothing in that article is related to underground at all. From the styles of music through to the VC-funded platforms.

Underground is record labels owned by a couple of friends pressing 250 records globally and distributing them by any means possible.

Underground is people putting all their spare money into putting on parties/gigs in obscure venues for the 100 other people in their city that like their particular niche of music/art.

Underground is not sitting in your room recording lip-sync videos and then sending them out over a platform used by millions.

<comment><USER3> Here's half a million songs going back a few decades by a community of artists so underground they don't even play gigs.

[https://modarchive.org/](https://modarchive.org/)

<comment><USER4> It's good to see somebody else that visits The Mod Archive. Virtually nobody that I know is aware that it exists.

<comment><USER3> And there's some really great music there as well. Lots of crap of course, but the ratings are usually pretty reliable.

</comment></comment></comment></comment><comment><USER5> Summary:

if you are an artist performing live shows and you are interested in building a cult of followers you can do so, and no one will stop you. If your performances and merchandise fees break through a threshold of profitability, you are designated a success. You can use digital tools like YouTube and Facebook to do this, but engagement is low. There are new companies and digital tools that are building engagement by facilitating addiction and game mechanics to make artists money. Record companies are bad, and they are not the way forward.

</comment><comment><USER6> Very interesting article- I do think Chance the Rapper is an outlier but still a potentially repeatable business model for the 'next' star.

Interestingly it requires the artists to be digital/business savvy which may select for those artists over those with better music, but that's always been the case to an extent.

<comment><USER7> > I do think Chance the Rapper is an outlier

Recently it seems to be the path to success as a hip hop artist, not the outlier case. Beyond Chance look at 21 Savage (who blew up before he signed to Epic), Lil Peep, hell, even Run the Jewels is independent.</comment></comment>


Waiting for Bitcoin - <AUTHOR> http://blog.instavest.com/waiting-for-bitcoin

<comment><USER2> This: When internet adoption began to take off in the 1990s, it came with skeptics and an endless series of questions. In 1995, Newsweek published an article titled "Why the Web Won't be Nirvana," stating:

"Visionaries see a future of telecommuting workers, interactive libraries and multimedia classrooms. They speak of electronic town meetings and virtual communities. Commerce and business will shift from offices and malls to networks and modems. And the freedom of digital networks will make government more democratic. Baloney. Do our computer pundits lack all common sense? The truth is no online database will replace your daily newspaper, no CD-ROM can take the place of a competent teacher and no computer network will change the way government works."

<comment><USER3> 20 years later the visionaries have been proven to be visionaries.

</comment></comment><comment><USER4> This: When internet adoption began to take off in the 1990s, it came with skeptics and an endless series of questions. In 1995, Newsweek published an article titled "Why the Web Won't be Nirvana," stating:

"Visionaries see a future of telecommuting workers, interactive libraries and multimedia classrooms. They speak of electronic town meetings and virtual communities. Commerce and business will shift from offices and malls to networks and modems. And the freedom of digital networks will make government more democratic.

Baloney. Do our computer pundits lack all common sense? The truth in no online database will replace your daily newspaper, no CD-ROM can take the place of a competent teacher and no computer network will change the way government works."

</comment><comment><USER5> Cryptocurrency, definitely yes.

Bitcoin, hopefully not. I'm fundamentally opposed to rewarding that particular wealth redistribution scheme.

<comment><USER6> Is current wealth redistribution scheme so much better? With forced taxation, shady fractional reserve system, central banks manipulating markets, rich getting richer, etc. I don't think so.

Actually Bitcoin is very fair. Everything is Open Source, verifiable, public. There is no insiders, no trusted parties changing rules, everything is publicly know: number of coins and their distribution scheme.

The price of Bitcoin is a fair price. It corresponds to current market knowledge about it's usefulness and chances to be more/less useful (valuable) in the future. Anyone is allowed to participate, and noone is forced to participate.

People holding Bitcoin are rewarded for their risk of holding risky asset. People trading it, are rewarded for providing liquidly, people mining it are rewarded for keeping the p2p network running.

Bitcoins is the fairest game in the town. And any wealth redistribution it causes is a fair redistribution.

<comment><USER5> It's not an either-or question. The current system is a travesty; replacing it with another that rewards those with means and early adopters at the expense of others isn't any better.

</comment></comment></comment><comment><USER7> Nice article, very thorough</comment>


A doctor discovers an important question patients should be asked - <AUTHOR> http://www.washingtonpost.com/national/health-science/how-i-discovered-an-important-question-a-doctor-should-ask-a-patient/2015/03/09/ca350634-bb9c-11e4-bdfa-b8e8f594e6ee_story.html

<comment><USER2> A similar thing worked well for our customer service blunders at Enterprise. We were taught to straight up ask what the customer how we could make it up to them or what they would like -> very open-ended. They said customers aren't used to hearing that and are even more surprised when they get what they directly ask for.</comment>


Pew report: "Sex robots will become commonplace" - <AUTHOR> http://pando.com/2014/08/08/pew-report-sex-robots-will-become-commonplace/

<comment><USER2> I can't stop laughing of that shower head.

