Why you should ALWAYS CC someone - <AUTHOR>

I ran a little statistics experiment over my Gmail inbox and here are the results:
Mails that I haven't gotten replies to and mails I did have, are in ratio ~1/13. In those mails not replied to, mails WITH someone in Cc and mails WITHOUT anyone in Cc are in ratio of ~2/11.
Now, this sounded all obvious - the more recipients you address your e-mail, the higher are the chances you will get a reply, right? Right, but not quite. :)
For the last 2 months, I've created a imaginary CEO assistant e-mail account named Alex. I've Cc-ed Alex to all my mails and Alex has not directed any mails to anyone, nor received any as To recepient. Select few contacts were exempt from the experiment, but that's taken into statistical account. So, Alex has basically been completely non-interactive in all this, besides being in Cc.
After two months, mails that I haven't gotten replies to and mails I did have, are now in ratio ~1/22.
I have my own explanation of the phenomena, but I'd like to hear yours.
:{- <comment><USER2> Perhaps, over the last two months you've been running the experiment, you've been thinking about actually wanting a response and have automatically been constructing better emails that people feel they can reply to. Unlike the "brain-dump" ones I sometimes get that just don't deserve a response.

To be perfectly honest, if there's more than one person on the email, I'm more likely to hope it's not my problem...

<comment><USER3> isn't there a name for that? something like diffusion of responsibility. the same reason we don't help one person in trouble when there's more than one potential helper...

<comment><USER4> The bystander effect/Genovese syndrome: <http://en.wikipedia.org/wiki/Bystander_effect>

Perhaps the effect is quite different when there is just one other bystander, as opposed to a whole crowd of them.

</comment></comment></comment><comment><USER5> You should try different names and titles for the assistant as well:

\- Instead of Alex, what about Sarah (?)?

\- Instead of a standard name, what about a noble rank / recognizable surname (+?)?

\- Instead of CEO assistant, what about personal assistant (-?), accountant (+?), future candidate of CEO (+?)

What about varying the person(s) involved depending on the type of project? If it's a issue of numbers, involve some accountant. If it's about coding, involve a senior coder, if it's about direction of the company, involve a imaginary future board member. The possibilites are endless - just make sure you don't get caught lest you want people to think you have some kind of disorder.

Just the idea of having someone else looking over your shoulder could increase the conscientiousness a lot and keep people on their toes. If this got to become the mainstream way of doing things in some subcommunity it would be horrible though.

<comment><USER6> Alex is a good name for this, as it's gender-nonspecific. I tend to assume Alex's are female unless I know otherwise (like Lesley's or Hillary's).

<comment><USER7> I wonder what the M:F ratio of the name "Alex" is. I agree that it's not really gender specific, but I only know 1 "Alexandria", and she doesn't go by "Alex". This could be a function of my university (70:30 M:F), or it could be generational (I'm in my 20's). As a result, I tend to default to male.

Perhaps different demographics respond better to different names, based on their preconceived notions of class and status. Does a really exotic name change anything?

</comment></comment></comment><comment><USER8> If someone else is cc'ed in then people feel pressure to reply as they aren't just ignoring one person, there's a whole other person expecting a reply. Even if that person is someone they've never met, or know of.

<comment><AUTHOR> I don't think that alone can account for doubling the response rate.

<comment><USER9> Why not?

<comment><AUTHOR> Because in most of those mails it was mission critical that I receive the response. The process grinds to a halt if I don't receive response, irregardless of anyone and anything else. Both Alex and I were tied to the same process and action. The priority of it is unchanged.

<comment><USER10> "Irregardless" is a double negative (and not a proper English word).

<comment><AUTHOR> Yes and no to that. <http://en.wikipedia.org/wiki/Irregardless>

</comment></comment></comment></comment></comment></comment><comment><USER11> I haven't fully understood what you're trying to say, although i am convinced you might be onto something.

Are you saying that emails that you send to other recipients have a higher chance they'll be replied to if you CC Alex on the outgoing email?

can you tell me what the increase in replies is as a percentage?

<comment><AUTHOR> x2. I couldn't believe it.

I ran the statistics just by plain labeling things consistently, but they're pretty solid.

EDIT: almost x2

</comment></comment><comment><USER12> So, assuming one was a lazy slacker and wanted all their email to fall into a black hole for the purpose of work avoidance, have you got any advice other than "always mail people without CC?"

It's not for me you understand, it's for a friend.

<comment><AUTHOR> Yes.

Never reply-to-all.

No subject.

</comment></comment><comment><USER13> i have a client who was a small 2-person startup before they got acquired. They were both doing client facing calls and emails with big multinationals trying to sell a large product inside a typical 100-200 person division. So they created a few fake personas in order to make it look like they could afford a support staff. It's fun to reply all and know that one of the cc'ed people doesn't exist.

<comment><USER5> That reminds me of Julian Assange in the beginning of Wikileaks, making up a lot of fancy titles for imaginary personas in order to make WL seem a lot bigger than it really was.

<comment><USER14> [citation needed]

<comment><USER5> I don't remember where I read it, and I didn't manage to find it after a couple of minutes of googling. It _could be_ a fabrication but I have two memories about it that speaks against it:

1) I think it was in a interview with JA himself (could have been the DDB book though which does indeed make it less credible)

2) It was said in a jokingly and positive way, which suggests it's not disinformation spread by someone trying to get them.

</comment></comment></comment></comment><comment><USER15> > I've created a imaginary CEO assistant e-mail account named Alex

What's Alex's email address? If it's "Alex Q Alex, CEO <alex@your_company.com>" people will think the email is more important than if it's "email@example.com". Unless of course they work for or know your company, in which case they'll know the CEO isn't him. Actually I'm trying hard to think of a scenario in which the recipients don't just think you mistyped the CC, in that case.

EDIT Urgh, you said CEO assistant. I can't read. Disregard this.

<comment><AUTHOR> Alex was not CEO, he was CEO assistant, but that doesn't matter at all since no one actually sent mails from that address, and subsequently have not read the his mail sig.

The adress was alex@your_company.com

</comment></comment><comment><USER16> For your statistic to be relevant, the experiment has to be blind: You must not know to which recipients you're sending the CC-enhanced version.

Then, the name of the CC-ed recipient may be important, so you have to do this experiment with multiple "imaginary assistant emails", trying out different variations of names (male/female, first-name/full-name).

</comment><comment><USER3> Is the content being mailed the same? are you mailing the same people again before and after alex was created? are you split-testing -- 1/2 recipients get the email without alex in CC? You might need some more experiments to attribute it to pure CC.

<comment><AUTHOR> Content is the same, but that's obviously subjective. The conversations were either all with alex or without, meaning, no reply requests were sent to the pre-alex mail with alex in cc and I haven't split tested.

<comment><USER3> how about the recipients? If they had an email from you before (part of the 5K set), then might be more open to replying to the second one (in the 2k set) even if Alex was not on cc out of guilt?

<comment><AUTHOR> Most of the recipients are contacted on relatively regular basis (some daily, some weekly, some monthly).

</comment></comment></comment></comment><comment><USER17> This is interesting because you're saying recipients are _opening_ the mail and then choosing whether or not to reply after they read it. This shows e-mails are not just sitting unread.

I always figured that it was the subject line that mattered most and that once a mail was opened it was more likely they would reply.

I've experimented with improving e-mail structure. I always get a more detailed reply if I group any questions I want answering together as the final part of the mail.

</comment><comment><USER18> Very cool experiment, kudos, and i can see why it works. But did you actually say in the emails "ccing my assistant?"

Even if you didn't i am not sure how legal it would be. Just by ccing someone, you mislead the other party, eg that you have someone else in your company. Of course the argument for "don't use for important emails" is invalid, why you can mislead some and not others?

And when in doubt, i say no.

<comment><AUTHOR> No, no e-mail sent nor received had any mention of Alex in any way outside him being in Cc.

I hardly believe it's at all illegal to have an e-mail address in Cc field, even if it's imaginary. E-mail isn't Facebook. :)

</comment></comment><comment><USER19> If we are to neglect the importance of the email and solely judge on one's replying instinct when there is a email id in the cc field, then i feel i am obligated to reply as there is a certain amount of importance attached to the content of the email and its reply would be monitored by not just the sender but also the person in cc.

</comment><comment><USER20> Would you mind sharing the statistical sample size? It's hard to talk about statistics without it.

<comment><AUTHOR> It was not rigorous, but here they are...

Pre-Alex I've ran through 5 months of mails, which amounted to ~5k mails, and sorted them out (there was already label Waiting done for me). Post-Alex, in 2 months of mails the sample size was ~2k mails.

Number of e-mail addresses contacted within those 7 month period is ~70.

<comment><USER21> So you _send_ ~50 mail every (working) day? Could your sheer volume skew the result? (as in: spam people and they start to ignore you, put someone on CC and they have reason to believe it's worth reading?)

<comment><AUTHOR> I send mails every (week) day, and favor it in front of any other form of business communication.

I've sent 17 since I've started this thread.

<comment><USER22> I'm curious, what's the _average_ email of those 17? Like, what's the subject and/or value to the recipient and you?

<comment><AUTHOR> Sending stuff for approval and approving stuff done. This is a busy day, though.

</comment></comment></comment></comment></comment></comment><comment><USER23> You should re-run the experiment and make it double-blind.

