"Subject: Urgent Warning" - <AUTHOR> http://daniel.haxx.se/blog/2016/01/19/subject-urgent-warning/ <comment><USER3> Ah, this sort of thing is as old as the moon.

We run an eCommerce platform, have a variety of clients using it, they have a number of customers. At least once a week we get an accusation either from a client or an end-user of some outlandish nefarious behaviour, usually due to some complete lack of understanding of the nature of technology.

Way back when, we responded, tried to help, tried to explain, but it tends to be the case that if someone has made their mind up, they've made their mind up, and anything you say can and will be used against you - confirmation bias is a harsh mistress.

The best response is usually no response, I'm afraid to say. It's a drain on your time, they won't be any the wiser unless you're prepared to sink serious time into educating a stranger, and more often than not responding results in escalation, and people doing stupid things like involving lawyers and law enforcement.

Case in point: About six years ago, we had an older guy phone us up frothing about how we'd hacked his wife's computer and she'd accidentally bought something from one of our clients. We explained that it would be hard to accidentally enter your address and credit card details, and that if they didn't want the order they should contact the merchant, not the web developer (they clicked our "ecommerce by" link in the footer of the client site - <USER2> don't do that any more!). We thought that was that. A week later we got a stern phone call from an ombudsman who wanted to know why we were ignoring the distance selling rules and taking advantage of old people... and they didn't understand that we weren't a merchant, didn't place an order on their behalf, either - so months of time were wasted, and we narrowly avoided ending up in court over a non-issue.

Anyway. When you have a conversation with an idiot, nobody watching can tell which one of you is the idiot.

<comment><USER4> > Anyway. When you have a conversation with an idiot, nobody watching can tell > which one of you is the idiot.

A friend of mine who works as a college professor has a fun approach to deal with the kinds of random cranks who contact him out of the blue seeking someone to validate their wild Time-Cube-style theories and "research": he responds to each one by providing an introduction to the previous one. Apparently, he received followups from some of them afterward saying how much they appreciated the introduction and how much it helped them.

<comment><USER5> This idea terrifies me even more than it amuses me. The notion of the long- term influence that could be gained by a network of cooperating Time-Cube- style theorists is enough to give me nightmares.

<comment><USER6> See also the Freemen on the land who pass incoherent legal information on to each other.

<comment><USER7> For a good example of such a case:

[http://captainranty.com/freeman-shafted-by-clueless- judge-2/](http://captainranty.com/freeman-shafted-by-clueless-judge-2/)

<comment> david-given ...I got halfway through that before realising that the author was actually serious rather than using snark!

</comment></comment></comment></comment></comment></comment><comment><USER8> SQLite has had this problem: [https://github.com/mackyle/sqlite/blob/3cf493d4018042c70a4db...](https://github.com/mackyle/sqlite/blob/3cf493d4018042c70a4db733dd38f96896cd825f/src/os.h#L52)

<comment><USER9> [https://www.google.co.uk/search?q=etilqs](https://www.google.co.uk/search?q=etilqs)

Nothing links back directly to SQLite, nice :)

<comment><USER10> Really? I found [https://answers.microsoft.com/en- us/windows/forum/windows_7-...](https://answers.microsoft.com/en- us/windows/forum/windows_7-files/what-are-etilqs- files/fbab1341-acf2-4013-8394-324f2679aa89?auth=1) and others complaining about etilqs files and being told they're created by sqlite. It's probably a failure of the software using sqlite if these files persist to the point they become a problem.

</comment></comment></comment><comment><USER11> About nine years ago now, I worked for a small security startup that managed to make its way up to PCI certification for scanning websites before keeling over dead. It died the "just one more feature before we can release" death, so you've never heard of it. You've probably never even heard of the company that bought it/put it out of its misery. I'm pretty sure the customer base never exceeded the _low_ single digits. Its most impressive moment was when it made the local TV for just... being a startup, basically. (I'm in the Midwest. Startups aren't and weren't _that_ rare, but few of them even tried to get on local TV. At least at the time it wasn't hard to get into the human interest slot, presumably because it was a nice change of pace for the TV station.)

Yet the founders had a _collection_ of letters from people, actual hand- written letters, asking for help with their hacked computers, asking how to hack, at least one probably-paranoid-schizophrenic one about... errr... hacking and the government and chips in brains and all that sort of thing and whether or not this company could help protect them against the hacker aliens (I don't recall the exact details but this is not an exaggeration of the flavor, alas).

There's an amazing amount of this sort of thing going on. At scale the only thing you can really do is ignore them; engagement doesn't go well for anybody, even the sender just ends up more frustrated and angry than when they started if you try so it's not even good for _them_. On an isolated basis you might get lucky, but don't count on it.

Edit: Kinda commenting on the thread above anchored on madaxe_again's comment, let me emphasize that I'm not saying ignore it because you can't be arsed, or because replying is beneath you, or because elitism... I'm saying that ignoring it works out best even for the sender, which is why you should do it. That it happens to be the easiest course of action for you as well is just one of those rare times when the easy action also happens to be right.

<comment><USER12> The Museum of Jurassic Technology in LA has an exhibit of letters written by interested citizens to the astronomers at Mt. Wilson observatory in the early decades of the 20th century ([http://mjt.org/exhibits/letters/letters.html](http://mjt.org/exhibits/letters/letters.html)). Mt. Wilson was famous at the time because Edwin Hubble had just discovered extra-galactic light sources, and the Big Bang, while observing with the 100-inch telescope there.

Most letters are just routine congratulations and thanks. But others have the tone you mention. A sample from 1928:

[http://mjt.org/exhibits/letters/26ezekielp.1dropped_image.gi...](http://mjt.org/exhibits/letters/26ezekielp.1dropped_image.gif)

[http://mjt.org/exhibits/letters/23ezekielp.2dropped_image.gi...](http://mjt.org/exhibits/letters/23ezekielp.2dropped_image.gif)

People have been having fevered imaginings about little-understood technology for a long time.

<comment><USER13> I find it relieving that people were already bad at punctuation 88 years ago.

<comment><USER6> ...and that people have BEEN USING CAPITALS and _underlining_ and different colours for as long as they have.

<comment><USER14> Underlying was used for emphasis since typewriters can't do italics.

I don't know how they did the different ink thing.

<comment><USER15> I remember this one, from using a typewriter back about 45 years ago, when I was a kid. You could get a dual-color ink ribbon, and could shift the ribbon up to print in red instead of black. Haven't thought of or seen that for many decades.

</comment></comment></comment></comment></comment></comment><comment><USER16> If you desire to respond, I would relate the topic to her field. She claims to be a photographer. Surely she has a vague idea of copyright law. I would explain that you had developed a piece of Intellectual Property and licensed said property in a specific form -akin to taking a photograph. The person who takes a photograph owns the copyright. It just so happens that Spotify and Instagram, "enjoy your work" and have decided to make use of your work under the license you have given.

<comment><USER17> or, even easier to understand analogy: Daniel is the person on the photograph, Spotify/Instagram are the photographers and the hacker is the person who just stole the picture.

<comment><USER18> I fear you're still overcomplicating it: Daniel is a battery manufacturer. The person complaining bought a camera from Spotify, which came with one of Daniel's batteries inside. Someone stole that camera.

(It's not perfect, but it's probably as close as you're going to get)

<comment><USER19> Most people don't associate batteries with cameras these days..

<comment><USER20> Daniel built the camera lens that is mounted on your camera; the hacker managed to make your camera send all the photos on his computer.

</comment></comment></comment></comment></comment><comment><USER21> This came today on a friend's facebook page (he's in IT/QA/etc.) - [http://imgur.com/mnfQe3V](http://imgur.com/mnfQe3V)

"My facebook suddely split in half and this screen popped up with all these random cyber space options and it was like watching and assessing things soooo weird? and talking about child... and children being forced WTF????? is this some sort of cyber police thing that my IP was accedently allowed to access so i could help stop child abuse on the net or am i going crazy???? has this happened to anyone else??? - :(( - feeling confused".