</comment><comment><USER3> I hope so--provided they aren't programmed in C/C++.

Maybe Rust or Elixir, or something safe. Certainly not JavaScript.</comment>


Crazy Idea or Billion Dollar Startup? (How to Validate Product Ideas Before MVP) - <AUTHOR> https://blog.fairytrail.app/2019/09/how-to-validate-product-ideas.html <comment><USER2> Good tips, thanks for sharing and congrats on actually launching!

<comment><AUTHOR> thanks for the support!

</comment></comment><comment><USER3> Good name for a TV show..</comment>


'Liquid gold': students make world's first brick out of human urine - <AUTHOR> https://www.theguardian.com/global-development/2018/oct/25/liquid-gold-students-make-worlds-first-brick-out-of-human-urine <comment><USER2> Now instead of just shitting bricks, you can piss bricks.

Seriously though, I wish the article had more information about material strength, time and cost. Eco-centric tech like this is great in my opinion, but is it something that's actually practical?

<comment><USER3> In the article they referenced if you want a brick stronger then a 40% limestone brick you just have to let these bricks grow a little longer. So they can be at least as strong as a limestone brick if that is any sort of reference.

<comment><USER4> Limestone is a 3 on the Mohs scale (1 = talc, 10 = diamond).

A kiln fired brick is a 5 to 7 depending on its constituent parts.

<comment><USER5> What is a beet's strength on the mose scale?

</comment></comment></comment></comment><comment><USER6> The byproduct of this reaction is a unit ammonia for each unit of urea used. Is large amounts of ammonia easier to dispose of than urea?

"When urea is hydrolysed by the urease enzyme from the microorganism, ammonia is released and becomes accumulated in the medium which then increases the pH, making it alkaline (Zoheir et al 2013)

(PDF) Integrating Biotechnology into Geotechnical Engineering: A Laboratory Exercise. Available from: [https://www.researchgate.net/publication/326113096_Integrati...](https://www.researchgate.net/publication/326113096_Integrating_Biotechnology_into_Geotechnical_Engineering_A_Laboratory_Exercise) [accessed Oct 25 2018]."

<comment><USER7> The decomposition of urea [(NH2)2CO] produces _two_ equivalents of ammonia for each equivalent of urea. It's not clear from the article how much (if any) of the ammonia gets consumed by the bacteria.

> Is large amounts of ammonia easier to dispose of than urea?

Ammonia's boiling point is -33 C, so pure urea is a gas a room temperature.

When dissolved in water, ammonia is in equilibrium with ammonium hydroxide. So the stuff can stick around until consumed by microorganism or it evaporates.

Both urea and ammonia can be used as fertilizers.

<comment><USER8> Pure urea is not a gas at room temperature.

[https://en.wikipedia.org/wiki/Urea](https://en.wikipedia.org/wiki/Urea)

<comment><USER7> Typo, that should be "ammonia."

</comment></comment></comment></comment><comment><USER9> Gives new meaning to the phrase Kidney Stones.

</comment><comment><USER10> _" world's first brick made from human urine"_ seems a bit strong.

Maybe there are even earlier ones, but this is from 2010: [https://www.treehugger.com/green-architecture/architect- grow...](https://www.treehugger.com/green-architecture/architect-grows-brick- from-bacteria-sand-urine.html)

Edit: Ahh, I guess the nuance is that the first effort used extracted urea versus actually using urine.

<comment><USER11> Yeah, I thought that was a bit humorous. It seems like the original experiments didn't want to do a field test.

</comment></comment><comment><USER12> Using liquid gold as a resource to extract valuable phosphates is a long-time practice. For instance in 2013 the Amsterdam sewage treatment plant started a large-scale installation to process urine.

Here are some ins and outs on the hows and whys:

[https://www.earthmagazine.org/article/p-phosphate-could- urin...](https://www.earthmagazine.org/article/p-phosphate-could-urine-solve- fertilizer-shortage)

</comment><comment><USER13> Could they embed urine powered batteries ([https://newatlas.com/urine- battery/42866/](https://newatlas.com/urine-battery/42866/), and many others) in the urine brick? These could bricks be part of a "smart" home/building, where every brick reports in as to its current condition, strength and mood!

</comment><comment><USER14> Time-lapsed video of what this looks like once it's in the mold would be interesting. Some more technical specs about the time involved and volume of materials would be interesting as well. Maybe there will be a follow up article?

</comment><comment><USER15> Myth Busters proved you can polish a turd, but how about a brick of piss?

[https://www.youtube.com/watch?v=yiJ9fy1qSFI](https://www.youtube.com/watch?v=yiJ9fy1qSFI)

</comment><comment><USER16> I just hope the president sees this. He could realize his greatest dream -- the wall, by using his favorite material.

</comment><comment><USER17> Good for Mars colonisation, perhaps? Piss your way to a new Villa! ;)

</comment><comment><USER18> And now we know how we'll build our buildings on Mars.

<comment><USER19> It seems like it would take a very long time for a small number of residents to produce enough bricks to build anything via this method. Then again, it could still be more practical than utilizing local materials, particularly in the very early stages of colonization.

</comment></comment><comment><USER20> Youtube: World's sharpest urine knife.