<comment><AUTHOR> My sample is tainted now. Someone else should do it.

</comment></comment><comment><USER24> Pretty interesting. Before jumping to conclusions let me ask how many variables (time of day, wording of subject, frequency of sent emails, history of relationship with the recipient etc.) can you claim to "have under control"? Did you start CCing Alex for all 70 recpients? I'm asking coz there might be several explanations for the effect (assuming it's statistically significant and methodologically acceptable)

</comment><comment><USER25> _In those mails not replied to, mails WITH someone in Cc and mails WITHOUT anyone in Cc are in ratio of ~2/11._

Am I missing something, or does this have no statistical relationship to the number of replies received?

Mails replied to could have _all_ had a CC, or _none_ had a CC and the CC ration for unreplied mails still be the same, no?

<comment><AUTHOR> Yes, quite right. It's superfluous.

</comment></comment><comment><USER26> Really interesting, have you tested the effect on gmail priority inbox? it could explain a higher open rate.. and it would awesome to know that cc is part of their rankings..

[EDIT]- Also, if you all set with labels already, would you mind continuing the test with something like SigBuzz (g apps) to track open rates and keep us posted?

<comment><AUTHOR> No, I don't use priority inbox.

<comment><USER27> I think he means that it might have an effect on other people's priority inbox. It could be that if an incoming E-Mail has another recipient, GMail thinks this E-Mail might be more important and place it in the priority inbox.

<comment><AUTHOR> Yes. I misunderstood.

I know for a fact that most of those contacted do not use Gmail. Only one confirmedly does.

There might be other corporate non-public solutions that do that, on the other hand.

</comment></comment></comment></comment><comment><USER28> I would think it is because the email becomes more personal and social. More people 'collaborate'.

<comment><USER29> In particular, more social.

My suspicion is that when recipients see the cc with a name they don't know, they're suddenly in the position of making a first impression on someone that don't know yet, but will probably be working with in the future.

Another possible (related) thought -- here's an assistant who will be taking over some of these conversations, and thus they're probably talking about me (...so if I don't reply now, that's what they'll be discussing).

People care what others think of them; these people already know the original sender and have a stable relationship they don't feel will be threatened by a slow response (which easily slips into no response); but this adds a new person into the mix.

</comment></comment><comment><USER30> Has anything about your role, the work you're doing or the success or otherwise of your company changed in the past two months?

<comment><AUTHOR> Of course it has. Not significantly.

</comment></comment><comment><USER31> Are you cold-emailing folks? In a close work group, I'd have guess replies would be near 100%.

</comment><comment><USER32> the raw data would be nice - the full emails would be best,but just the sent w. cc,sent w.o. cc figures, time of message, time of response, number of reponse asking who is alex, .... anonymified recipents,... such data would be cool,</comment>


Blockstream Satellite: broadcast Bitcoin transactions and blocks from space - <AUTHOR> https://blockstream.com/2017/08/15/announcing-blockstream-satellite.html <comment><USER2> Does anyone know if there is an auto following dish that would be somewhat portable? I'm thinking of a solar powered Bitcoin station that would be mobile.

<comment><USER2> It looks like digital TV dishes meant for marine purposes would work.

</comment></comment><comment><USER3> Coming out from the blue, i don't think most people get how groundbreaking this news is. Your cryptographically secure savings are now accessible anywhere on earth. You can determine if you have been paid anywhere on earth totally anonymously.</comment>


Cowrie: a medium-interaction SSH and Telnet honeypot - <AUTHOR> https://github.com/cowrie/cowrie <comment><USER2> Caution for folks: I ran this for a few weeks and it was very informative. You see how simple many attacks really are, how many corporate assets are comprimised, and where most of the source attacking countries are.

But, there is a downside.

The downside is any site you put it on will be flagged and attacked 100x more since it registers as a vulnerable destination. After turning it off, the deluge of attacks for the site continues and I ended-up rigging a fail2ban setup to just deny if a destination port is hit. (See >> [https://mergy.org/2019/08/setting-up-a-killswitch-for- attack...](https://mergy.org/2019/08/setting-up-a-killswitch-for-attacks-with- ufw-and-fail2ban-on-ubuntu-linux/))

But, it is fun and interesting to see. Highly recommend but know the legacy on that as well.

<comment><USER2> Here is what a playmaker session looks like if you are interested

[https://vimeo.com/345068825/86f8c8f97e](https://vimeo.com/345068825/86f8c8f97e)

</comment></comment><comment><USER3> > _records the interactions of hackers_

Before you get too excited, I would say that a common mistake of inexperienced sysadmins is assuming all those brute-force attempts in the logs are results of those "hackers" and "crackers", it's not, not even a scriptkid.

All you can get by running a honeypot, like this one, is pretty boring activities by soulless, ancient worms and viruses, or automatic global Internet scanners running 24x7, not humans. Most of those are not even worth your time to block (e.g. if you only use strong password or pubkey, there are few reasons to fail2ban).

It's nothing personal. Any machine will be port scanned, vuln probed, brute forced, blindly hit with ancient "1 shot" exploits (e.g. ?file=../../../etc/passwd ). This is how the Internet works.

Another lesson is: _never_ run any unsecured webserver/service on the public Internet, _never ever_ , not even for debugging, period. Don't listen 0.0.0.0:80 if you have just installed your PHP management system, don't reset your forgotten MySQL password by disabling privilege checking before turning off networking first, if you just installed a new VPS with root password 123456 in a morning, don't wait until afternoon, change it immediately, etc.

The reason is exact the opposite, not because of "hackers" but those stupid worms. Ordinary life is boring: if you run a webserver with password 123456 (e.g. for debugging an issue on a disposable server - just for 20 minutes, you think, then you forgot it), you won't (or unlikely) to see someone hacking into your system, but it's a certainty that one of those stupid worms/viruses would infect your machine within hours, sometimes it's as quick as having your lunch. And it probably won't do much damage, but you would spend your time to reinstall the system again...

<comment><USER4> Wasn't it just a couple minutes at the hight of Windows XP?

<comment> yjftsjthsd-h Oh yeah, the "infected before you can install patches" time

<comment><USER3> Thanks for the memory. Your comment reminded me about the suggestion _" You must disconnect your machine from the Internet before/during the installation of patches."_ from 2000s computer magazines.

</comment></comment></comment></comment><comment><USER5> I opened up port 23 telnet and had it connect immediately to a playable Crowther & Woods' original adventure,

YOU ARE STANDING AT THE END OF A ROAD BEFORE A SMALL BRICK BUILDING. AROUND YOU IS A FOREST. A SMALL STREAM FLOWS OUT OF THE BUILDING AND DOWN A GULLY.

In a year and a half I had logged over a million probes. No humans at all. I would have known because they would have typed something to do with the game or tried to play it. So I must conclude no one is checking the logs of the worms either.

<comment><USER6> In a strange way, it's a bit sad that there aren't more humans out there.

<comment><USER7> Of course there are. They are all over the place. But the internet is _vast_ so you narrow down your targets using tools before you waste even a second of your time connecting manually.

If he had his telnet service return something that looked interesting (and no, not Crowther & Woods interesting), then he'd have a lot of people connecting.

</comment></comment></comment><comment><USER8> My team and i run some different honeypot solutions, and we base a lot of them off of cowrie. As pointed out by previous comments, most interactions are not so interesting, except for the fact that many cowrie based honeypots imitating IoT devices have their attackers running a simple script that pulls down a number of second stage binaries, for a variety of cpu architectures.

One downside to running software like cowrie is that generally speaking crawlers like shodan will be able to figure out that you are running a honeypot, and will have you fingerprinted in a hurry.

A better strategy for increasing the cost of an attack is actually implementing something i read about on HN called a ssh tarpit, where one can "hang" an incoming ssh connection indefinitely. A lot of the attacks on honeypots are automated, so instead of having a 3 second attack, one can waste the attackers time for about 30s to 1m on average as these scripts have very generous timeouts (and sometimes no timeouts at all).

<comment><USER9> > ssh tarpit

Interesting, like slow request attacks in reverse? Is that actually useful for something? It seems like that would just needlessly burn resources on your end. The majority of attacks on my instance seem to have come from other infected routers/devices/etc. that pretty much perform these attacks for free.

<comment><USER8> Depends on your goals! If you are defending a network, increasing the cost of attack is something we actively try to optimize for. It costs me next to nothing to hold a socket open and send a keep alive every 15 seconds or so, in addition to the extra threat intel from the initial connection.

You might have a point, and maybe i should try to turn these subjective feelings into harder metrics in terms of cost, but we have figured at this point it has a net good. If we slow the scanning down by a magnitude, in my opinion its a good thing!

<comment><USER10> Is there any research on what proportion of services (ssh, telnet, FTP, WordPress) have to be honey pots or tar pits for it to make a difference?

I've been running honey pots or tar pits for years out of a belief that anyone who can has an ethical duty to do so, to slow down the attacks on those who can't.

<comment><USER8> I havent seen anything terribly relevant, most of the thesis projects i have seen are more interested in creating realistic and believable honeypots for specific protocols, eg RDP.

In my experience, honeypots and tarpits are not the same sort of thing, and fufill different goals. Tarpits get you more utilitarian good, honeypots get you more representative threat intel.