[what happened, was that this person most likely clicked F12 or Ctrl+Shift+I - and brought up the chrome/firefox/etc. developer console]

<comment><USER22> I'm gonna go with satire here, since that's showing the Firefox Developer Edition console.

<comment><USER23> Pretty sure that was added after to show what she was talking about

</comment></comment></comment><comment><USER24> My name and email address is the very last thing in the Waze about box, because they used some code I open sourced. Turns out it's the only email address anywhere in the app.

Thanks to this, I get about a dozen emails a week from people asking for Waze help. (Lots more when Waze changes something, like hardware support for a particular device!)

I've tried contacting Google (either to get these people help, or to get my email address removed...) with no luck.

I empathize with Daniel. It's an unexpected downside to open sourcing something and asking for credit.

<comment><USER25> What license did you give Waze for using your code? Your repo (I'm guessing [https://github.com/robterrell/TVOutManager?](https://github.com/robterrell/TVOutManager?)) doesn't mention the license, so Waze either shouldn't be using it, or you've specified some license to them directly. Did you pick a license with an attribution-required clause?

<comment><USER26> The last item in the Waze about box is indeed for TVOutManager.

</comment></comment></comment><comment><USER27> Definitely agree with one of the comments on the blog - the domain (haxx.se) really doesn't help the author's case here when trying to explain to a layperson.

<comment><USER27> Also, from [http://daniel.haxx.se/blog/about/](http://daniel.haxx.se/blog/about/)

>I'm Daniel Stenberg, a network hacker working for Mozilla.

Sigh. Why does everyone have to be a hacking rockstar ninja? What's wrong with not using a word that has negative connotations to the rest of the world, and just calling yourself a developer/engineer?

<comment><USER28> Why all the downvotes for this comment? I think the point is reasonable. It's fine for us to use the word "hacker" in the non-criminal sense among ourselves (for example, the title of this site), but not where the general public is likely to see it and misunderstand it.

<comment><USER29> > but not where the general public is likely to see it and misunderstand it.

So nowhere. It's on the public internet which is where 'the general public' is likely to see it so suggesting that you don't use some phrase where 'the public' can't see it in practically means you can't use it anywhere.

I know the last thing I want to do is self censor myself everywhere because someone somewhere might get offended.

<comment><USER30> It's not "self-censorship," it's understanding that the generally-accepted definition of a word is different from it's obscure jargon meaning. The word "hacker" has meant "someone who maliciously breaks into computer systems" since at least the 1980's (thirty years ago, before some HN readers were even born). Languages are fluid.

<comment><USER29> Yes languages are fluid but words also have various meanings. If we have to prevent ourselves from using some word because others may find it offensive, that is self-censoring.

OP tried to get around that by trying to say that when you could be heard by 'them' you shouldn't use those words, but this is the public internet. You are always communicating in the presence of those that will be offended.

<comment><USER30> This isn't a matter of anyone being "offended," though. No one finds the word "hacker" offensive, they just might have a completely different definition of it depending on what their experiences are. You might as well use a word that's unambiguous.

Likewise, editing a paper to remove grammatical errors is also not "self- censorship." It's improving the clarity of your message.

<comment><USER31> What word or words do you suggest that are fully, completely, 100% unambiguous identifiers in this instance?

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER32> "Attack of the Repo Men":

[http://www.acme.com/software/thttpd/repo.html](http://www.acme.com/software/thttpd/repo.html)

The only way to win is not to play.

</comment><comment><USER33> Honestly, I wouldn't even respond. I would imagine any response you give is going to be twisted as your original ones have been. You've tried to be reasonable, and you don't owe her anything - don't engage her any further.

<comment><USER34> One of the suggestions on the blog comment is good, explain the issue in term of car and parts, people usually get that.

</comment></comment><comment><USER35> I once received a request to hack a load of different companies' client databases due to one of my posts in the HN "Seeking freelancer" job threads, pretty much well solely because "Hacker" is in the site's title.

Bless him, the guy _mostly_ kept on signing off his emails as "John," having forgotten to change his name in the "From" field, except for the time he forgot and signed his "real" name again.

(I say "emails" \- it was a bizarre few exchanges, starting with "I have a job for you," and myself replying to his opaque emails to find out _quite what on earth_ the guy was on about)

<comment><USER36> That's actually kind of cute. He was trying to act all secretive, a 'job' for you. :)

</comment></comment><comment><USER37> This reminds me of the case when some state or local agency got the default CentOS / Apache page and they contacted them as if they were hackers.

EDIT (thanks mariuolo): [http://www.theregister.co.uk/2006/03/24/tuttle_centos/](http://www.theregister.co.uk/2006/03/24/tuttle_centos/)

<comment><USER38> That was the city manager of Tuttle, Oklahoma.

<comment><USER3> You're sure it wasn't Buttle?

</comment></comment></comment><comment><USER39> The author information is part of the user interface, and can be as confusing as every other UI aspect. It should be carefully designed such that it is clear what the author takes responsibility for and what they don't.

Some years ago there was a similar issue with the default Apache website on CentOS. Somebody that their webspace being reset by their hoster, but rather than complaining to the hosting community, the user complained to the contact info shown on the default website, claiming they had hacked their website. (Sorry, couldn't find the link of that story anymore.)

<comment><USER40> The CentOS story was named 'the Tuttle hack'. Googling for 'Tuttle hack' finds relevant links:

[https://lwn.net/Articles/177085/](https://lwn.net/Articles/177085/)

[https://web.archive.org/web/20060427011138/http://www.centos...](https://web.archive.org/web/20060427011138/http://www.centos.org/modules/news/article.php?storyid=127)

<comment> david-given That conversation is very sad --- an absolute textbook example of how not to handle this kind of issue.

Instead of complicated, technical and annoyed explanations of what Linux was to someone who obviously just doesn't care, the simple statement that:

        Sorry, we make components for websites. This just means that your web people are using one of our components and has set it up wrong. You'll need to talk to your IT people; they'll be able to point you at someone who can help.

...would have gone a long way towards defusing the situation.

Given their first reply ('...we produced it for free and you are able to use it without paying us ... and are even threatening to have us arrested...') no wonder the conversation went badly. That's just being an arsehole.

<comment><USER41> "Sorry, we make _flurble glurble purple_." (user's eyes glaze over, rest of line remains unread)

</comment></comment></comment></comment><comment><USER42> Lest Stenberg get tangled up too much in the email-sender's unfortunately troubles, he should likely refer the emailer to Instagram and Spotify's customer support.

As an aside, hopefully someone can recommend to the emailer as well to use a different service to host high-quality versions of her photography so that potential clients can evaluate critical clarity in her technique. I'm not sure I'd want to rely on Instagram as the sole example of my work, but, maybe she's targeting a different clientele that I'm imagining.

As an aside (#2), who hacks Spotify accounts?

<comment><USER43> > As an aside (#2), who hacks Spotify accounts?

My first guess when reading the article is that her Facebook account is compromised and that she uses facebook login for both spotify and instagram.

<comment><USER44> That makes a great deal of sense, as there's no obvious benefit to the data you would get from a compromised Spotify.

Older people also use the word "hacked" to mean a too-wide set of things, from "broken" to "locked out" to actually owned.

</comment></comment></comment><comment><USER45> It's not exactly the same, but it reminds me of something I heard a few years ago. I knew someone who worked at a small non-profit. Once a year they'd do a particular fund drive that involved calling their previous donors and either talking with them or leaving a message asking them to please donate again. And every year, they'd get a message back on their machine saying only, "Please take me off your list!" They had no idea who the caller was, and she never answered the phone when they called her, so they could never take her off the list!