</comment><comment><USER21> Imagine the smell of that :)</comment>


A Decade of Sun - <AUTHOR> https://www.youtube.com/watch?v=l3QQQu7QLoM <comment><USER2> This is not about Sun Microsystems :-(</comment>


How Elementary School Teachers Biases Can Discourage Girls from Math and Science - <AUTHOR> http://www.nytimes.com/2015/02/07/upshot/how-elementary-school-teachers-biases-can-discourage-girls-from-math-and-science.html <comment><USER2> In my opinion, this is the heart of the diversity problem. We spend a lot of time trying to improve the representation of adult women in tech. Wouldn't that be a whole lot easier if girls felt more comfortable growing up to become women in tech?

I'm certain it's not just girls vs boys, either. I'm convinced adults are consciously and unconsciously acting as a giant sorting hat and shuffling children into preconceived interests, activities, and careers based not just on gender, but on ALL those things we like to hope don't matter but stubbornly persist in mattering: gender, race, ethnicity, wealth of parents, religious preference of parents, attractiveness, height, voice tonality, presupposed future sexual orientation, and on and on.

We do have a really cool experiment that just started this year, though: a mandatory computer science curriculum in Britain[1]. It'll be a lot harder to convince impressionable kids that they are no good at computers (because they "don't look like it") when everyone is learning it from kindergarten on. It's unfortunate that we'll have to wait another 10 - 15 years to see what effect that will have, though.

[1] [http://pando.com/2014/02/10/by-next-year-coding-will-be- mand...](http://pando.com/2014/02/10/by-next-year-coding-will-be-mandatory-in- british-schools-what-the-hell-america/)

<comment><USER3> Been lurking for a while, figured this'd be a good place to make my first post.

I'm a trans woman (MtF). This isn't the first time (and it won't be the last) I've observed something about gender stereotypes just from having lived on both sides.

One stereotype that's widely known in the trans community is that a disproportionately large percentage of trans women work in tech (or are tech hobbyists). The "MtF CS nerd" is probably the biggest trans stereotype I can think of.

This stereotype doesn't extend to trans men (FtMs). In fact, it's assumed that the ratio of MtFs to FtMs in tech is about the same as the ratio of cis men to cis women in tech.

In the main online trans community I run in, where this stereotype is endlessly touted as being true (often tongue-in-cheek), most of us start our transitions somewhere between 18-45 and by and large is biased towards people who started in our twenties (I started at 28, myself, and I'm 30 now). People who started before or after that are really rare in that particular community (there are other communities that swing younger or older, by the way -- I'm just talking about the group I run with).

The only real conclusion is that whatever biased us towards or against careers in tech based on our perceived genders must have occurred in childhood, definitely before college and probably before high school as well. It probably happened in toddlerhood, really. There's an excellent SMBC comic on this, by the way, but I'm new and I don't know if posting a link will get this post tossed into the spam filter.

This is why I think putting pressure on companies to recruit more and more adult women is fundamentally flawed. There just aren't enough adult cis women who are interested, no matter how much any company tries to recruit. I'm also particularly appalled by attempts to demonize Linus Torvalds for not having enough women as core kernel developers: it's not his fault that people perceived as female (i.e. cis girls and pre-transition FtMs) are told as early as preschool that they shouldn't be interested in technology. Fix _that_ part of society instead of demonizing project leaders.

<comment><USER4> On the gendered toys thing, Rhesus monkeys show gender preferences for different types of toys. I'd be surprised but interested to see a follow-up paper about cross-species gender expectations forcing toy choices.

paper: [http://www.ncbi.nlm.nih.gov/pmc/articles/PMC2583786/](http://www.ncbi.nlm.nih.gov/pmc/articles/PMC2583786/)

bbc news article w/ video: [http://www.bbc.com/news/science- environment-29418230](http://www.bbc.com/news/science-environment-29418230)

<comment><USER5> This study was done on _adult_ monkeys. And AFAIK, in humans the differences in neural connectivity are _negligible_ until testosterone kicks in. On the other hand, in adults, gender differences are drastic.

<comment><USER4> > This study was done on adult monkeys.

I think we read Table 1 differently: [http://www.ncbi.nlm.nih.gov/pmc/articles/PMC2583786/table/T1...](http://www.ncbi.nlm.nih.gov/pmc/articles/PMC2583786/table/T1/)

> And AFAIK, in humans the differences in neural connectivity are negligible > until testosterone kicks in.

Possibly, I'm not a biologist, but the 4th paragraph of the intro is interesting in that regard:

"Prenatal hormone exposure is known to influence children's toy preferences as girls with congenital adrenal hyperplasia (CAH), an inherited enzymatic defect....show more boy-typical toy preferences than do their unaffected sisters or control girls....This preference is evident in CAH girls who look like and are reared as girls ... and despite the fact that most of these girls have typical female gender identity... When parental socialization was explicitly studied, one study found that CAH girls are more strongly encouraged to play with female-typical toys than are unaffected female siblings, yet they still show a masculine toy preference.... Thus toy preferences appear sensitive to prenatal androgen exposure..."