<comment><USER10> Thank you, and good points. From the view point of increasing the utility of scanning for weak-password ssh ports, a honeypot and a tarpit are both entities the human setting up the scanning would like to avoid. I think that ultimately a human looking for easily-guessed ssh or telnet or whatever passwords would want to avoid tarpits and honeypots equally. They might have to code differently for a tarpit than a honeypot, but the goal would be to detect and avoid instances of both things. What proportion of "something to detect and avoid" would cause a scanner to be less than profitable, or just give up?

To illustrate: I've been giving the people that staff robocaller's "service centers" a hard time for years. I believe that my phone number is in some of their systems as a "bad actor" \- I've occasionally heard an audible, computer-generated voice telling the "service rep" that this is a known troublesome number. They also occasionally hang up on me a sentence in to the script. I usually tell them I'm Edward Snowden, but you can call me Ed. That gets a hangup maybe 5% of the time. So giving them a hard time wastes their resources enough that at least a few boiler room/"service centers" put effort towards avoiding me, and the few others like me. What proportion of resource- wasters would it take to make them quit?

</comment></comment></comment></comment></comment></comment><comment><USER11> Wish that this were available 33 years ago...

<comment><USER5> Mr. Cuckoo's Egg, I presume? Well met!!! I really enjoyed your sleuthing tale in the age of modemy Compuserve and Telenet-with-an-e ... which I also did some exploring on. The telephone NPA plus a couple digits was an explorer's dream. Hope you are doing well in this whacky 21st century.

</comment></comment><comment><USER12> any examples of replay logs on asciinema or even youtube?

Just curious about what these look like

<comment><USER2> I played back a friend banging on my cowrie setup a while back. Here you go.

[https://vimeo.com/345068825/86f8c8f97e](https://vimeo.com/345068825/86f8c8f97e)

</comment></comment><comment><USER13> I want to give this a try. Years ago I stumbled upon a similar project written in python which I don't remember the name of, but something about its handshake must have been fishy as most clients disconnected again right away without trying to authenticate. (The initial version string sent by the server looked fine but I wasn't motivated enough to dig any further.)

<comment><USER14> You might be thinking of kippo? Honeypots are fun to think about and toy with - I just never have any idea what to do with the logs and data?

<comment><USER15> The major use case for them nowadays is to help filter out the noise in your alerts. See for example a company such as GreyNoise ([https://www.greynoise.io](https://www.greynoise.io)) to help companies focus on real attacks and not just background noise/ automated attacks.

<comment> yjftsjthsd-h Alternatively, run on your internal network and alert on every attempt....</comment></comment></comment></comment>


Life after Facebook - <AUTHOR> http://www.aljazeera.com/indepth/opinion/2014/07/life-after-facebook-201475175522941104.html

<comment><USER2> Life after facebook should be distributed, decentralised and with a human application pattern. It could be a company following the ind.ie/manifesto and just presented at the indietech.org/summit. We are, as a small startup try to do something along these lines:)</comment>


Dumping SNES Zelda ROM - <AUTHOR> https://medium.com/@bdettmer/dumping-snes-zelda-rom-45b91b92e1c9 <comment><USER2> On Medium? We can't even comment there. It was a failure.</comment>


PayPal and Venmo are still letting SIM swappers hijack accounts - <AUTHOR> https://www.vice.com/en_us/article/pke9zk/paypal-and-venmo-are-letting-sim-swappers-hijack-accounts <comment><USER2> CapitalOne is even worse -they locked me out of their app today and asked to send an SMS code - and they let you pick which number to send it to on the spot. Good one fellas. What is the point of having Touch ID and their dumb Swift ID stuff set up if they keep doing dumb stuff like this.

<comment><USER3> Google does this too when you sign in from "unknown" locations, if you don't have 2FA configured. I think the purpose is to slow down bots. If you try reusing the same number in quick succession on different accounts, Google won't let you.

I'm so glad I'm out of the family tech support "business"; if only firing real customers were so easy...

<comment><USER4> This really bugs me. I have throwaway Google accounts that I don't want to add my phone number to, so I can only access them from the location I created them.

<comment><USER5> How do you even create a Google account without a phone number?

<comment><USER2> You can't create a Google account without a phone number (at least last I tried), however once you enable a 2FA method other then SMS you can then delete the phone number. To their credit the phone numbers I gave to Google when setting up my accounts have never shown up in any of the usual law enforcement or skip trace databases so I'm less apprehensive about opening new accounts with them.

T-Mobile sells me out once a year - I don't even give them my real name, they must get it from my credit card or something. This year I used a fake name "authorized user" card, still waiting to see if that keeps my latest number out of the databases or not, around nine months to go.

<comment><USER6> Wow there's a lock to unpack here. How are you accessing law enforcement or skip trace databases to check?! And what do you mean by T-Mobile selling you out -- where did they give out your info? (They let you get a line without your real name?!)

<comment><USER2> You can request a copy of your info from those databases from Transunion, LexisNexis, etc. and they'll send it to you. however since they are not used in credit decisions they are not governed by the FCRA and you can not dispute or amend anything. Every phone number I've ever had is in those databases, as well as every address I've ever lived at - plus a few dozen variations that are typos or incomplete which I guess says something about my handwriting, every paycheck I've received over the past twenty-some years is in there, both regular payments and bonus, with taxes broken out and everything (a lot of businesses outsource employment verification to a Transunion subsidiary called The Work Number and in return they get all that information). There is my list of "known associates" which is pretty much all of my family living and dead since the 80s, all of my wife's family, a couple former roommates and their families. Apparently I own a sporting goods store in Austin, Tx (thats false, but can't dispute or amend). Every legal action I've been a party to is there. Every car I've ever driven is in there. I think most people would be shocked if they knew how much data these companies keep. I became aware when a police officer called me about some tenants at a rental property on a phone number I'd never given to anyone. I think the Transunion TXLop database is where I finally found the number. Since then its been my hobby to see how long I can keep my phone numbers out of that database.

<comment><USER6> Wow, thank you so much for sharing, that's really great info!

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER7> My account was abused because of SIM swap. It was banned. I explained them that I did not do it. They won't budge.

We need to enforce tech companies to have proper customer support. We need to make a regulation that enables users to appeal or sue tech companies decision about their account. No more 'fix through hacker news submission or reply' please.

<comment><USER8> Paypal is less of a tech company and more of a finance company.

This kind of behavior is caused by rules that put the cost of fraud on the payment processor rather than the customer, even though the payment processor's primary tools to prevent it basically involve locking the customer's account based on vague suspicion and hearsay.

When someone has stolen your identity, there isn't really anything you can tell someone to prove you're you. Having your password or SSN or access to your email or the answers to your security questions tell them nothing. The perpetrator could have those things. Your account may have been created by the perpetrator to begin with and the person whose name is on it has never even used their service. How are they supposed to tell? Even if you're you, the perpetrator may still have access to whatever method was used to access your account to begin with and if they turned it back on there would be more fraud (which causes the payment processor to lose money instead of you). So your account is locked forever and you can pound sand.

The alternative to people getting locked out of their accounts is having accounts without reversible transactions. You don't want this for your brokerage account, but you do want it for the account you're using to buy things with petty cash. Because then the account never has more than $1000 in it to begin with, which limits your losses to that amount, but then the payment processor doesn't have any incentive to ban your account because the losses are yours. If you're careless and reuse passwords, you might lose the $1000, but you don't get banned forever from making financial transactions. Then you learn your lesson and do better next time.

That would also result in lower transaction fees, because most of the transaction fees go to paying the cost of fraud protection. And it would reintroduce the incentive to prevent fraud to the people best situated to do that ( _stop reusing passwords, people_ ), so there would also be less fraud, which is better for everybody.

<comment><USER2> PayPal is the worst - a couple days ago they disabled my password (including both 2FAs) and sent me an e-mail asking me to reset it. The only way to reset it is via SMS which I don't do. I'm locked out of my account now and also support now since the only way to contact them is by logging in. I'm hoping Synchrony has an in with them because I have balances on PayPal MasterCard and PayPal line of credit that can only be accessed by logging in.

<comment><USER8> It's really the same problem. As soon as they suspect your account could be compromised, they can't trust your authentication methods anymore and the risk calculation favors losing your business over reactivating your account and then having fraud losses on it. It's a math problem, not a customer service problem.

Granted it's obviously bullshit if they try to keep the money when your account had a positive balance.

<comment><USER2> What I love is when they refuse to help you except by talking on the phone. As-if somehow my speaking to someone who has never met me and is completely unfamiliar with my voice is more secure then when I log in to their "secure message portal" and leave a message. Too bad there is no Tony for security theater. ;)

</comment></comment></comment></comment></comment><comment><USER9> This is the recommended solution:

> The easiest way to make it impossible for SIM swappers to take over your > accounts after they hijack your number is to unlink your phone number with > those accounts, and use a VoIP number—such as Google Voice, Skype, or > another—instead.

They don't mention that some carriers offer the ability to secure your account against unauthorized transfers, but it's opt-in. Here's how you can do it on Verizon:

[https://twitter.com/ramsey/status/1235227940054585344](https://twitter.com/ramsey/status/1235227940054585344)

<comment><USER10> I tried using a Twilio number with my bank. I found out that any service that uses SMS shortcodes for their SMS '2FA' won't work as this kind of service. SMS shortcuts are a value addon that carriers provide that is only suppose to work with real numbers.