<comment><USER46> Having worked for a Real Estate webhost who provided email campaigns as a service, we got those all the time. Someone who wasn't subscribed in the system, but was receiving our spam nonetheless. These were usually due to an email distribution list being subscribed and that person being on that DL. Unfortunately some of these were distribution lists of distribution lists, so we couldn't see the original DL address to unsubscribe it, or help at all.

</comment></comment><comment><USER47> Sorry, it's pretty ridiculous that the author chose to write all that and engage in correspondence without mentioning the elephant in the room either to the photographer, or to the reader (us) in this write-up. The elephant in the room is that haxx.se is a tongue-in-cheek name (or a coincidence.)

Would it have killed him to mention this?

"Dear Photographer Lady: I run a very well-regarded library, you may have had this reaction because I have the tongue-in-cheek name haxx.se [alternatively: because of the coincident name haxx], however I am a well-paid consultant similar to yourself and other than this choice of domain name there is nothing alarming. The library is famous and you should see a similar notice in all of your friend's phones (or anyone else's you check). It is in use by major corporations including Apple and Spotify. Sorry about the confusion."

that's literally all this is about. (obviously.)

In fact, it makes me seriously question the author's good faith that he ends with the call-to-action "I've tried to respond with calm and clear reasonable logic and technical details on why she's seeing my name there. That clearly failed. What do I try next?" without mentioning the elephant in the room.

</comment><comment><USER48> TIL Spotify is a major partner of Spotify.

</comment><comment><USER49> Seems to be down, here's a cached version: [http://webcache.googleusercontent.com/search?q=cache:_tJLn3s...](http://webcache.googleusercontent.com/search?q=cache:_tJLn3sVzMYJ:daniel.haxx.se/blog/2016/01/19/subject- urgent-warning/+&cd=1&hl=en&ct=clnk&gl=us&client=ubuntu)

</comment><comment><USER50> I can't count how many mails I got via php.net webmaster and security mails (yeah, I admit my involvement there ...) from people who locked them out from some website with a "powered by php"-button and asked me for a password reset. The picture of the producer of a screw in a machine often seemed to work.

</comment><comment><USER51> Unfortunately in this kind of cases more technical you get and try explain things, more they think that you have something to do with it. If you still want to try to convince her, then ask her to check the same information from any of her friends devices or any other device, so she can confirm that your name can be seen in all of them. This is simple enough that she can do herself. If I would you, I would just forward the email to Instagram support.

</comment><comment><USER52> > "I came across this information using my Spotify which has also been hacked > into and would love your help hacking out of Spotify. Also, I have yet to > figure out how to unhack the hackers from my Instagram"

You keep using that word, I don't think it means what you think it means.

In all seriousness though, she went to the ToS for help with the Instagram app? Why not write Instagram support directly?

<comment><USER53> Instagram support is an utter joke, accounts are routinely stolen/disabled and Instagram doesn't offer much support besides a pat on the shoulder and a "there there"

</comment></comment><comment><USER54> Site is broken, here's a link/mirror in googles webcache:

[http://webcache.googleusercontent.com/search?q=cache:http://...](http://webcache.googleusercontent.com/search?q=cache:http://daniel.haxx.se/blog/2016/01/19/subject- urgent-warning/&num=1&strip=1)

</comment><comment><USER55> I'm starting to believe to use my real name for my email address was not a very wise choice (email@example.com).

<comment><USER56> Oh wow, I never thought about how Hungarian names sound in English.

A website where you input a name and it spits out if it contains profanity in any language would be useful.

But yeah, you should definitely change it.

<comment><USER57> There's one made by a HN user: WordSafety [http://wordsafety.com/](http://wordsafety.com/) "Show HN" thread: [https://news.ycombinator.com/item?id=10117297](https://news.ycombinator.com/item?id=10117297)

</comment></comment></comment><comment><USER58> [https://webcache.googleusercontent.com/search?q=cache%3Ahttp...](https://webcache.googleusercontent.com/search?q=cache%3Ahttp%3A%2F%2Fdaniel.haxx.se%2Fblog%2F2016%2F01%2F19%2Fsubject- urgent- warning%2F&oq=cache%3Ahttp%3A%2F%2Fdaniel.haxx.se%2Fblog%2F2016%2F01%2F19%2Fsubject- urgent-warning%2F)

</comment><comment><USER59> Personally this brings up a very ridiculous and rather humorous observation on the nature of ToS agreements:

Intelligent people don't bother reading them closely, and the people who have read them often use the information contained in rather stupid ways.

Granted I have spent many hours over the years reading contest / entry rules and ToS type documents, so I'm pretty comfortable picking on myself a bit here and there. Often I've read a very clear ToS and then observed the responsible company basically disregard their own rules and stated processes. Two notable examples were for a Deadmau5 remix project (he 'lost his laptop' and they stretched the contest for a couple months, barely supplied any promised materials, etc) and a Local Motors contest (routinely lied about what they were looking for as judging criteria, then claimed to contact winners on day X to start authorization process, instead vetted winners in advance and then used day X to announce). I've used these experiences to temper my trust of any online engagement or contest, because it's nearly impossible to hold any provider accountable when they're dishonest or just inept.

Antagonizing bothersome people is a form of entertainment [1] from time to time. If there's nothing to be gained from actually being constructive, then being obtuse might be the most worthwhile course of action. YMMV.

[1] [http://dontevenreply.com/view.php?post=111](http://dontevenreply.com/view.php?post=111)

</comment><comment><USER60> > "Also Spotify is a major partner of Spotify"

It reads like text generated by a computer

</comment><comment><USER61> This sort of confusion could be partly resolved if apps with "License" or "Legal" screens would actually have a little explanatory paragraph at the top, explaining what it is they contain in layman's terms. For the average person, I imagine that scrolling through one of those would be quite bewildering, especially if WTFPL stuff was in there.

</comment><comment><USER62> Maybe advise her that she have a lawyer explain it to her or one of her friends look at it and explain it to her.... ie delegate.

</comment><comment><USER63> Reminds me of back in the late nineties I developed a freeware email client. The client header in the send emails said "???mail by www.example.com"

I tought it might give me more users... What it gave me was lots of angry emails once someone used my mail client to send out spam. That header was gone pretty quickly.

</comment><comment><USER64> The "hacking ring" accusations remind me of the ill person who used to harass a friend from their time at DailyBooth, incredibly weird situation.

It's pretty unnerving because the person clearly needs some assistance but also thinks you are the bad guy.

</comment><comment><USER65> "You know how when the credits roll on a movie, it shows a list of songs the movie has licensed? Same goes for software. I have as much ability to influence Instagram as Mozart does to influence the movies his music is in."

</comment><comment><USER66> So there's a lot of "LOL LOOK AT THIS DUMB PERSON I AM SO MUCH SMARTER THAN HER!" going on here, especially in the reply that he seems to have sent her.

Here's what's going on. Her IG account may, in fact have been hacked. This happens. She's obviously afraid and angry. She is the kind of person who thinks she can solve all of her own problems, and found the licenses section of the app, which included something with a nonsensical name (libcurl) and a domain "haxx.se". Despite having known that haxx.se is for libcurl basically forever, I occasionally see it and associate it with gray or black hat stuff before I remember. So it's not at all surprising that a non-initiate saw this and thought it might have something to do with her IG account being hacked.

Daniel says his reply to her original email was "clear and rational". It should have been "understanding, compassionate, and patient". This is someone who is seriously freaked out, because her livelihood is at risk, and based on the fact that she went digging through the app, she is probably having what a shrink would call a "crisis of control". So here's what the author should have done:

1 ) Patiently explain what libcurl does (it let's programs request web pages, just like a browser). Explain that he's the author, but he's given it away for free. The license is in the app because he took pains to ensure that nobody can package it up with some slick marketing and sell what he's giving away free.