<comment><USER5> You are right. My bad. I've only briefly looked to confirm that the study was not specifically targeting juvenile monkeys. But in fact 52% (8+10)/(11+23) of monkeys were juvenile. Still, half are post puberty and taking into account "females reach puberty around age three while males are sexually mature by age four" (Rawlins & Kessler 1986, that probably diminishes this 52%. And as per the study itself "Overall sample size precluded analysis of individual age groups." So, I still wouldn't be too happy to transfer that results into human children domain.

</comment></comment></comment></comment></comment></comment><comment><USER6> > In math, the girls outscored the boys in the exam graded anonymously, but > the boys outscored the girls when graded by teachers who knew their names.

I get that there's such a thing as "partial credit," but seriously? What kind of math are they teaching?

<comment><USER7> one issue could be the study design. I can't quite tell from the NYT writeup, but it seems that the test graded by the teacher was a _different_ test than the one graded by outside teachers. That could definitely have an impact

<comment><USER8> Fulltext: [http://sci- email@example.com@gener...](http://sci- email@example.com@generic-7242DB741D24.pdf)

Correct, the tests are _very_ different:

"We measure teachers' gender biased behavior by comparing their average marking of boys' and girls' in a "non-blind" classroom exam to the respective means in a "blind" national exam marked anonymously.

To construct a measure of teachers' biased behavior we combine the scores from the GEMS 5th grade external exam with those of internal exams held in the middle of 6 th grade. The GEMS test scores is a "blind" assessment since the GEMS exams are graded by an independent agency where at no stage are the identity and gender of the student revealed. In contrast, the internal exam is graded by the student's teacher and therefore it is a "non-blind" assessment. We assume that this measure of teacher's stereotypes captures her/his overall perception about gender cognitive differences and we use it as a proxy for her/his level of prejudice and discriminatory behavior in class . 15"

(The paper is surprisingly quiet about what the "internal exams" actually are.)

<comment><USER9> Doesn't matter how badly the study was constructed, the mission has been accomplished. Coming soon to a recommended article on Medium near you.

<comment><USER8> Yeah, I've learned to not expect anything good of any study which is about gap-busting. The topic draws terrible studies like flies.

(Seriously, it's kind of boggling going back and looking. The _entire_ study rests on the exact comparability of the two sets of tests allowing claims of teacher bias by gender to then give later causal effects... and not only can they not establish the comparability in any remotely rigorous way, they don't even tell you what one set really is!)

</comment></comment></comment></comment></comment><comment><USER10> As a guy I find it hard to believe that sexism still exists but then my wife just got back from an interview where someone asked her if "Being a mother will negatively impact her science".

Now that I have a daughter I will work hard at home to let her know that she can be whatever she wants, but I feel bad for the kids that can't get that reinforcement at home.

</comment><comment><USER11> Just because I'm surprised this link hasn't already been dropped into this discussion:

[http://slatestarcodex.com/2015/01/24/perceptions-of- required...](http://slatestarcodex.com/2015/01/24/perceptions-of-required- ability-act-as-a-proxy-for-actual-required-ability-in-explaining-the-gender- gap/)

</comment><comment><USER12> Anecdotal evidence, but _my_ primary school teacher's refrain was "math is hard!". Not exactly helpful, and it was puzzling to me as a primary schooler since, you know, addition and subtraction aren't so bad. I still remember it because she said it so damned often.

If we could reach people like _her_ and make the impression that such attitudes are detrimental to the future of every child she teaches, perhaps more progress could be made.

</comment><comment><USER4> The last time this topic came up, buried in the comments somewhere I found this gem: [http://denisdutton.com/baumeister.htm](http://denisdutton.com/baumeister.htm)

It's controversial, but it has some ideas not usually tossed around in these debates. It certainly brings at least as much to the table as an article suggesting a small study done in Israel explains America's STEM gender differences.

</comment><comment><USER13> Today I read an article that Swedish politicians are arguing against gender equality in Elementary School.

Male elementary teachers not only represent a small 3%, but has extraordinary standards put on them, where people expect them represent the male gender. Additionally, male elementary school teachers are looked at with suspicion, where co-workers wonder if newly employed male teachers are sexual predators or just failures for not picking normal male jobs. Unsurprising, this lead to over 50% of graduates who enter the work force to switch job within the first year.

This is the context and environment this NY times article exist in. It should come as no surprise that an environment this toxic to gender equality produces biases.

</comment><comment><AUTHOR> Apologies if there's a paywall -- you should be able to Google the URL and get it from there. Relevant pull quote:

 _In math, the girls outscored the boys in the exam graded anonymously, but the boys outscored the girls when graded by teachers who knew their names. The effect was not the same for tests on other subjects..._

And the original paper if you have access to NBER: [http://www.nber.org/papers/w20909](http://www.nber.org/papers/w20909)

<comment><USER14> Until I read the article I was having a hard time reconciling the headline (elementary school teachers) with your post, since I don't recall many elementary school math tests featuring questions where partial credit was possible, but the study actually covers grade 6 through high school, which makes way more sense.

Since I can't see the paper: did they type these up, or maybe have one person re-write all of the papers going to both graders? Maybe things are different in Israel (where the study was conducted) but handwriting would have given a stranger at least an 80% chance of correctly guessing the sex of the test- taker in the schools I attended.