It's possible that services more centered around VOIP vs an automation plateform might work. It's also possible that using a foreign VOIP number might work but that also might also cause issue if you try using it with a US bank.

And I'd rather not have some half baked solution using Google Voice.

If anyone knows how to get an shortcode enable number ( _not_ a short code number but rather a number that can recieve SMS _from_ shortcodes) on Twilio or similar platform, it would be very easy to set up an SMS 2 EMAIL gateway. Perhaps if a number is ported to Twilio it will retain shortcode capabilities?

Besides finding a solution to the above problem, I suppose I could just get a GSM usb modem & SIM card for this purpose.

<comment><USER11> I've started using a dual sim phone with a second number that I do not give out to anyone being used for companies that insist on SMS authentication.

<comment><USER12> Be sure to enable a SIM PIN on it, in the event that it's stolen/taken an attacker can't simply put the SIM in a new device to request the code.

<comment><USER11> I did not think of this. Thank you!

</comment></comment></comment></comment></comment><comment><USER13> I try to avoid having my phone linked to accounts as much as I can. When the web sites say, "add your phone" I say "no."

<comment><USER14> Same here, but disturbingly some sites are making it a requirement.

The Match Group dating sites like Plenty of Fish and OkCupid recently made it a hard requirement to setup a 2FA phone number, even for existing accounts.

It's a super annoying trajectory, and I imagine potentially dangerous if one considers the dating sites and victims of abusive relationships attempting to get out. Making physical access to the phone all one needs to gain access to a dating profile is a clear regression from unsaved passwords.

<comment><USER15> Without any form of national ID it's a really hard problem to solve. As someone who runs my own login system, I require phone numbers to prevent botting. Obviously you can make a bot through Twilio etc, but it becomes economically nonviable to mount attacks through bot registration, which is my goal.

<comment><USER14> What are you doing to combat the risks of attacks like SIM-swapping?

Personally I find using phone numbers for this purpose as a cop-out, and like you said it's just a Twilio account away from being defeated. Like captchas it's only a matter of time before that is the baseline capability for bots and you're in no better place than before, except now your users have worsened security.

IMHO the true business incentive for requiring numbers is just getting identity-coupled phone numbers which add significant value to their collection of PII.

</comment></comment></comment></comment><comment><USER16> While SIM swapping is certainly a concern, this article makes it sound like it's universally bad to rely on phones as a form of authorization. What are the alternatives? I'd argue that email is far riskier; it's more commonly compromised, easier to compromise, and less visible when compromised. Ideally, users employ more secure 2FA methods like TOTP apps or dongles, but it's like pulling teeth to get anyone to adopt those. Relying on SMS in addition to email is better than relying on either one in isolation. I don't think I agree that Google Voice numbers are necessarily harder to hijack, because to do that they just need access to your Google login (typically your email credentials).

There are risks all around, but this article doesn't offer any good solution that customers are likely to adopt in meaningful numbers. Maybe PayPal and other companies should require people to use secure 2FA, but they'd lose too much business.

<comment><USER17> TOTP apps are fine, if they're properly implemented (either completely on- device, or properly encrypted before stored in cloud). Services should properly implement account restoration codes if access to TOTP secret is lost. SMS should never be used for 2FA, ever.

<comment><USER18> There are some apps that if my TOTP secret is lost, as horrifyingly annoying as it would be, I'd much rather need to take the time to get a registered public notary to stamp that they saw me in person, and checked my ID or other such documents, before the account recovery process can begin.

The "old ways" are usefully slow, have protections built around them for centuries of our culture, and I'd rather the annoying administrative headache and "slow" over the quick abuse of account recovery systems for theft and fraud.

</comment></comment></comment><comment><USER19> It is annoying that some of these companies refuse to allow me to use a Twilio number when they insist on using SMS as 2FA. If they are going to insist on the weakest possible form of 2FA and INSIST that I use a number which is subject to SIM hijacking, how are they not liable through negligence?

<comment><USER20> This is because these companies use APIs to establish trust for numbers which do so using a combination of proprietary telco data, machine learning models, and reports from customers. voip numbers like twilio and google voice are a surprisingly large source of fraud, so often the recommendation returned is to block based on how risk adverse the company is.

This method is highly effective at reducing fraud at the cost of penalizing a minority of legitimate users who actually do have to use Google voice / etc.

It should be noted though that factors like why is this number being looked up are considered too, ie: OTP is less risky than say account creation at a bank.

<comment><USER21> Can't Google Voice numbers be outside the US? I've read of foreigners trying to take over Google Voice numbers so they can use them like they are in US.

</comment></comment></comment><comment><USER22> > Paypal

So my instinctual habit of adding and then deleting my credit card details whenever I need to do a Paypal payment was correct, after all...

</comment><comment><USER23> This was (is?) also possible with Lyft. When I was interning in the US, my visa sponsor sent me a SIM card that they clearly reused several times a year. Opening the Lyft app with this SIM automatically logged me in to the attached account. I didn't noticed this and took a 70$ trip from SF to SV. Next morning I realized it wasn't my account and credit card details. Wrote to Lyft support but never heard back. It wasn't even possible to log out of this account and create a new one.

<comment><USER24> Lyft probably decided it was cheaper to eat the $70 than admit this attack vector exists.

</comment></comment><comment><USER25> PayPal / Venmo also don't have support for proper security keys. :(

<comment><USER26> PayPal supports Symantec tokens though? They even sold hardware tokens in the past.

</comment></comment><comment><USER27> The article this is pointing to was discussed here: [https://news.ycombinator.com/item?id=22687927](https://news.ycombinator.com/item?id=22687927)

and the study here: [https://news.ycombinator.com/item?id=22016212](https://news.ycombinator.com/item?id=22016212)

</comment><comment><USER22> There should be a well-known website with a neat domain name that lists well- known companies that allow this to continue to happen.

</comment><comment><USER28> Is there a recommended defense against a SIM Swap attack at the carrier level? Do carriers offer some form of two factor? I suppose the weakest link is the in store associate who just can't be bothered to verify identities.

<comment><USER9> Yes, you can add additional security onto your account - at least with Verizon. I highly encourage everyone to do so. Once enabled, you will need to present photo ID at a corporate Verizon store to allow your phone # to be transferred to a new carrier.

Instructions: [https://twitter.com/ramsey/status/1235227940054585344](https://twitter.com/ramsey/status/1235227940054585344)

My wife got SIM jacked just a few weeks ago and we got extremely lucky that it didn't turn into a bigger problem. They did get a hold of her Venmo account, but fortunately it's not actually linked to our bank account (Venmo restricts the # of users that can link to a single bank account).

<comment><USER29> This doesn't work because many SIM swaps are now done with stolen corporate credentials or bribed retail employees. They login to the corporate portal and check the box that says "I verified the customer's ID" and proceed with the sim swap.

This only protects you from the old way where a scammer tries to convince well intentioned phone support or retail employees.

</comment></comment></comment><comment><USER30> Please stop supporting sms for 2FA. It's not better than nothing, it's worse than nothing. Given the extent of technology workers on hacker news please work to remove this antipattern from your products.

<comment><USER31> The problem is that the SMS is being used not to implement 2FA, but 1/2FA where you can get into the account with just one of the two factors, rather than requiring both.

</comment></comment><comment><USER32> Why isn't there more of an emphasis on the phone companies? They're the ones literally giving your phone number to someone else.

</comment><comment><USER33> 2FA should never be SMS based. I've deprecated SMS for all communications and block all SMS messages to my phone.

I use a virtual number for all such services that demand an idiotic SMS verification code. I won't state which one I use here, but there are several services you can choose from that provide virtual numbers.

</comment><comment><USER34> Oddly enough, today I finally had to give my mobile number to paypal - apparently due to incoming EU PSD2 regulations. I was also automatically signed up to paypal "one touch", where my device is now able to make transactions with no need for a password. Another thing I have to turn off.

</comment><comment><USER35> To be clear, Paypal owns Venmo.

</comment><comment><USER36> I think if you use Google Fi, then you can lock down your account pretty well and you'll need your hardware key to change things.

</comment><comment><USER37> PayPal is legitmately the biggest piece of crap flying around the internet. I'm amazed they are still a thing, given the sheer number of stories we all hear about "PayPal stole my 10k and wouldn't give it back for months" and then, this.

It's been such a relief to stay in SE asia for sometime where PayPal isn't associated with all kinds of online shopping. I can actually order online AND be given the choice to either pay online OR in person in cash.

PayPal and it's crappy culture needs to die.

</comment><comment><USER38> can we please stop using cellphones and smartphone for anything serious please?</comment>


Malcolm Gladwell's response to Steven Pinker's review of his new book - <AUTHOR> http://gladwell.typepad.com/gladwellcom/2009/11/pinker-on-what-the-dog-saw.html

<comment><USER2> As long as we are returning to the "Gladwell is full of shit" meme, I recommend the Vanity Fair satire of Gladwell ([http://www.vanityfair.com/culture/features/2009/12/gladwell-...](http://www.vanityfair.com/culture/features/2009/12/gladwell-200912)) for anyone in search of a quick laugh.

<comment><USER3> Wow. That is hilarious. Takes the piss out of a large swath of middlebrow journalism along with Gladwell, too.