2 ) Acknowledge that haxx.se sounds kind of shady. Explain why he chose the domain. Self deprecating humor would be great here. Explain that despite this, all kinds of apps use libcurl for perfectly benevolent purposes.

3 ) Explain that he has nothing to do with instagram (commenters have suggested the car parts analogy, which seems like a good plan).

4 ) Finally, and most importantly, link her to their hacked accounts page! They have people paid to deal with this stuff, who are much, much better at dealing with panicking laypeople.

There is a lot of "reason good, feelings bad!" stuff in the tech community these days. It makes people see us as a bunch of borderline autistic[1], self centered, stuck up, evil nerds. Many of us, myself included, were terrible with social interactions and dealing with our feelings at some point in our lives, so the finer points of human interaction and emotional thinking left a bad taste in our mouths. But we've all grown up. We aren't social rejects and evil nerds anymore. We have lives, careers, friends, and family. We need to let go of the stuff we suffered in our youth, forgive those "stupid popular kids", and learn how to be nice.

[1] In the sense of the popular conception of borderline autism, not the clinical condition, which generally doesn't make you a jerk.

<comment> david-given Yes, absolutely. The whole episode is actually pretty sad and using it for laughs makes me uncomfortable.

...

As a tangent, you say:

> 2 ) Acknowledge that haxx.se sounds kind of shady. Explain why he chose the > domain. Self deprecating humor would be great here.

I work in a big multicultural office --- I'm the only UK person in my team. We occasionally have these tedious courses on defusing disputes. One of the things they said that was actually helpful is that humour's generally not a good idea; it's way to culturally specific, doesn't translate well, and in particular doesn't come across in text.

Something which to a fellow UKer is obviously self-deprecating snark can look absolutely serious to someone from another culture, and can frequently make stuff worse.

I saw an interesting study the other day on punctuation in text messages. Even as simple a change as using a ! instead of a . at the end of a sentence can have a huge difference in the impact the message has...

<comment><USER66> That's not something I'd thought about. I work in a multicultural office too, but we were all raised by the internet, so internet flavored humor is generally universally understood.

</comment></comment></comment><comment><USER67> I think I might try to explain it this way:

It's like he makes paint. He mades this really cool shade of red paint that everyone likes. One day, some really mean dude used this guy's paint to paint his car red. He then used that car to go on a crime spree. The victims of the crime then went to the guy who made the paint demanding their stolen money back.

<comment><USER68> Wait, are you saying the bad dude is Facebook, or the hackers who got into her account?

</comment></comment><comment><USER69> Dear Sir/Madam,

You have contacted the software design company that licenses these commerce systems to merchants. We do not deal with the merchants' customer service. Please directly contact the merchant instead.

This is an automated message and you cannot reply to it.

</comment><comment><USER70> Well, if she found thieves had the lock of her bike cracked open with a steel cutter, she wouldn't call the manufacturer of the cutter either and accuse them of thievery, would she?

</comment><comment><USER71> How terrible would it be to just create new accounts?

<comment><USER72> That's not her problem. She's her own worst enemy.

> help me salvage my original Instagram photos, pre-hacked, despite Instagram > serving as my Photography portfolio and my career is a Photographer.

</comment></comment><comment><USER73> Urgent: use cache before hitting your DB all the time in your blog :P * website is down * (an easy way to do that is with cloudflare)

</comment><comment><USER74> This link now goes to 'download.gz'.

</comment><comment><USER75> I think the proper response is something along the lines of "did Michelin Tires hack your car?"

<comment><USER76> this requires interpretation and analysis of an analogy, something most people are terrible at (back when i took the SAT this section was a source of frustration among my peers - i suspect all high scorers had a knack for it).

</comment></comment><comment><USER77> webpage down?Any link to a cached copy?

</comment><comment><USER78> >haxx.se

</comment><comment><USER79> 452aeed4794ff312e6963a043b17676f

</comment><comment><USER80> I think it best not to use your actual name in such an email/web reference so you more easily ignore the lunatics.

</comment><comment><USER81> I think you are misusing the phrase "nothing to do with." It seems to me that you in fact did have something, however indirect and misunderstood by the emailer, to do with these products. I, on the other hand and for example, had nothing.

<comment><USER82> I think you must have missed the end of his sentence:

"...I also have nothing to do with Instagram other than that they use software I've written."

I think that's an adequate description of his relationship with Instagram.

<comment><USER81> My only problem is with the use of "nothing to do with". I'm sure it's just me but, as I tried to explain in my comment, that's a pet peeve of mine. If you had "nothing" to do with it, what word would you use to describe what _I_ had to do with it?</comment></comment></comment>


Peter Molyneux may have just monetized trolling - <AUTHOR> http://gamasutra.com/view/news/190865/Peter_Molyneux_may_have_just_monetized_trolling.php <comment><USER3> "players have so far paid to remove nearly 14 million cubelets, while adding an extra 4.7 million."

Wow I almost spit out my tea when reading that while wrongly assuming each block was $0.99

Then I followed the link in page and discovered that the $6.99 point is for 100,000 units.

So figure ~200 of those sold or about $1000 after App Store fees.

I can now sleep tonight.

</comment><comment><USER4> After decades of trying to mke better and better videogames, always more realistic, Molyneux shows that the average human is, in fact satisfied by a Skinner box and will gladly pay for it.

<comment><USER5> Do you honestly think the _average_ human being is busy playing Curiosity?

<comment><USER4> Re-read my post. I didn't say the average human being is busy playing Curiosity; I said that the average human is fully satisfied interacting with a Skinner box.

<comment><USER6> Re-write your post. You said Molyneux showed something about the average human. You can't backpedal that into a statement not involving Molyneux.

<comment><USER4> > you said Molyneux showed something about the average human.

Yes.

> You can't backpedal that into a statement not involving Molyneux.

I didn't backpedal; you can change "I said that the average human is fully satisfied interacting with a Skinner box" to "I said that the average human is fully satisfied interacting with a Skinner box, as shown by Molyneux's Curiosity", if it makes you happy, but it doesn't really change anything.

<comment><USER6> Kronopath challenged the idea that the people playing Curiosity are in fact average. I don't know if you read his comment as a silly statement regarding billions of people playing the game or something, but there is legitimate argument to be made that the average Curiosity player is far away from the average western citizen.

If the average Curiosity player is not even close to an average person (such as what if 80% of them had OCD), then your statement that Molyneux has showed anything about the average person is incorrect.

So please, either disagree with Kronopath or point out a flaw in my logic, let's not mess around with semantics and restatements.

</comment></comment></comment></comment></comment></comment><comment><USER7> _"...players have so far paid to remove nearly 14 million cubelets, while adding an extra 4.7 million"_

Adding 500,000 cubelets costs $10.99, which implies that people have paid ~$103 to add cubelets over the course of 166 days, or around 62 cents per day. Gross revenue from all cubelet sales in either direction is ~$405 or ~$2.43/day. He may have monetized trolling, but it doesn't seem very profitable.

<comment><USER8> > Adding 500,000 cubelets costs $10.99, which implies that people have paid > ~$103 to add cubelets over the course of 166 days, or around 62 cents per > day. Gross revenue from all cubelet sales in either direction is ~$308 or > ~$1.85/day.

Your numbers are way off, as is the timescale. The ability to add or remove cubelets is a new feature, released on April 17th. At ~$405.75 to change the cubelet levels using the most economical price ($10.99 for 500k, or $21.98 for 1 million, over 18.46 million cubelets[1]), that's ~$101.44/day.