</comment></comment><comment><USER15> Interesting how the mainstream media keeps doing circles around these issues.

When you start with flawed assumptions, you will never get an accurate solution. The hypothesis that vicious and systemic oppression of females since birth is keeping them out of Computer Science is hardly sound. While there may be an element of discrimination in all professions that tend to be dominated by one sex, I think it's time to look a little more closely at the situation.

Humans are a sexually dimorphic species. This means that on a genetic and physiological level, our sexes are distinct barring genetic anomalies such as Klinefelter syndrome and other rare conditions. Now as with anything that deals with biology, there is a massive amount of variation within each classification category, i.e. sex. This being said, we can and have done studies measuring the distribution (mean and variation) of tendencies for both sexes to find that they are quite distinct at a physiological level.

This means that when comparing the mean male adult brain to the mean female adult brain, the neural architecture is quite distinctly different. This has natural consequences in our behavior, predispositions, illnesses and life outcomes.

For example, it is found that the mean male does better on visuospatial tasks than the mean female, whereas females tend to do better on verbal tasks. Now all the usual disclaimers apply about cognitive testing biases and sample populations, but there is a slight empirical difference.

This is why in certain Nordic countries which pride themselves on being the most sexually egalitarian, the polarization of traditional careers is at a record high. For example, comparing two equally lucrative professions, on average men tend to study engineering and females tend towards nursing. As these countries have worked tirelessly to eradicate discrimination from their education, social, legal and professional systems, the only variable left to control for is personal preference which tends to gravitate towards sexual averages.

In conclusion, I find it often helps to frame a problem from an empirical point of view before assuming the cause and prescribing a treatment a priori.

Now, are all the developed countries in the world at the level of the Nordic countries in terms of sexual egalitarianism? Most likely not, though I doubt they're exactly Saudi Arabia either, which some of the more radical pundits tend to vociferously imply publicly at every opportunity.

Empirical and rational thought are gifts left to us by our ancestors after thousands of years of toil. I find it disappointing that we constantly fall into these irrational situations simply due to knee-jerk emotional outrage over perceived injustices. I hope one day rationality and empirical thought become the core education platform for mankind.

<comment><USER16> But this line of reasoning isn't rooted in empiricism at all. Your factual premise, sexual dimorphism, is true, and the end result, underrepresentation of women in certain careers, is readily observable, but you don't even attempt to provide a mechanism that links the purported cause to the observed effect.

To turn the empiricism around a bit: the gender disparity among those with perfect SAT Math scores is about 2:1, and is less in the whole 700-800 range. Given that most engineering programs draw from the 600-800 range, how on earth do you explain the 4:1-5:1 disparities you observe in these programs in the face of a much lower disparity in mathematical aptitude in the relevant range?

Moreover, if the disparities are rooted in biology rather than sociology, how do you explain why the percentage of CS degrees awarded to women is half of what it was 30 years ago? [http://www.randalolson.com/wp- content/uploads/percent-bachel...](http://www.randalolson.com/wp- content/uploads/percent-bachelors-degrees-women-usa.png).

<comment><USER15> > To turn the empiricism around a bit: the gender disparity among those with > perfect SAT Math scores is about 2:1, and is less in the whole 700-800 > range. Given that most engineering programs draw from the 600-800 range, how > on earth do you explain the 4:1-5:1 disparities you observe in these > programs in the face of a much lower disparity in mathematical aptitude in > the relevant range? Moreover, if the disparities are rooted in biology > rather than sociology, how do you explain why the percentage of CS degrees > awarded to women is half of what it was 30 years ago?

This is perfectly in line with the statement I made. Just because females with high SATs are more than capable of doing CS, doesn't mean they are interested in it as a career. This is most likely due to their innate predispositions for other types of work. This may be tough for lifelong programmers to understand, but the majority of computer scientists see this field as just work and nothing else. There is none of that Zuckerbergian passion that drives most programmers.

A great example is a guy like Elon Musk, vs a guy like Linus Torvalds. Both undoubtedly prodigious programmers, but one kept doing it even when he no longer hand to, and the other jumped ship onto his other, more pressing, passions.

From a personal example, a close female relative of mine is a brilliant girl who has outperformed me at every academic level. She chose to specialize in the medical field, because it suited her interests more. She is incredible at math and would have made an excellent programmer, but she just doesn't have a passion to spend the rest of her life doing it.

What my argument boils down to is this: girls and boys are biologically different, and thus they enjoy doing different things. Why are certain vocal groups trying to force them into roles which they may not desire? Equality of opportunity will not yield equality of outcomes when individual choices vary.

Edit: removed ad hominem

<comment><USER15> > What your argument is missing is any attempt to connect an empirically > observable difference to the empirically observed disparities between > fields.

Free will.

</comment></comment></comment></comment><comment><USER17> To those who can access the paper -- how large was the discovered effect?