 _"The conclusion is both remarkable and inescapable but also—most importantly—counter-intuitive," Dr. Bunquum told me over a glass of organic lemonade in his stunning waterstulp, or waterside studio, near Rotterdam._

I'm trying hard not to giggle because the person next to me is actually getting work done. Oh yeah, work...

</comment></comment><comment><USER4> I'm surprised that all responses seem to be on Pinker's side, but here is my take on it

>>What do Sailor's beliefs about an unrelated issue have to do with his analysis of NFL

Well, the credibility of a source (and his past "research" conclusion about racial superiority) is a factor in reviewing conclusions.

>>Gladwell seems to rely on ad-homenim.

This is subjective, but imo calling Pinker an "IQ fundamentalist" is a pretty mild response to the much more harsh attacks from Pinker.

>>I was absolutely shocked when Pinker's writing revealed that Gladwell in his book referred to an "igon value"

imo questionable spelling is better than questionable data.

<comment><USER5> If you're writing entire chapters on 'igon values' then obviously you've never read a single page on the topic. I'm sorry but this is not about forgetting to click 'spell check'.

<comment><USER4> >>If you're writing entire chapters on 'igon values'

Pinker's review says thatthe book "quotes an expert speaking about an 'igon value' (that's eigenvalue,.."

I haven't read the book.

Are you sure that Pinker was downplaying the "igon value" issue and that Gladwell really wrote "entire chapters on 'igon values'" ?

Which entire chapters are about "igon values" ?

<comment><USER6> There aren't entire chapters. It appears in a quote by a mathematician. Gladwell isn't trying to explain mathematics poorly, he's transcribing poorly.

</comment></comment></comment></comment><comment><USER7> Pinker's review: <http://www.nytimes.com/2009/11/15/books/review/Pinker-t.html>

</comment><comment><USER8> Steve Sailer has a reponse up on his blog: [http://isteve.blogspot.com/2009/11/gladwell-strikes- back.htm...](http://isteve.blogspot.com/2009/11/gladwell-strikes-back.html)

He has another explanation of his point here: [http://isteve.blogspot.com/2009/11/pinker-v-gladwell-on- nfl-...](http://isteve.blogspot.com/2009/11/pinker-v-gladwell-on-nfl- quarterbacks.html)

Overall, I think Sailer's critique is quite valid: _What Berri is doing, in effect, by using his "per-play" measure is comparing quarterbacks taken at the top of the draft (most of whom get a lot of plays in the NFL) to those taken lower in the draft who turned out to be surprisingly better than expected, and thus got a lot of plays. He's essentially leaving out of his analysis all those lower drafted quarterbacks who turned out to be as mediocre as expected and thus didn't get many plays. In other words, his methodology is pre-rigged to produce the conclusion that Malcolm likes._

<comment><USER9> Hypothesis: The reference to Sailer is mainly a hit, intended to link Pinker and Sailer, and drag Pinker down. Therefore, Sailer's response is largely irrelevant.

(Agreed that Sailer's response is valid. Further support for my hypothesis: Gladwell spends the rest of the article denigrating blogs for their names and associations with Fantasy Football, as opposed to Science.)

</comment></comment><comment><USER10> This does a great job refuting one of Pinker's fact based counter examples. It in no way refutes the core thesis of Pinker's review, that Gladwell is full shit.

<comment><USER11> The fact that he pointed out a error in analysis in no way affects your opinion of the conclusion?

The whole point of Gladwell's assertion is that if Pinker is this haphazard in gathering supporting data, perhaps his entire review is nothing more than opinion.

While there's nothing wrong with that - being a review and all - it certainly isn't a factual debunking of data.

(btw I'm not debunking the assertion, just your reasoning)

<comment><USER12> When he spends a whole essay refuting less than a third of a sentence in the original criticism the impact is diluted to very little indeed. The fact that he doesn't respond to any of the other factual assertions is more telling to me.

</comment></comment></comment><comment><USER13> I was absolutely shocked when Pinker's writing revealed that Gladwell in his book referred to an "igon value" (instead of eigenvalue, which I learned about in the second week of my Linear Algebra class.)

How the hell does someone lecturing us on social sciences have little-to-no math background?

<comment><USER14> If the term "igon value" had been replaced with "eigenvalue", would the usage or context have been incorrect?

In other words, a mere misspelling -- while embarrassing -- doesn't demonstrate that someone has "little-to-no math background".

<comment><USER15> People who know what eigenvalues are don't misspell "eigenvalue" as "igon value," ever. Malcolm Gladwell doesn't know what eigenvalues are. That's the only point, really, but it's a pretty big one -- Gladwell's stock in trade is the popularization of counterintuitive statistical studies and their conclusions, and if he's never learnt any linear algebra he's not in a good position to actually understand those studies.

<comment><USER14> Just addressing your first sentence -- since I don't know Gladwell well enough personally to respond to the others -- it's not beyond the realm of imagination that he uses a ghost writer, or that someone transcribes for him, or even that he uses voice recognition software (as one of my clients does, which prompted my initial response).

My point was whether the _usage_ was incorrect, because it's not impossible to misspell it and still know the meaning of the term.

<comment><USER16> Come on, Malcolm Gladwell isn't being ghostwritten. Anyone that good doesn't need a ghost writer, and if his ghost writer is that good, he's not going to be ghost writing instead of writing his own stuff and building his own name. Even if he were using a ghost writer, Gladwell didn't go back and read through?

<comment><USER17> It's may be more correct to say that Malcolm Gladwell does ghostwriting for the scientists he interviews.

</comment></comment></comment></comment></comment></comment><comment><USER3> A weak defense, insofar as he picked only one point to go all-in on, and it's probably the least significant one. Also, notice his attempt to trivialize "igon value" as "my spelling"; the appropriate phrase would have been "my ignorance". I'd say this rebuttal does more to expose Gladwell as a sleight- of-hand artist than Pinker's actual critique did. It doesn't mean that Gladwell isn't a superbly entertaining writer and storyteller, though; and at his best, a popularizer of damned interesting stuff.

<comment><USER18> The thing is he's strictly a popularizer of flattering stuff. It's all designed to make his bourgeois readership feel like they have special insights, or feel good about themselves. One would think a lot of uncomfortable truths or null results (common sense or the experts are actually right) would come up, but they never do.

</comment></comment><comment><USER19> Pinker's core point is that Gladwell is a shallow dilletante that writes well, but makes profound conclusions based on this basic dabbling.

Gladwell does nothing but make one of Pinker's specific challenges appear much shakier (and yes, I'm going to be stereotypical here and guess that Pinker probably is much less comfortable with Football than Gladwell). If I hadn't ever heard of Pinker before, this would do something to my trust in his argument.

However, knowing Pinker's track record and background, Gladwell's "rebuttal" seems a frail attempt that tries to hit at the one weak point he found. Really? Nothing more substantial to refute?

</comment><comment><USER20> Malcolm Gladwell has a rather long history of being corrected by experts. See here: [http://www.fastcompany.com/magazine/122/is-the-tipping- point...](http://www.fastcompany.com/magazine/122/is-the-tipping-point- toast.html) and here: [http://www.dr5.org/judge-posner-on-blink-the-power-of- thinki...](http://www.dr5.org/judge-posner-on-blink-the-power-of-thinking- without-thinking/)

Full disclosure: I am a Gladwell fan, though I recognize that he is more storyteller than scientist.

</comment><comment><USER21> What do Sailor's beliefs about an unrelated issue have to do with his analysis of NFL draft positions and performance? Gladwell's retort would have been better without that.

<comment><USER22> Sailer's introduction to many, including myself, was his posting of mile-long screeds, primarily regarding race and IQ, in the comments of Gladwell's blog. He was banned from same and his comments removed in late 2006:

[http://gladwell.typepad.com/gladwellcom/2006/12/the_lunatic_...](http://gladwell.typepad.com/gladwellcom/2006/12/the_lunatic_fri.html)

He seems to be trying to make a name of himself in part by carrying on a one- sided debate with Gladwell, which in itself makes him a suspect source even if he wasn't already familiar to the blog's long-time readers.

<comment><USER23> Sailer's posts were not screeds. They were well-argued and relevant, just like his contributions in the current debate. He was not banned. Gladwell made his readers vote whether or not he should stay, and they overwhelmingly voted in support of Sailer. Nor were his comments removed.

</comment></comment></comment><comment><USER24> This is a very interesting comparison of how to do research well with how to do research poorly, with the journalist coming out better than the academic.

After edit: I'll have to check a Pinker book reference after I return from PZ Myers's debate this evening to give a more focused example of what Pinker can miss while doing research.

<comment><USER25> Unfortunately the original research paper by Berri and Simmons is locked up behind a paywall. But Sailer does seem to make a good point - if you measure QB performance on a per-play basis, the low-end of the draft order is going to be dominated by the few Tom Brady's of the world (draft number 199, 3 Super Bowl rings, lots of plays) because most late draft picks don't even get any NFL snaps.

It would be like saying IQ is not correlated with Nobel Prize awards, if you only look at people who have earned PhD's.

<comment><USER26> Actually the Pro Bowl thing might not be bad.

Am I missing something or is Gladwell not taking in account the fact that higher draft pick QBs play on worse teams then QBs taken later in the round? Also, QBs taken later in the round will probably be allowed a season to learn and mature as opposed to first round picks who will play right away because of the large salary.