[1]: "...users have paid to remove 13,780,000 cublets and add another 4,680,000" from [http://www.eurogamer.net/articles/2013-04-19-molyneux- adds-o...](http://www.eurogamer.net/articles/2013-04-19-molyneux-adds-option- to-re-grow-curiosity-cube)

<comment><USER7> Actually, they are not. The article indicated that the experiment had been going for 166 days (164 days, but it was written two days ago). $10.99/500K=$0.00002198 per cubelet. 0.00002198 X 18.46M total cubelets sold = $405. $405/166 = $2.43/day.

<comment><USER8> The experiment has been running for a few months yes, but like I said, the feature to add or remove cubelets is new for version 3.0, released on April 17th. Check the Eurogamer article I linked to (also linked in the original article).

</comment></comment></comment></comment><comment><USER9> This is insane. This is literally just incrementing and removing a counter, and 22cans has become the middlemen for this.

<comment><USER10> PROGRESS QUEST.

Caps lock because it's that cool.

<comment><USER11> Sadly, Curiosity is not quite as good a game as PROGRESS QUEST; it still requires too much player input.

</comment></comment></comment><comment><USER12> I'm amazed that people are still buying into his games. If you were to go by Peter's history, it's quite likely that the "life-changingly amazing" thing in the middle of the cube is a message like "Sorry Mario, but the princess is in another cube".

I personally got burned somewhere around Fable and I'm never[0] going to get one of his games again..

[0] except for maybe Godus.. maybe.

<comment><USER13> I don't care what people say, Black and White was an excellent game which was much too far ahead of its time.

<comment><USER14> [Disclaimer: I don't know B&W 2, I'm basing myself only on the first B&W]

Black and White was a good game which unfortunately was far behind what its originating concept promised to deliver.

</comment></comment></comment><comment><USER15> As someone who had paid money to remove cubelets before this was introduced id feel somewhat ripped off.

I also wonder how this game would be doing with similar marketing but without Molyneux' name to it. Imo the golden days of the guy are long gone.

<comment><USER16> > As someone who had paid money to remove cubelets

As someone who never pays for in-app purchases, I am quite curious why you did this. Did you feel the purchase was worth it?

<comment><USER17> To quote more fully:

"As someone who had paid money to remove cubelets before this was introduced ID feel somewhat ripped off." Note the emphasized (by me) "ID" or "I'd", aka "I would". This one word changes the entire case of the verb and implies empathizing with a hypothetical victim versus actually being one.

<comment><USER18> Except... can you use "id" instead of "I'd"? My language parser also rejected this as invalid token and I ended up interpreting that sentence the same way Xcelerate did.

</comment></comment></comment></comment><comment><USER19> Holy motherfucking shit. This is not a game, this is something else. This is sick. This is abusive... This feels akin to exploiting a mental vulnerability that exists in a portion of the population to earn money. Its a strange situation where it is legal to do something to a human that is illegal to do to a computer.

<comment><USER20> >>>This feels akin to exploiting a mental vulnerability that exists in a portion of the population to earn money

Ermmmm, that is what some advertising and marketing are all about, creating insecurities in people and then selling them the "cure."

<comment><USER19> At least when you are being advertised you actually get something out of the deal. If I convince someone to voluntarily empty their bank account and give me everything in exchange for nothing, that would make me a shitbag. Or a televangelist, I guess.

</comment></comment></comment><comment><USER21> This exemplifies that making money and making a good product are two quite distinct things.

</comment><comment><USER22> I wouldn't exactly say that this is monetizing 'trolling'

<comment><USER23> I'm also appalled that a gaming site would confuse "trolling" and "griefing".

<comment><USER24> Hm?

<comment><USER25> Griefing is just being annoying, while trolling is both a art and an science.

<comment><USER26> I see what you did there.

</comment></comment></comment></comment></comment><comment><USER27> Did he? I'm fairly sure I saw that on the _PetetMolydeux_ parody Twitter account.

<comment><USER28> According to Eurogamer [1] it is announced in the app itself, but yes it was also tweeted by @PeterMolydeux [2] - I guess it's never been easier to parody someone...

[1] [http://www.eurogamer.net/articles/2013-04-19-molyneux- adds-o...](http://www.eurogamer.net/articles/2013-04-19-molyneux-adds-option- to-re-grow-curiosity-cube)

[2] <https://twitter.com/PeterMolydeux/status/325281598444556288>

</comment></comment><comment><USER20> Now I can't help wondering how many other things this "Get them coming and going" idea could be applied to in games. Is this as unprecedented as they make it out to be in the article?

</comment><comment><USER29> I'm very surprised at the gullibility towards the whole project. Who's to say they don't add more cubelets by themselves for free?

</comment><comment><USER30> well, I have to give Molyneux some credit where credit is due.

This is incredibly clever and a great way to use IAP-type stuff.

</comment><comment><USER31> What is the estimated number of cubelets or layers remaining?

<comment><USER8> There were 4,096 total layers; currently 262 layers have been removed with 17,758,801 cubelets left on the current layer. So 3,834 layers and 112,689,867,042 cubelets remain.

The cube age is 166 days, so at the current rate of progress (~148,787,753 cubelets per day), it should take another 758 days to complete. However, the rate has been slowing from over 2 layers/day at the start to just over 1.5 layers/day. Combined with user attrition and this new ability to add/remove layers, it's hard to say when exactly it'll be completed.

<comment><USER32> There are only 2048 layers. I used the statistics from [1] at 5:20 from day one.

Layer 1, 66,631,501 cubelets remaining on the current layer and 33,982,651 cubelets destroyed in total. Because it is the first layer it is made up out of 66,631,501 + 66,631,501 = 100,614,152 cubelets. An estimate of the edge length is obtained by dividing by 6 faces and taking the square root and this yields 4,095.0000407. It is a bit counterintuitive - at least for me - but the actual edge length is 4,096. I would have expected that counting the edges twice and the corners trice becomes insignificant for large edge lengths but if you do the math you will see that this approximation has the limit n - 1 as n goes to infinity.

So because every layer adds 2 to the edge length there are 2048 layers. That is bad - there is no central cubelet because the edge length is not odd. Maybe this is the hidden secret. I guess they used 4096 because it simplifies texturing the thing, implementing level of detail or stuff like that, does it? Or they have 8 secrets in there to make it a tiny bit more fair.

One more thing, the number of cubelets on the surface of a cube with edge length n is n^3 - (n - 2)^3 - the whole cube minus the smaller cube under the surface. Plugging in 4096 yields the number obtained from the statistics so we probably made no mistake.

Okay, let's fix the other numbers, too. The cube started with 68,719,476,736 cubelets. I assume the current layer was 263 - the statistics gives the number of layers removed and layer 263 seems to be more consistent with the time of the comment - and there are 23,220,183,736 cubelets in those layers. Subtracting the 17,758,801 cubelets remaining yields 23,202,424,935 cubelets destroyed in 166 days or roughly 139.8 million cubelets per day. There are 45,517,051,801 cubelets remaining and assuming the same rate of destruction this yields roughly 326 days to go.

[1] <https://www.youtube.com/watch?v=giEykqDoUCQ>

<comment><USER6> I can help your intuition with the n - 1, I hope. It's true that it's negligible when you're handling cube roots. But when you're cutting down to faces you end up ignoring the entire inside of the cube, so edges can cause problems. Looking at a single face, you have four edges that must be shared, so give away two edges a keep two edges, and you very easily result in a square of n-1 on every face.

<comment><USER32> I like the idea of embedding n - 1 squares in each face, it is quite intuitive...but not fully satisfying. It would be nice if exactly six n - <USER2> squares would fit into the surface...but no, there are two additional uncovered cubelets. Two is again unintuitive to me - 6, 8 or 12 and I would be happy. On the other hand unintuitve results make me redo the work to find the mistake and so unintuitve results are less likely wrong and that in the end is a good thing.

After spending some more time thinking about my initial reasoning it became a bit more intuitive. I thought there are O(n^2) cubelets on each face and the error with the edges is only O(n) so the error should become negligible and it does - the linear error becomes a constant error of less than 1. I just expected it would approach 0 and this is not true.