</comment><comment><USER18> this seems very HN worthy ... let's turn this place into shit also -_- ... also im going to leave this here for all those "concerned" people ... [http://ideas.time.com/2013/02/06/do-teachers-really- discrimi...](http://ideas.time.com/2013/02/06/do-teachers-really-discriminate- against-boys/)

<comment><USER18> I see "triggered" people down-voting ... lel</comment></comment>


Show HN: Debug C# in web browser - <AUTHOR> http://duoco.de/samples/webgl/index

<comment><USER2> I love this trend of building compilers for existing languages that target Javascript. What you get in comparison with Javascript are saner languages that aren't just a prettified Javascript - completely different type system, awesome standard libraries, packages, saner semantics overall. I'll be checking this compiler out.

<comment><USER3> I don't understand why people love these loosely/dynamically typed languages like Ruby or JS. I'd much rather a C# or Java. And Haskell is leagues ahead of the rest.

If you haven't tried Haskell. Let's just say it has no nulls and no mutable state. If that doesn't whet your appetite :)

</comment></comment><comment><USER4> What kind of sorcery is this? :| _Throwing TypeScript away and making room for this shiny new thing_

<comment><AUTHOR> :)</comment></comment>


Seagate Announces 12 TB HDD: 2nd-Gen Helium-Filled HDD - <AUTHOR> http://www.anandtech.com/show/11199/seagate-announces-enterprise-capacity-v7-12-tb-hdd <comment><USER2> Of course, Im gonna need three, because backing one of these up to the cloud from my home adsl would take (tap tap tap, calculate) 3.5 _years!_ (sorry cperciva, not gonna tarsnap this even at picodollars per gigabyte!)

(fortunately, it'd only take 3-4 months to bittorrent down all those, ummm, linux ISOs...)

<comment><USER3> > sorry cperciva, not gonna tarsnap this even at picodollars per gigabyte!

Oh, I would, but I guess you meant per byte.

At current rates it's $3K monthly to keep a backup of this HDD on tarsnap and that's not including bandwidth. That's six 10TB drives.

I don't mean to discourage from tarsnap though. Cloud storage is unfortunately still pretty expensive, and most people are probably only truly paranoid about much less than 1GB of their data.

<comment><USER4> Why don't just use Arq (encrypted cloud backups for Win+MacOS, $49) and Amazon Cloud Storage (unlimited storage for $59 a year)?

I've got terabytes backed up, no issues at all.

<comment><USER3> Because I had no idea about this Amazon unlimited Cloud Storage, thanks! Need to read the fine print though, home DB snapshots forever sounds really great. Plus there's not much to save space on their side if I encrypt them first. But even without it, I trust Amazon to keep my photos secure more than I trust CrashPlan which already have lost my data once (yes I think it's worth repeating, and no it was not PEBKAC, they admitted it and all they could do about it was "sorry").

edit: I wonder if Amazon goal with this was to get their hands on as many photos with their full metadata as possible (for training).

<comment><USER5> Interesting. Was this data loss of CrashPlan announced publicly? Did it affect more users?

It's concerning to hear, since I know people using it for backups.

<comment><USER3> I'm not aware of it. But you know, in some other company (don't even know which) I remember a story where after the data loss the CEO contacted the user and tried to do whatever he can including sending hard drives to speed up uploading new copies.

In my case it was 90GB, a whole single machine. The fact that they were pretty causal about it, is worrying. But I still use them for some use cases because they have unlimited storage with software for Linux, although I don't depend on them.

Quote from the support ticket:

"I have looked again for your data, but we are unable to locate the archive anywhere in our system.

I am sincerely sorry that we have let you down as there is not a reason that I can find that this data should not be here.

If there is anything that I can to for you, please do not hesitate to ask and I will do so."

</comment></comment></comment></comment></comment></comment><comment><USER6> Seagate also has a 60TB SSD: [https://arstechnica.com/gadgets/2016/08/seagate- unveils-60tb...](https://arstechnica.com/gadgets/2016/08/seagate-unveils-60tb- ssd-the-worlds-largest-hard-drive/)

<comment><USER7> What can they fit in a 5.25" enclosure?

I always wished a 5.25 mass storage HDD would come back on the market. How much would those hold relative to this?

Hm, I'm guessing about 2.5x more data per platter, about 50% more platters... 45GB?

<comment><USER8> Just put more drives into the box. You don't want bigger disks because of how fast they spin.

The only 'obvious' improvement you can make is having more arms or figuring out some way of micro-aligning multiple heads at the same time on a single arm. There's not much benefit from larger single units.

<comment><USER9> SSDs spin?

<comment><USER8> The post I replied to was about hard drives.

You can already fit way too much SSD into a 3.5 inch drive, and nobody will ever buy it because they want more ports and performance per dollar. There's no benefit for either technology to go up to 5.25 inches.

</comment></comment></comment></comment></comment><comment><USER10> Any sense of how much helium will permeate through the grain structure of the drive enclosure during its lifetime?

<comment><USER11> Does helium go through metal?

<comment><USER12> No seal is ever perfect, that's the concern. Plus helium, being monatomic, is able to jam into tinier holes than things like oxygen, nitrogen, or water vapour.

<comment><USER13> I've asked people who used the first gen He drives because it's an obvious worry, and the consensus seems to be that they're at least as reliable as conventional drives. MTBF doesn't seem unusually bad, and can even be better than some trad designs.