</comment></comment></comment><comment><USER27> Gladwell seems to rely on ad-homenim. Calling Pinker an IQ "fundamentalist" is a bit over the top, too, especially in light of Pinker's moderate writings that point to the relevance of both environment and heredity.

<comment><USER14> No, he doesn't. The closest thing to a true ad-hominem fallacious point in his reply would be his mentioning of Sailer's opinion that blacks are intellectually inferior to whites. However, he immediately follows that up by addressing Sailer's actual data, cited by Pinker.

I need a fancy-sounding Latin term for "trotting out 'ad hominem' when there is no such thing"...

<comment><USER28> In real life, virtually no one uses true ad hominem. No on says, "he is a jerk, therefore he's wrong." In my book, using insults and connotative (negative) language rather than strictly denotative is on the ad hominem scale. It is absolutely designed to undermine the credibility of the person you're debating while not engaging the argument at all.

This new meme that started on reddit claiming ad hominem isn't ad hominem is weird. We shouldn't defend argument techniques that make truth-seeking harder. There's a time and a place for ad hominem and that time and place is entertainment writing.

<comment><USER14> Mmm, a debate about debates. How meta.

I have a couple of problems with this. First, by broadly sweeping "everything I don't like about arguments" under the label "ad hominem", you're powerfully eroding the usefulness of the term. It has a specific use and purpose, and it's useful to understand the various fallacies in debate (<http://www.nizkor.org/features/fallacies/>).

Also, you admit that this style of debate has a place in entertainment writing -- _in a thread about his letter to the editor_. This was not a formal debate, nor was it the appropriate forum for such; he was writing a response that would reach a large number of readers, and they were his audience.

Besides, aren't you committing the selfsame fallacy that you're accusing him of, according to your own rules? i.e., "Gladwell used methods I don't like, so he's wrong."

I wasn't aware that this was a Reddit meme. I stopped visiting Reddit some months ago, and my usage fell off even before then. I'm glad it is, though. If someone's going to try and bolster their criticism of someone else by using fancy Latin phrases, they really ought to get called out on it by someone that knows better.

</comment></comment></comment></comment><comment><USER29> I was left feeling completely dissatisfied with this response. It came across as childish.

</comment><comment><USER30> [http://scienceblogs.com/pontiff/2009/11/igon_value_problems....](http://scienceblogs.com/pontiff/2009/11/igon_value_problems.php)

</comment><comment><USER31> malcolm owned that biatch.

</comment><comment><USER32> Lost me at football.

</comment><comment><USER33> So two soft scientists are fighting? Who cares?

<comment><USER34> Pinker is not a soft scientist.

<comment><USER33> Oh? What is he then? (I read evolutionary psychologist off his wikipedia bio)

<comment><USER35> Read his papers from the 80s -- they are highly technical linguistics manuscripts. Pinker knows Unix and uses emacs. Yes, really.

<comment><USER36> I took a class from him at MIT (9.00). He is a very, very smart person.

<comment><USER34> I took that too, which is also how I knew :)

</comment></comment></comment></comment></comment></comment><comment><USER37> I didn't like the implied ad hominems much 8/ Respect for Gladwell--;

<comment><USER37> Am I to take the downvotes to mean we like to undermine the credibility of people by saying things like "...who is best known for his belief that black people are intellectually inferior to white people" before we address the actual data?

It's cute, yeah, but it's also fallacious argumentation. Even if the smear is true, which Galdwell doesn't substantiate, it's not relevant to the data. He points out why the data is weak--and that part is fine--my issue was with his extraneous ad hominem.

But apparently here on HN, ad hominems are a-ok, as long as they are clever and make for a good read, right?</comment></comment>


Uncovering multiscale order in the prime numbers via scattering - <AUTHOR> http://iopscience.iop.org/article/10.1088/1742-5468/aad6be/meta <comment><USER2> Very suspicious of the whole line of this work. Suspect that the "Bragg peaks" are trivial. For instance all primes > 3 are in the form 6n + 1 or 6n + 5.

<comment><USER3> 6n+1 or 6n-1, easier to remember.

<comment><USER4> 6n±1, even easier. ;)

</comment></comment></comment><comment><USER5> You can access the paper on arxiv: [https://arxiv.org/abs/1802.10498](https://arxiv.org/abs/1802.10498)

</comment><comment><USER6> I believe there was a popular exposition of this:

[https://www.quantamagazine.org/a-chemist-shines-light-on- a-s...](https://www.quantamagazine.org/a-chemist-shines-light-on-a-surprising- prime-number-pattern-20180514/)

<comment><USER7> It was posted here: [https://news.ycombinator.com/item?id=17067821](https://news.ycombinator.com/item?id=17067821)

</comment></comment><comment><USER8> I did not really study the article, but from the abstract: is is not to be expected to find semi-regular subseries in an infinite series of prime numbers?

<comment><USER9> From the abstract: "Our analysis leads to an algorithm that enables one to predict primes with high accuracy."

From my very, very basic understanding of/curiosity with primes, predicting primes with any sort of accuracy has been elusive. If this does, in fact, help to predict primes, it opens up all sorts of possibilities. That's my guess as to the importance of this article.

<comment><USER10> I dont have access to the article, but I imagine 'high' is a relative term. In general, the density of primes arround n is roughly 1/log n; if you could do significantly better than that say 1/sqrt(log n) you could call that high accuracy.

Meanwhile, the actual probability of predicting a prime would still be very low. Note that I am only speculating here.

</comment></comment></comment><comment><USER11> This is just re-inventing sieve theory with physics jargon.</comment>


How the Fleece Vest Became the New Corporate Uniform - <AUTHOR> https://www.wsj.com/articles/how-the-fleece-vest-became-the-new-corporate-uniform-1532442297 <comment><USER2> who cares?

</comment><comment><USER3> paywall

can't read

<comment><USER4> [https://outline.com/EMrnme](https://outline.com/EMrnme)</comment></comment>


3D WebGL Goo Engine goes open source - <AUTHOR> http://goocreate.com/blog/1199/oh-my-code-goo-engine-goes-open-source/ <comment><USER2> Finally we open sourced it! This engine powered a plethora of awesome projects like Suisse Mania, Mountains of Mouthness, the Nike Phenomenal Shot during the Soccer World Cup in Brazil, as well as many others.

It will be great to see what other cool things people can create with it.

</comment><comment><USER3> Great news! Excited to check it out

<comment><USER2> Please do! And let me know if you have any suggestions about it or about Goo Create ;)</comment></comment>


A friend helped out my startup, are they entitled to equity? - <AUTHOR>

I've been working on my startup for quite some time now (over a year) and my friend, who is a designer, does somewhere between something like 30 hours of work to help out where I was lacking in some skill.  No discussions or contracts have been made but I feel like its important to discuss expectations.  Are they entitled to equity now? <comment><USER2> Maybe equal to the cash value of the 30 hours of work. If you were to sell shares in the amount their work was worth.

But most likely you just pay them in cash & call it a done deal. Without written documents awarding equity I'd say an expectation of equity is out of line.

<comment><AUTHOR> Makes sense. If they demand equity, how would you respond to that? Are there legal ramifications? ( putting your friendship aside.. )

<comment><USER2> Then I'd say at the very least the friendship's over.

You might look into hiring an attorney to defend yourself, but I wouldn't worry about it too much since their demand wouldn't have a legal leg to stand on being that there was never any written or signed agreement stating they were due any equity.

Let them sue you & lose I guess.

But then I'm no attorney, so don't take my word for it.

</comment></comment></comment><comment><USER3> Legally or morally? I would say so morally. Legally is anyone's guess but you'd be crazy to take the advice of anyone other than a lawyer on that question.

<comment><AUTHOR> Because their work was temporary and they don't have any skin in the game, I feel like equity is a bit much. I was thinking some other type of remuneration instead</comment></comment>


Athens Startup Weekend Entrepreneurship Forged in Fire - <AUTHOR> http://niobiumlabs.com/athens-startup-weekend-had-it-all/

<comment><USER2> I was there in this Startup Weekend and the difference was really stark! Inside, people trying to disrupt the status quo by CREATING, while downtown Athens others trying to disrupt it by DESTROYING!

Never doubted my preference to be in the CREATING side...</comment>


YC startup Coinbase has been hacked? Unable to withdraw $25,000 - <AUTHOR> I believe that coinbase has experienced a hack on a large scale, as there have been multiple people having issues with withdraws recently on coinbase. Several other people on the coinbase support forum have recently stated that coinbase has also stolen their funds.
So I wanted to warn the reddit community from using Coinbase.
Here is what happened:
Coinbase shut down my account, and then there was a message displayed saying that I need to transfer the 60 Bitcoins (about $25,000 ) to another address. I attempted to do that at least 10 times, but it simply says "please wait..." for over 2 hours.
Next, I sent 3 different support tickets asking for help on this topic, but it has been 4 days already with no response at all.
I have about 60 BTC on this account, worth around $25,000 at this time.
In conclusion, Coinbase is not to be trusted and has most likely experienced a major hack.
Attached is proof on my coinbase account: http://imgur.com/AK8lCgF
UPDATE 05/26 6:30PM EST: someone else just posted about this. (I swear it's not me )
The person said that they were unable to withdraw their money.
I'm pretty sure coinbase has been hacked. DO NOT USE COINBASE.
https://www.reddit.com/r/Bitcoin/comments/4l7tde/coinbase_down/ <comment><USER2> Hi - Michael here from Coinbase Support. Since this has shown up on both reddit and now here, it's probably worth stating that we haven't been compromised. We have, as the customer stated, closed their account and will not be re-instating it. The customer is able to withdraw their funds without restriction, but has had some issues doing that. It's completely understandable that this would be upsetting. We're working with them to resolve the issue.