And now I will stop bothering - my intuition is not the best in this area and I will just have to calculate everything. I just realize that I can not even easily say if the approximation over- or underestimates...we use some cubelets twice, so we under...over...underestimate the area of a face...no, over?...under!...

</comment></comment></comment></comment></comment><comment><USER32> I find it odd that the edge length is even.

</comment><comment><USER33> It's hilarious when someone finds two actions that are opposites of each other and collect on both sides from people who want to take part in each.

I had a similar thought. I worked for a truly evil (management-wise; the engineers and PMs are fine) startup in the winter of 2011-12 and I've been debating whether to name-and-shame. The ethical problem I have with it is that, while I could easily kill the company (publicity-wise, but that would be enough) it would be low-level engineers who get fucked and the shitbag managers would probably bounce along fine. That's why I haven't done it. (After embarrassing a less-deserving company whose name starts with G, I'm more hesitant about public whistleblowing.)

However, if I ever end up in financial hardship I can't get out of, I'm going to start a Yes and a No project (maybe on Kickstarter, if they don't mind?) If "Yes" raises more money, then I name the evil startup that inspired my hatred of VC-istan, and out its scumbag executives in excruciating detail (including stuff about their families that I found later on). If "No" wins, then I keep it a secret. (Obviously, the losing side gets back their money.) I'd probably have to preclude the company itself, and its managers, from funding the "No", lest I get an extortion rap.

This could be a brilliant or fucked-up-evil startup idea. People who are cash- strapped and need to raise money take issues in their lives from the mundane ("should I sell my furniture?") to the important ("should I go back to school?") to the extreme ("should I out my scumbag ex-manager?") into the public and set up Yes/No races. On one hand, it would help a lot of people. On the other hand, it'd be hard to set it up so it doesn't become a vehicle for extortion.

<comment><USER34> Maybe save it for an example in your book? Your blog already has enough great material to establish your place at the forefront of modern philosophy. Now it's just a question of marketing. Kickstarter campaign for your book sounds good. And to those who have down voted Mr. Church I can only say, how dare you.

<comment><USER35> Well played; I read your post while taking a sip and now I can't stop coughing/laughing.

</comment></comment></comment><comment><USER36> A sucker and his money were lucky to get together in the first place.

</comment><comment><USER37> I think that in by this point in time, it's a pretty safe rule of thumb to take everything Peter Molyneux says with a very large grain of salt.

</comment><comment><USER38> Title doesn't really make sense. This is just a lottery, with a bit of a PvP angle. Spending more increases odds of winning.

<comment><USER39> > Spending more increases odds of winning.

Does it? I was under the impression the winner would be whoever removed the last cube, which would be un-affected by how many cubes users removed earlier.

</comment></comment><comment><USER40> Can someone reference the post here (or possibly on reddit) that described how technically infeasible this project is to be accurate?

<comment> lost-theory <http://lucumr.pocoo.org/2012/11/12/death-by-million-cubes/></comment></comment>


Basic Flavours - <AUTHOR> https://basicflavours.com/ <comment><AUTHOR> New cooking website dedicaded to mediterranean recipes. Betting on a pop style recipes videoclip. A new vision and fresh air for the genre.</comment>


Should I Spend $1k on a Smartphone? - <AUTHOR> https://www.wired.com/story/should-i-spend-1000-on-a-smartphone/ <comment><USER2> The question I find fascinating is whether we should spend $100 for a hard case to protect our $1000 smart phone. I bought an Otter case for my current iPhone, and it's saved my phone 6 times from a fall of 3 feet or more (I know, because I scratch a tick mark into the case each time).

The comment I get most often is how bulky my phone is with the case. It's a tradeoff.

A lot of damage could be avoided with a lanyard, but none of the iPhones have lanyard holes. Nearly all early cell/mobile phones, and small audio devices had this feature. Cameras have had straps and lanyard holes for years. Why not the iPhone??</comment>


One OS to Rule Them All (guess which one?) - <AUTHOR> http://benparr.com/2012/02/one-os-to-rule-them-all/

<comment><USER2> Yes, iOS and OS X are basically a single OS. Only they support different hardware platforms, run completely different apps, provide completely different SDKs, have completely different UI guidelines, and serve completely different use cases.

Other than that, who could tell the difference?

The reality is that the AppKit (OS X) and UIKit (iOS) SDKs are actually diverging, not coming together. There isn't so much as a hint of traditional keyboard+mouse UI support in the UIKit SDK, which means that iOS apps are not coming to mouse-driven desktop anytime soon. And while many new AppKit features are inspired by iOS (e.g., view-based table views), the AppKit engineers have made no effort to keep those features source code compatible with their iOS counterparts.

Apple has made it clear. These are two different SDKs on two divergent paths.

<comment><USER3> Not to mention even the most basic Foundation data structure classes are different. iOS's Foundation comes with less data structures than OS X's and has different performance characteristics tailored to mobile hardware.

</comment></comment><comment><USER4> "Oh, and one more thing: OS X Mountain Lion boasts complete integration with Twitter, just like iOS. Microsoft will need Facebook integration in Windows 8 more than ever if it's going to catch up to Apple (remember, Microsoft is a Facebook investor)."

This paragraph really makes my blood boil. I suspect "complete integration" means the same thing it does on iOS, oauth without an NSWebView. What, when I right click I'll be able to tweet the text I've selected? Give me a break.

There is little need for anybody to "catch up" to a feature that everybody already has. Now logging in with twitter is slightly easier and faster. I can hear you already, "twitter integration gives users a default account and eliminates the mental friction of signing into things". I'm sorry, how many programs do you log into daily? You generally log into web apps, and the browser already has pretty good oauth support.

This is a fantastic opportunity for Twitter, I wish I knew how much iOS5 has helped them grow, but I bet being shoved in the faces of OSX users will drive adoption even more. It's also a good move for Apple, they get to say "now we've integrated twitter across both iOS and OSX."

So, it's good for Twitter and good for Apple; Let's not pretend it's good for consumers.

<comment><USER5> Twitter integration will bring close to nothing, because most of the things we do happen in browsers nowadays, and you have tons of plugins or addons to do the job of integrating Twitter or Facebook without leaving your browser and it works just as well.

I can see the need to integrate twitter directly in a phone OS, where you can share pictures directly as you take them with the camera software, but on desktop it does not really have much practical use. And Facebook integration in Win8 ? To further enhance the destruction of privacy and blur the lines between what's on your desktop and what's available to everyone...? I do not see this as adding much value either.

The author clearly fails to point out "what's in it for us?"

</comment></comment><comment><USER6> I believe that it will be one OS with two or three UIs. For instance, you'll have a device that will look like an iPhone or iPad when you use it like an iPhone or iPad, touch screen, big icon dashboards. When you plug that device into a docking station and monitor, it spits our a more OS X like OS. Though it's still the same OS, just a different view of it, now that you've got more real-estate. I like to think of it as a responsive OS.

</comment><comment><USER7> For all his alleged fanboyism, Gruber is a good enough student of Apple's business strategy that his analysis as to how Apple _isn't_ merging Mac OS X and iOS is worth a hundred times as much as this ridiculous linkbait.

</comment><comment><USER8> Somehow I don't see it. I'm going to use a functionally single-tasking OS through a touch interface on a 12 core Mac Pro with dual 27 inch monitors? It seems to me that they are making their full spec OS look a feel a bit more like their mobile OS to help along the halo effect, and make it more comfortable for their mobile users to make the jump to their desktop OS.

I don't like it, but that seems more likely. Also because iOS on the desktop would need a massive amount of expansion to be useful with much of what desktop users need to do--unless you are a very low needs user that runs a web browser and few internet dependent apps. Autocad on iOS? Protools on iOS? Maya on iOS? InDesign on iOS? Illustrator on iOS? I don't know that touch will be very good with the deeper parts of those and many similar apps.