<comment><USER14> This is different than the typical failure scenario though, isn't it?

You might have a few drives with bad seals that fail early. But say the majority are sealed properly, but the helium still leaks out at x small rate over time, you might have almost all the drives suddenly fail at around the same time after say 6 years or whatever.

I don't think you can really know if they're truly reliable in that sense until you can take one that's been sitting one in a drawer for 10 years and plug it in.

<comment><USER12> A company like Backblaze is bound to find out before the consumers do but I have a feeling it'll be fine. Keeping gas inside of something isn't much harder than keeping it sealed enough that dust stays out.

A high-altitude environment might put more pressure on the seals than other places, that _could_ shorten the life-span, but other than that it shouldn't be a huge deal. Most drives have a commercial life-span of no more than 4-6 years anyway. After that you're on borrowed time.

</comment></comment></comment></comment></comment></comment><comment><USER7> EIGHT platters? More platters more failures and heat, isn't that right? Or does He change the equation on that?

<comment><USER15> Helium is an excellent thermal conductor so it should move the heat around pretty well.

<comment><USER16> Interesting: found this table:

[http://www.engineeringtoolbox.com/thermal-conductivity- d_429...](http://www.engineeringtoolbox.com/thermal-conductivity-d_429.html)

Big difference between different gases.

But, check this out. Helium also has a high heat capacity. Table on same website:

[http://www.engineeringtoolbox.com/specific-heat-capacity- gas...](http://www.engineeringtoolbox.com/specific-heat-capacity-gases- d_159.html)

Six times the conductivity of nitrogen (0.142 to 0.024) and five times the heat capacity: 5.19 to 1.04.

Big conductivity and capacity should translate to "convective cooling monster gas". :)

<comment><USER17> This is misleading. Helium has a higher conductivity and heat capacity than nitrogen _per unit mass_ , but since helium has such low density, the heat capacity and conductivity per unit volume at atmospheric pressure is less than nitrogen.

<comment><USER18> While it's true that helium will have a lower practical heat capacity due to lower density, it still has far higher thermal conductivity than air at the same pressure.

[http://www.engineersedge.com/heat_transfer/thermal- conductiv...](http://www.engineersedge.com/heat_transfer/thermal-conductivity- gases.htm)

<comment><USER19> Why does this chart show nitrogen < helium while the other is opposite?

</comment></comment></comment></comment></comment></comment><comment><USER20> I know a few folks who use these, their applications usually involve a lot of them, high in the atmosphere (in flight or remote observatories on mountaintops) where downlink is prohibitive. Any other realistic use cases? Undersea maybe? But space isn't at quite such a premium there.

<comment><USER21> Delimiter has $10/mo "bring your own drive" storage plans. Just buy this drive and ship it to them and share it with a VPS or cheap server there and you can store a lot of media for a cloud Plex server

<comment><USER22> When I looked [1], it reads as if they have an 8 TB cap on this service. That is, you can ship them any drive, up to 8 TB, to plug in and run at $10 per month. It sounds like their pricing is predicated on some kind of assumed Watt-hours per TB.

It would be interesting if someone offered a similar plan, but priced on energy consumed instead, giving incentive for managed storage arrays that power down drives that idle (for some algorithmically-derived definition of "idle", trading off against projected lifespan of the device due to increased power cycling), and other energy-saving practices. Slices up the granularity of cloud hosting even finer.

[1] [https://www.delimiter.com/slot-hosting/](https://www.delimiter.com/slot- hosting/)

</comment></comment></comment><comment><USER23> Hum. I am thinking about ordering a new FreeNAS Mini (the 8 bay one). I was going to get the 6TB drives....

So right now I have 3 copies of everything.

1\. Masters are on 4 bay FreeNAS mini (ZFS baby!) 2\. Rsync to Thunderbolt drive on desktop (well laptop but...TB monitor with drive attached). 3\. Everything goes up to Backblaze auto-magicly.

<comment> matthew-wegner I guess you might be buying something for your desk/living space if you're thinking of something that small.

But if you aren't (or for others who might be reading this), that's a crazy price.

In case noise and idle power consumption aren't as big of an issue:

You can get a 12-bay Supermicro with two six-core CPUs + 48GB and 12 HDD bays for <$400 shipped: [http://www.ebay.com/itm/2U-Supermicro-12-Bay-826TQ-R800-Serv...](http://www.ebay.com/itm/2U-Supermicro-12-Bay-826TQ-R800-Server-X8DTN-2x-Xeon-E5645-Six- Core-48GB-Rail-/132098335210)

Or the very popular SA120 DAS for <$300 to hang 12 bays off another machine (Dell R210II is quiet and cheap): [http://www.ebay.com/itm/Lenovo-70F10000UX- THINKSERVER-SA120-...](http://www.ebay.com/itm/Lenovo-70F10000UX-THINKSERVER- SA120-DIRECT-ATTACHED-STORAGE-1-I-O-MODULE-12-X-D-/162356290095)

(Random eBay links I found just now, have no affiliation with either of them)

<comment><USER23> Well it is for my office / man cave. I have a 19" telco rack in the corner that has as switch, the mini and a box running proxmox running VMs (minecraft server, work testing VMs, etc.). My startup buys from IxSystems for all or our stuff so I hope to get a good discount. My current 4 bay I have had for 4 years and it just works. Also the support from IxSystems has been great. I have spent so much of my life build data centers and networks, et.al. that just paying for something that works has a great deal of appeal. In 1998-2001 the rack has a ton of systems, switches and routers, now I guess I would just trade $ to spend time with the family. If I am going to build anything it will be a new Ryzen gaming setup.