</comment><comment><USER3> I just got a weird email from Coinbase last night. I've had an account for ~2 yrs now but haven't been very active. They sent a message soliciting me to log in for the first time that I can remember. Here's the text of the email:

 _Subject: The Economy of the Future is Here!

Wow - the price of bitcoin nearly doubled in the last year! We noticed it's been a while since you bought bitcoin and thought you might want to get your stake in finance 2.0 sooner rather than later.

Sign in to your Coinbase account now to instantly purchase bitcoin and start participating in the economy of the future._

The kind of email that makes you think...what is the agenda here?

<comment><USER4> I got this earlier today:

 _Just when you were beginning to understand Bitcoin, we decided to add Ethereum! We thought you might want to get your stake in Finance 2.0 sooner rather than later.

Sign in to your Coinbase account now to instantly purchase Ethereum and start participating in the economy of the future._

</comment></comment><comment><USER5> Not chastising you, but why would you store $25k with what is essentially a bank that has no FDIC (or any other type of) insurance for those funds?

<comment><USER6> Coinbase have insurance. [https://support.coinbase.com/customer/portal/articles/166237...](https://support.coinbase.com/customer/portal/articles/1662379-how- is-coinbase-insured-)

<comment><USER5> >Coinbase's insurance policy would respond in the event that bitcoin stored in Coinbase was lost or stolen as a result of a breach of our physical security, cyber security, or as a result of employee theft

Potentially not covered:

Non-theft malfeasance

Negligence

Bankruptcy

Seizures by foreign governments

Technical problems leading to loss of data

Someone at Coinbase not liking you and wiping out your account

Unauthorized access to your account that doesn't count as a breach of security (your link specifically mentions this one as not covered)

Violation of terms of service leading to forfeiture of account and balance

And probably tons of others I haven't thought of. I know most of these are unlikely, but still very possible. Someone losing their FDIC insured bank account balance due to any of the above is virtually unheard of as long as the consumer exercises their legal protections. Keeping $25k at Coinbase is just as risky as keeping it at Paypal, and we all know how much Paypal loves permanently freezing accounts.

</comment></comment></comment><comment><USER7> It seems to me that anything associated with Bitcoin becomes a target for hackers.

site relates to bitcoin = eventually hacked

<comment><USER8> Pssh. This also is true for any other digital system that handles money.

</comment></comment><comment><USER8> Just moving my money out. I got a gambling warning anyway and do not accept that they forbid this.

</comment><comment><USER9> I lost a lot of money in the MtGox theft. Not a nice feeling.

I really hope it works out for everyone.

<comment><USER10> Completely unrealized gains or had you actually lost capital you converted to BTC?

</comment></comment><comment><USER11> Where should I move my BTC to assuming I can get access to my coinbase account?

<comment><USER12> If you have a significant amount of money, I would suggest a good hardware wallet like Trezor or KeeyKey or Ledger.</comment></comment>


A self hosted, open source status page application - <AUTHOR> https://github.com/owainlewis/status <comment><USER2> Test instance running here [https://systemstatus.herokuapp.com](https://systemstatus.herokuapp.com)</comment>


MIT scientist captures 90,000 hours of video of his son's first words, graphs it - <AUTHOR> http://www.fastcompany.com/1733627/mit-scientist-captures-his-sons-first-90000-hours-on-video <comment><USER2> " _applies these same high-powered analytics to relate [...] events broadcast on TV to conversations taking place in social media_ "

So, if you use Twitter, you're someone's lab rat. I know that when I tweet, it's open for all the world to see, but I can't shake the feeling that this is really creepy.

Beyond that, I'm trying to envision how this data could be used. I imagine three scenarios:

1\. Leverage it to sell more TV advertising. If a show is getting buzz on twitter, maybe this could be a viable alternative to Nielsen ratings. (Which leads to the question of whether Blue Fin can discern positive buzz from negative buzz).

2\. If step 1 is analysis, could step 2 be manipulation? Can buzz be jump started or boosted at key inflection points by sock puppet marketing?

3\. C-level eye candy - interesting visualizations that TV exec's buy for their egos, but ultimately can't do anything actionable with the information.

<comment><USER3> I think that it will be used in more sinister ways. They will provide information on how to make political speeches and propaganda more influential and how to get main stream media stories to be better believed.

There has already been a statement on the particular psychological tricks Obama uses in his speeches - I can only see this being used to strengthen that.

<comment><USER4> Haven't politicians, leaders, and many others in positions of authority been doing this for millennia? People have been studying this (rhetoric) since ancient Greece.

</comment></comment></comment><comment><USER5> Here's the TED talk: [http://www.ted.com/talks/lang/en/deb_roy_the_birth_of_a_word...](http://www.ted.com/talks/lang/en/deb_roy_the_birth_of_a_word.html)

</comment><comment><USER6> So the language acquisition stuff could be an n=1 just-so story, but meanwhile:

Deb Roy and Phil Decamp just invented a way to efficiently browse _days_ of multiple video streams - on _paper_ , if you want:

[http://video.fastcompany.com/plugins/player.swf?v=2014e22b27...](http://video.fastcompany.com/plugins/player.swf?v=2014e22b27618&p=fc_social)

Their work on "time worms" is astounding; unfortunately, the video ends before zooming out to the next step: multitrack timeworms with hundreds of cameras; broadband recordings of ALL THE CHANNELS.

[http://www.youtube.com/watch?v=RE4ce4mexrU&t=11m56s](http://www.youtube.com/watch?v=RE4ce4mexrU&t=11m56s)

We can put off the hard problem of CV-driven video search; we can solve the much easier problem of "leverage people's brains to recognize patterns". Visualizations are the new algorithm.

</comment><comment><USER7> I think a better summary would by "MIT professor collects 90,000 hours of video of his son's first words, gets tenure based on that, does nothing with the data. With tenure safe in hand, leaves his students in a lurch as he heads off to do a start-up."

It's a great corpus he collected. Wish he either had a longer attention span, or at least bothered to share the data.

<comment><USER8> I had a similar reaction. I think it speaks to the time, that some of the greatest minds of our generation are 'seizing the opportunity' of a startup to develop social analytics around the 'jersey shore'. I can't help to think the great linguistic scholars (ex. his fellow MIT faculty member, Chomsky) doing the same things in the 50's. Can you image the loss to humanity if each one, after giving a TED talk, abondons his research in their 30's or 40's to make an advertising platform? This made me sad.

</comment></comment><comment><USER9> I keep a git repository[1] of my son's (1,5 years old) keyboard hammering. He "types" until he accidentally leaves insert mode in Vim or leaves the computer, and then I commit it.

In 5-10 years time I hope to be able to do some real-time visualization with milestones like "first real word", "first use of _complicated word_ ", etc. If he's interested I might track his first code there as well.

1: <https://github.com/jacobrask/Ivar>

<comment><USER10> Out of curiosity, why did you choose to give a kid a modal editor?

<comment><USER9> I didn't really choose, I was busy coding one day and his mom had to do something quick, so I had him in my lap. He wanted to type like I did, so I just opened a split in Vim and let him type a few characters, he could barely press down a key anyway. When he later wanted to go to the computer even when I wasn't sitting there, I just continued in Vim.

I'll probably switch to something else now that's he's actually starting to understand the connection between the monitor and the keyboard better. Previously he mostly liked right-clicking with the mouse as it gave a big box on the screen..

</comment></comment></comment><comment><USER11> The MIT project sounds awesome and I love the visualization. I was underwhelmed by the offshoot company called Bluefin Labs. For such awesome research at MIT, it seems like Bluefin is basically Twitter trending for TV shows.

</comment><comment><USER12> I was disappointed.

The graphics/visualization is breathtaking but what they learned from all of that analysis seems very limited: Apparently, when caregivers discover that a child is learning a word they simplify their use of that word till the child grasps it and then revert back to normal usage once the child can use the word.

It could very well be that their regular usage of the word that the child is learning is unaffected, but in addition they use the word more often in simple sentences around the child, and once the child understand the word revert back to regular usage patterns/frequency. That would explain the results and does not seem that interesting.

<comment><USER13> I am studying Natural Language Processing, so I have been interested in how humans learn language, in order to understand if the process can be replicated such that a computer can learn a human language. I think we would have to read the actual paper to really understand their findings, but the main thing I took away from this is: in order for a child to learn a language the parents apparently subconsciously alter the way they speak (whether it is just to or also around the child), language learning appears to be tied to psychical locations and children seem to rely heavy on feedback by their care takers.

That would be an indication that there is a limit to what computers can learn about human language by analyzing textual data (like e.g. Google Translate does). This is related to the poverty of the stimulus argument in linguistics. (<http://en.wikipedia.org/wiki/Poverty_of_the_stimulus>)

<comment><USER14> If only teachers were taught to do the same at school.

</troll>

</comment></comment></comment><comment><USER15> This is probably one of the coolest projects. The people working on this project are doing and figuring out some amazing things.

</comment><comment><USER16> Has the poor child ever got outside the house?