</comment><comment><USER9> With the Mac App Store in Snow Leopard, or Lion's Launchpad (and touchpad), it seems clear that Apple's been headed in that direction for a while.

What strikes me is how they're doing it iteratively. Not because it's surprising; graceful iteration has been OS X's single best feature for about a decade running. It's just interesting to observe the enormous contrast between what they're doing and the "try and alienate all our users by being as disruptive as possible" approach that Microsoft has chosen to take with Windows 8.

<comment><USER5> Where is Windows 8 being as disruptive as possible ? You can disable the Metro interface if you want a regular Win-7 desktop experience. You do not HAVE to get a tablet-like interface if you want to use Windows for productivity. On the contrary, Win 8 is not alienating anyone, it gives you the choice. There are very few OS out there which can claim the same thing.

<comment><USER9> In every previous version of Windows it has also been possible to change the settings to get it to behave much like previous versions.

However, in every previous version it has also been the case that the configuration in question is not terribly discoverable. This situation is compounded by the way that the default settings create an environment that is confusing to people who were used to previous versions of Windows - the result being they feel alienated or intimidated enough that they're unlikely to attempt to discover these changes.

And I don't see much indication that Microsoft will succeed in avoiding this situation. I'm sure they've got UI experts thinking about it, but their marketing department has a solid track record of seeing a good idea paperclipizing it because they think it needs to be more visible.

There will also be, as there have for every other Windows update, many UI changes which may be less advertised than the Metro UI is, but which have just as much ability to alienate users. Ribbons in the Explorer come to mind. (Not that ribbons are bad, mind you, just that an all-at-once switch to them is unnecessarily jarring.) Though I will say that on the other hand it is nice to see that this may be the first major Windows release in a decade to forgo the traditional Reshuffling of the Control Panel.

<comment><USER5> I see your point, if you are talking about the general population, but for the audience of HN, discovering how to change the configuration to return to a win7-like desktop is no challenge. Plus, I would be very surprised if companies started shipping Win8 with the Metro interface by default. All productivity environments will be set up on the regular desktop version. Frankly, implementing changes while allowing people to use the interface they prefer is not that bad. Ubuntu, for one, is clearly imposing you to use Unity and that's it. Don't like it ? Well, forget about using it then.

Re: Ribbons, I have never liked that very much, however it may be more positive than we think in the end, as it is going to provide visual consistency for users between applications.

</comment></comment></comment></comment><comment><USER10> A unified OS experience is hardly the same as a unified OS.

</comment><comment><USER11> If you didn't see this coming I don't think you've been paying attention. If you think the iPad is "just a toy" then you need to hand in your tech pundit credentials. It is far less of a toy right now than the Apple II was at launch, let alone the Altair. The future of mass appeal computing is in a more streamlined experience. Centralized app installation and management using a package manager type system, simplified and more universal user experience metaphors, etc. The PC as it has evolved has done wonders for bringing the power of computers to a level that's manageable by non-expert users, but it has always had persistent fundamental problems that have kept it falling short of that ideal. The mobile experience is another huge leap in that direction. It is not the final step, nor does it necessarily eclipse everything that has been done with other user experiences, but it represents the kernel of the next evolution of personal computers.

</comment><comment><USER12> Hold on, I thought Gatekeeper would only give you verification that an app is secure, and you would otherwise still be free to install any app you want. Is Apple really restricting you to install only app store and Gatekeeper verified apps?

<comment><USER13> No, no, no, no, and no again.

There is a simple preference you can use to disable Gatekeeper entirely.

The default setting is to require that the app either come from the App Store or be signed by the developer (app signing is available through your ADC account)

Disabling it is as simple as changing one setting.

EDIT: If I sound a little frustrated, it's because people keep posting questions like these, and it's getting to the point that it appears rhetorical. Take 3 minutes and read just about any article that covers Gatekeeper and the answers to these questions become abundantly clear.

The repetition of this question, stated in this specific manner, is causing a deluge of rumors and misinformation. I've already been told by two non-tech people, "I heard Apple is making everyone use the App Store in the next version of OS X."

<comment><USER14> This particular article doesn't say that about gatekeeper though - the GP's question is valid:

 _If that weren't enough, OS X Mountain Lion is introducing Gatekeeper, which will, by default, limit the apps you can install to apps from the OS X store or verified Apple developers._

<comment><USER13> I disagree. The operative phrase here is "by default". Which implies that there is some "non-default" option. The relevant question posed by the GP was this: "Is Apple really restricting you to install only app store and Gatekeeper verified apps?" That question is answered by the phrase "by default". Not entirely unambiguous, so why not take a moment to look in to it.

On the very first page of Google search results for "os x gatekeeper" is the official Apple page, with the screenshot of the preference panel:

<http://www.apple.com/macosx/mountain-lion/security.html>

That's 30 seconds of looking for anyone capable of typing two terms in to Google.

</comment></comment></comment></comment><comment><AUTHOR> It is the Apple newest OS, which will blur the line between MacOSX and iOS, between desktop and mobile.</comment>


Who Rises To The Top? Early Indicators - <AUTHOR> https://my.vanderbilt.edu/smpy/files/2013/02/Kell-Lubinski-Benbow-20132.pdf

<comment><USER2> Is is a very interesting research paper. Sort of something we're trying to do with this: [http://getpredikt.wordpress.com/2013/12/13/predikt- aggregate...](http://getpredikt.wordpress.com/2013/12/13/predikt-aggregate- and-quantify-your-professional-data/)</comment>


Use multiple CPU Cores with your Linux commands - <AUTHOR> http://www.rankfocus.com/use-cpu-cores-linux-commands/

<comment><USER2> I find my favorite use of GNU parallel is as a parallel drop in replacement for xargs.

</comment><comment><USER3> BTW, bzip2 has been obsoleted by xz and the parallel version is called pxz.

<comment><USER4> xz is clearly superior in many regards. My understanding is that xz can use significantly more memory upon compression/decompression.

[http://pokecraft.first- world.info/wiki/Quick_Benchmark:_Gzip...](http://pokecraft.first- world.info/wiki/Quick_Benchmark:_Gzip_vs_Bzip2_vs_LZMA_vs_XZ_vs_LZ4_vs_LZO)

Some additional discussion about why xz is not as widely used: [http://stackoverflow.com/questions/6493270/why-is-tar-gz- sti...](http://stackoverflow.com/questions/6493270/why-is-tar-gz-still-much- more-common-than-tar-xz)</comment></comment>


Website or email address to suggest an app to Apple/iOS team - <AUTHOR>

I'd like to make a suggestion for an app/service that I think Apple should provide on their operation system. Does anyone know of an email address, or website for these types of submittals? <comment><USER2> [https://www.apple.com/legal/intellectual- property/policies/i...](https://www.apple.com/legal/intellectual- property/policies/ideas.html)

<comment><AUTHOR> thanks</comment></comment>


How shedding DRM in the Xbox One will benefit Microsoft - <AUTHOR> http://www.forbes.com/sites/carolpinchefsky/2013/06/19/how-shedding-drm-in-the-xbox-one-benefits-microsoft/

<comment><USER2> Strategically a very sound business decision for them. Before this I think they had lost the game, now - they may win it.</comment>


Before Present - <AUTHOR> https://en.wikipedia.org/wiki/Before_Present <comment><USER2> Intriguing that this corresponds fairly precisely with what we call the Modern era.

So here we are almost -70 BP in the post-Modern future. I wonder to what cause historians of a century hence will ascribe this anomaly.

From my own limited perspective it seems to relate to the concept of the Year 2000 as "The future". Then we reached it, and now it's the future, presently, and the present lays in the past: with Modern art, Contemporary furnishings, and other old-fashioned things.