</comment></comment></comment><comment><USER24> Tangential question: What's the absolute cheapest storage per byte right now for someone who doesn't care about speed? Is it like a 4TB HDD? Any specific examples would be appreciated.

<comment><USER25> > 4TB HDD

Yes. It's what Amazon Glacier runs on: [https://en.wikipedia.org/wiki/Amazon_Glacier#Storage](https://en.wikipedia.org/wiki/Amazon_Glacier#Storage)

The Backblaze blog is also a great place to learn about a large storage deployment: [https://www.backblaze.com/blog/hard-drive-benchmark- stats-20...](https://www.backblaze.com/blog/hard-drive-benchmark-stats-2016/)

<comment><USER24> Thanks! Side question, but how is Amazon Glacier consdiered affordable? For 4TB it costs $192/year... yet you could buy two 4TB HDDs at that price yourself and use one for redundancy and the other for immediate retrieval. What's the benefit of putting your data on Glacier when it costs twice as much as keeping it yourself, and probably takes longer to retrieve too?

[1] [https://aws.amazon.com/s3/pricing/](https://aws.amazon.com/s3/pricing/)

<comment><USER26> It is offsite storage. If you store your backups all in the same place, then something may happen to the place like fire, flood or burglars.

<comment><USER24> But can't you put your own hard disks offsite somewhere? Just because you're holding your own backups that doesn't mean you have to be keeping them at the same location.

</comment></comment></comment></comment></comment><comment><USER27> What are the downsides of Helium when it comes to data recovery? If it comes down to the click-of-death, surely a traditional clean-room set-up won't work.

<comment><USER28> A sealed box with glove access could be filled with Helium.

Edit: apparently it's not easy even to take the lid off of these drives :) See [https://youtu.be/ANMtvYnI1gQ](https://youtu.be/ANMtvYnI1gQ)

</comment></comment><comment><USER29> Good thing there isn't a global shortage of extractable helium.

<comment><USER30> There isn't. There is a robust market in Helium, and its price represents the cost of bothering to recover the large quantities that are produced (and generally vented) as a by product of oil extraction. We could have much more helium if we wanted to pay for it, but it's not worth it.

[https://www.forbes.com/sites/timworstall/2015/06/18/were- rea...](https://www.forbes.com/sites/timworstall/2015/06/18/were-really-not- about-to-run-out-of-helium-no-please-stop-it-were-not/#6f6f3ade13b6)

[https://www.wired.com/2016/06/dire-helium-shortage-vastly- in...](https://www.wired.com/2016/06/dire-helium-shortage-vastly-inflated/)

> In 2014, the US Department of Interior estimated that there are 1,169 > billion cubic feet of helium reserves left on Earth. That's enough for about > 117 more years.

<comment><USER31> I would consider 117 years a pretty significant shortage.

<comment><USER32> Maybe in 100 years we will have fusion power plants everywhere producing Helium. :)

We will need something because fossil fuels are not sustainable. In 100 years we should be pumping much less oil than we do today. This also means finding substitutes for all of the byproducts of oil production.

<comment><USER33> Fusion plants in the 1GW range will have at most a couple of grams of fuel in them at any given time (though looks like ITER expects to use 250 KG per year collectively - still though, not a lot).

</comment></comment></comment></comment></comment><comment><USER34> I'd few of 8GB ones and they were truely horrible. They ran super slow and then to top it of they started making noises with very light usage within months. I'm just not sure how reliable these are...

<comment><USER35> Are you sure that you had Seagate EC drives, and not Seagate Archive drives? The latter are DM-SMR and therefore poorly suited to pretty much anything doing random write I/O (e.g. rsyncing directory trees, rdiff-backup and so on). However, with the correct workload (object store, log-oriented storage) they perform admirably, especially for their price.

With DM-SMR strange noises and paranormal drive activity has to be expected since the drive can spend considerable time flushing it's PMR buffer (~16 GiB) to the shingled zones.

</comment></comment><comment><USER36> If I'm reading this right the rated workload is 45 writes of the whole disk per year[1]. Is that right? That does not seem to be a high degree of confidence by them....

[1] I divided the rated workload listed on the page by the size of the disk.

</comment><comment><USER37> I don't know about the Seagate, but the HGST He drives are super reliable. I've been using them since they exist (3 years) in growing numbers (several hundreds) and I'm still waiting for the first one to fail.</comment>


Show HN: Morphological image processing - <AUTHOR> http://danielrapp.github.io/morph/# <comment><USER2> Great article, thanks for sharing. These simple techniques can be useful e.g. when preprocessing images for machine learning.</comment>