</comment><comment><USER17> Not related to his project, but I feel very proud in a distant way. My last startup's office (in Kolkata, India) was at his father's house. Don't know why I wrote that, just felt...

</comment><comment><USER18> I liked the example with the president's speech. It won't be long before politicians will adjust their speeches during the speech according to the reactions from viewers.

</comment><comment><USER19> ...then public dies of ennui.</comment>


God, Gods, and Fairies - <AUTHOR> https://www.firstthings.com/article/2013/06/god-gods-and-fairies <comment><USER2> Another example of the very clichéd "atheism is a religion!" trope. I would suggest that when trying to post Christian propaganda to HN, you not use a site which on its home page features "The War on Christian America" and an article defending convicted child rapist Cardinal George Pell.

</comment><comment><USER3> It's the old motte-and-bailey argument; the author stands in the bailey and asserts "there is a living God, who created you and cares for you individually, and I have detailed information about this God's nature."

When you ask to see some evidence for that, the author runs back into the motte, and says "obviously something led to the existence of the universe, and all my information about the nature of that Something is subjective, which you can't impeach. Since you can't prove my subjective assertions wrong, I'll continue to claim I'm right. If you don't accept my claim you're being unreasonable."</comment>


ASk HN:  2 questions about founder's equity - <AUTHOR>

When it comes to founder's equity, the general rule of thumb seems to be to vest it over 4 years and have a 1 year cliff (so if one of the founders leave before a year is up, they lose their equity.  So far so good, but here are my questions:
1.  What if one of the founders isn't doing much work during the first year and they refuse to leave on their own accord?
2.  After the first year, what if one of the founders decides to start another company on the side without his partners?  Should that company be considered part of the original startup? <comment><USER2> 1\. Shotgun clause or something similar.

2\. Work-for-hire clause or similar — everything that the employees do is property of the company unless specifically negotiated otherwise.</comment>


Snap-on thermal camera for iPhone gives you heat vision - <AUTHOR> http://www.nbcnews.com/technology/snap-thermal-camera-iphone-gives-you-heat-vision-2D11880997 <comment><USER2> Great for catching moments like this:

[http://www.youtube.com/watch?v=T1FxI3aVBOs](http://www.youtube.com/watch?v=T1FxI3aVBOs)</comment>


Cheap Android tablet, perfect for hacking. - <AUTHOR>

If you were waiting for a cheap android tablet to sink your teeth into, here's your chance.
http://www.dealextreme.com/details.dx/sku.39448
Gotchas: 1) no app store 2) resistive touch screen (not capacitive like iPhone etc) 3) single-touch
No affiliation. <comment><USER2> I actually got something similar off of eBay from China: $90+$30 for shipping. The thing is surely pos quality wise (slow [same specs as this one] and battery doesn't keep charge for long, screen/touch suck, plus some power management issues), but hey, it's $120 and I can actually develop something for Android and read books/browse net. I don't care even if it die tomorrow.

App store isn't an issue, as long as you can download software directly. Why even bother with some intermediary?

</comment><comment><AUTHOR> $137 for an 8" tablet opens up a lot of opportunities for a kitchen pc, or say a door-side pc, or home-automation control panel.

If anyone gets one please post your review.

</comment><comment><USER3> Wow, this is cool. Too bad the touch screen is resistive and not capacitive. But it's pretty neat to see Android tablet prices so low. At $137 price point, it would be great to get one by my bed, in the bathroom, in the kitchen, in the car... and in my golf bag.

</comment><comment><USER4> Battery life time is so critical. It if can work for 6-10hours it is fine. Really, we will be able to serf the internet and read pdf files. So, good deal

</comment><comment><USER5> I want one...I mean at that price it will have a purpose...either as a back up netbook or an alternate or maybe yes...a kitchen PC.

</comment><comment><USER6> Why does it come with a proprietary apple connector?

</comment><comment><USER7> Anyone know if the OS can be upgraded to 2.2?

</comment><comment><USER8> pretty neat. i wish the bezel wasn't so thick, but hey it's $130.</comment>


Fired IT Workers at Billboard, Hollywood Reporter Get Revenge - <AUTHOR> https://variety.com/2020/biz/news/billboard-it-team-fired-animal-house-1234580764/ <comment><USER2> Very Professional. It sucks to be laid off, but I'm not sure this will advance their chances of getting rehired (anywhere).

<comment><USER3> I wouldn't be so quick to judge, usually when something like this happens there's some bad blood.

If these people are reasonably good at what they do I doubt this will affect their chances of getting hired. They also don't need to put it on their CV.

<comment><USER4> Not sure that any amount of "bad blood" excuses that sort of lapse in professionalism.

Its a shit situation but you dont gain anything by burning bridges in front of you as well as behind you.

<comment><USER5> I bet people forget about this stunt in a week lmao.</comment></comment></comment></comment>


Ask HN: Should BMI preceed AI for goal alignment? - <AUTHOR> Are breakthroughs in BMI more important than those in AI to allign goals of future superintendent AI with humans?<p>https://twitter.com/maheshyadav/status/950788184186564609 <comment><USER2> By "BMI" I presume you mean brain/machine interface. (I had to look it up.)

If you've got an AI that is out of control and human-indifferent or -hostile, all BMI will do is make it easier for the AI to control us.

Now, I presume you're hoping that improved BMI will make it so that the AI understands us better, and therefore helps it not become human-hostile. And in fact it might work out that way. My guess, however, is that any human- equivalent or better AI will think so radically different from us that empathy isn't realistic, and therefore improved BMI will not decrease the probability of a human-hostile AI.</comment>


Copyright, patents, the public domain and today's Supreme Court decision - <AUTHOR> http://www.patentlyo.com/patent/2012/01/supreme-court-affirms-broad-congressional-authority-to-offer-intellectual-property-rights-for-public-domain-works.html <comment><USER2> This is a good reason not to rely on the courts to strike down the bad parts of SOPA & PIPA.

And it's also a good reason to seriously consider something like a Constitutional amendment that clarifies the tension between the First Amendment and the Copyright Clause. They appear to believe that the Copyright Clause gives Congress carte blanche to override any First Amendment concerns and that the Public Domain is not an important part of advancing progress.</comment>


Discovering an Equation for Altruism Cost George Price Everything (2016) - <AUTHOR> http://nautil.us/blog/how-discovering-an-equation-for-altruism-cost-george-price-everything <comment><USER2> The article is interesting and biographical, but for those not interested in biography:

The Price Equation[1] simply states that the change in a trait due to natural selection is proportional to the covariance between that trait and it's impact on "fitness" (survivability). The link to altruism is that the equation applies to a whole population, not just an individual. So, spending time and energy to help your kin can increase evolutionary pressure for your traits, so long as the gain in utility from the resource transfer is larger than the genetic difference between you.

The equation is useful and accurate, though not incredibly insightful. From the article: _It is like a footballer who, when asked how their team will win the next match, says they will score more goals than the other team. By trying to explain the game at its most fundamental level, say the critics, the equation explains and predicts nothing about why certain traits should increase or decrease fitness._

[1] [https://en.wikipedia.org/wiki/Price_equation](https://en.wikipedia.org/wiki/Price_equation)

</comment><comment><USER3> "It was altruistic ants that posed a particular problem for Charles Darwin."

Darwin offers a thorough and well-thought out explanation of the sterility of worker ants in The Origin of Species, chapter 8 (where he discusses this and other instincts that are "so wonderful").

</comment><comment><USER4> Beautifully written article with a rather sad and sympathetically handled ending.

On the Price Equation, I think this is rather telling - "In her own quest to crack its meaning": * quite simple, really * Another jumped up and started scribbling diagrams and equations on the whiteboard in his office * None of us understands it really

... which leads to:

"For its supporters, the Price equation is the closest thing biology has to E=mc2"

No it isn't. E=mc^2 stands up to experiment after experiment and observation after observation. The Price Equation is at best a conjecture that looks right. Looking right is not generally considered rigorous.

</comment><comment><USER5> Sounds like the reverse of Anti-Life Equation [https://en.wikipedia.org/wiki/Anti- Life_Equation](https://en.wikipedia.org/wiki/Anti-Life_Equation) "", the Anti- Life Equation is a formula for total control over the minds of sentient beings, that is sought by Darkseid, who, for this reason, sends his forces to Earth, as he believes part of the equation exists in the subconscious. Various comics have defined the equation in different ways, but a common interpretation is that the equation is a mathematical proof of the futility of living.""

</comment><comment><USER6> Interesting story but I feel sad for the daughters.

<comment><USER7> As stated by the article, his daughters were happy and thought he did a fine job as a parent.</comment></comment>


The Cops Who Abused Photoshop - <AUTHOR> https://www.theatlantic.com/ideas/archive/2019/08/photoshop-tattoos-oregon/596482/ <comment><USER2> "Contrary to the common assumption that eyewitness identification is strong evidence, it's long been known, and overwhelmingly empirically proven, that eyewitness identifications make for very strong testimony but very unreliable evidence,"

Yet it's the lynchpin of the legal system.

</comment><comment><USER3> The entire article is unbelievable like... from other planet.

</comment><comment><USER4> Could it be that the guy used touch up to hide tattoos before robbery, specifically to use the witness testimony that they saw no tattoos as an alibi? It could actually be a pretty clever trick.</comment>