<comment><USER3> I suggest AP for 'after present'. It's currently the year 68 AP.

<comment><USER2> This is clearly the better convention.

But counting negatively toward the future is more fun ^_^

</comment></comment></comment><comment><USER4> Also "Before Physics". Very nice! :-)

TIL: Used because nuclear weapons testing made carbon dating after that date unreliable.

</comment><comment><AUTHOR> I came across the concept of "before present" when reading about the Meghalayan age [1] being adopted by the International Commission on Stratigraphy [2] earlier this month.

[1]: [https://en.wikipedia.org/wiki/Meghalayan](https://en.wikipedia.org/wiki/Meghalayan)

[2]: [http://www.stratigraphy.org/index.php/ics-news-and- meetings/...](http://www.stratigraphy.org/index.php/ics-news-and- meetings/119-collapse-of-civilizations-worldwide-defines-youngest-unit-of-the- geologic-time-scale)

</comment><comment><USER5> > The abbreviation "BP", with the same meaning, has also been interpreted[1] > as "Before Physics"; that is, before nuclear weapons testing artificially > altered the proportion of the carbon isotopes in the atmosphere, making > dating after that time likely to be unreliable.

Kind of neat to think that a civilization 10 million years from now could have some clue about our level of technological development by noting the atmospheric nuclear weapons testing in the geological record.

<comment><USER6> I thought that was the most interesting part of the article. Anyone know where I can learn more about how unreliable it makes carbon dating and what far future civilizations will be able to learn about when/how our civilization lived?

</comment></comment><comment><USER7> hmm, interesting

</comment><comment><USER8> Inventing new time concepts, now and then, is very narrow sighted.

Think of archaeologists in 1000 years from now come over documents with 100 different time concepts.

B.C. and A.D. suffice, anything else is political nonsense or anti-religious propaganda.

<comment><USER9> AD/BC has a fundamental counting flaw [1] which is accounted for by ISO 8601 [2]

[1] [https://en.wikipedia.org/wiki/Year_zero](https://en.wikipedia.org/wiki/Year_zero) [2] [https://en.wikipedia.org/wiki/ISO_8601#Years](https://en.wikipedia.org/wiki/ISO_8601#Years)

<comment><USER10> I wonder what the practical side effects are of being off by one when discussing events that happened c. thousands of years ago.

<comment><USER11> > I wonder what the practical side effects are of being off by one when > discussing events that happened c. thousands of years ago.

A days-as-dots representation[1] has one _day_ precision at a thousand years BP, and since accuracy of a day or week is often possible, it was actually an issue. Wrestling with "everyone has their own odd calendar" was a pain.

[1] "History shown with days as dots - so centuries fit on a screen"'s "Days- as-dots demo" was basically an exploratory UX test piece: [http://www.clarifyscience.info/part/QEt9x](http://www.clarifyscience.info/part/QEt9x) . The Google Books and Google Newspapers links are regrettably rotted - it was great fun to click on random days in the 1800's and 1900's and read random newspapers of that day. :/ The inset NY Tribune from the Library of Congress still works. My fuzzy impression is the google newspapers database is simply unavailable now?

</comment></comment></comment></comment><comment><USER12> Oh great, another measure that defines the entire world by whether or not it existed in the 1950s. Greatest generation my axx. I'm a clear athiest, but at least the AD/BC line was so long ago nobody can claim to have invented it.

<comment><USER13> > nobody can claim to have invented it

afaik it's origins are very well established

[https://en.wikipedia.org/wiki/Anno_Domini](https://en.wikipedia.org/wiki/Anno_Domini)

"The Anno Domini dating system was devised in 525 by Dionysius Exiguus[...]"

<comment><USER12> Noone _alive_ can claim it.

<comment><USER13> oh... you mean a specific individual claiming personal responsibility? what's the relevance?</comment></comment></comment></comment>


Silicon Valley firms are increasingly hiring chiefs of staff - <AUTHOR> https://www.washingtonpost.com/business/economy/meet-the-new-chief-of-staff/2016/06/24/c82b614c-3348-11e6-95c0-2a6873031302_story.html <comment><USER2> > Myhrvold is chief executive of a company called Intellectual Ventures, which > sells patents

'Sells patents' is the most polite possible way to describe their racket.

</comment><comment><USER3> Today I learned that a Chief of Staff is basically a secretary with fewer responsibilities.

<comment><USER4> i don't think that's quite right. when i was at intel the chief of staff role was the "technical assistant" or TA (as opposed to the administrative assistant or AA/EA); some TAs were business types but many had advanced engineering degrees, even PhDs. a well-aligned TA seems like a massive multiplier for execs. the main peril with a chief of staff who is less technical than the exec is that they are gatekeeping (filtering meetings and proposals) based on a pattern-matching level of understanding about technology, as opposed to actual understanding, and that's sort of asking for leadership to drift off in their own filter bubbles.

<comment><USER3> I have very similar things to say about skilled secretaries and more. Good secretaries are master organizers and information gatherers. And yes, they're incredibly effective gatekeepers too.</comment></comment></comment>


How I organize a branch office [COMICS] - <AUTHOR> https://www.praim.com/organize-branch-office <comment><USER2> It's ok to submit your own content here, but this looks too much like an infomercial, without technical content. It would be more credible if you post a timelapse video or a video speeded to x10, so it's possible to see the whole installation in 1 minute instead of 10. (Also, put in that video a link to the normal 10 minutes video, because otherwise people will call bullshit.)

Also, I suggest removing the reference to Spain, because someone can be offended. Any city/country you choose will offend someone. Can you use an unnamed city?

[For reference, I'm from Argentina, so I´m not offended.]

<comment><AUTHOR> Hi Gus,

Thanks for your comment. I believe the video is a really interesting idea!</comment></comment>


Why Stablecoins Like Basis Won't Be Stable - <AUTHOR> https://medium.com/@glenjeh/why-stablecoins-like-basis-wont-be-stable-ca42e13a29d8 <comment><USER2> Don't you always have to start with the question of "stable relative to what"? Relative to the price of gold? Relative to the price of Bitcoin? Of USD? Of a loaf of bread? Of a unit of energy? Of a plot of land? (Where?) Of a "basket of goods and services"? (What goods? What services? How much of each? In what location?)

<comment><AUTHOR> Yes, relative to $1 USD.</comment></comment>


The Updated Pioneer Offer - <AUTHOR> https://pioneer.app/blog/ <comment><USER2> Turns out partially enslaving high school children for $5000 for eight years generates some backlash.

And to think, that from a guy who is already set for life; what does it say about a person if they're already rich and entertain themselves by preying on young people for money they don't remotely need? Other opportunities abound (with a higher capex and effort barrier), but why work when you can be a vulture and buy half some kid's life for $5000?

It's good the terms have been revised, but the initial terms were so inconceivably shitty that I not only wouldn't do business with Gross, but wouldn't even do business with anyone who does business with him -- I don't want to contribute to the prosperity of people _THAT_ predatory.

But hey, at least you get an introduction to the network of other vultures.

edit: the original terms were $5K and they get 3% of any company, even if unrelated to your funded project, that you start for the next 8 years, with the option to buy another few percent as well. So it was basically a slavery contract for n% of your life for essentially no money, passed off as a "fund your dreams" thing.

<comment><USER3> > So it was basically a slavery contract for n% of your life

This is not an exaggeration, as it would clutter future cap tables and cause your co-founders to reconsider working with you.

</comment></comment><comment><USER4> I had to dig up the prior discussion to understand what was updated about the offer. Previously it was:

"In exchange for the investment and benefits below, Pioneer will retain 3% of any company you found over the next eight years. Pioneer will also have the option of investing an additional $20,000 for 5% in any of those companies. These conditions apply if you already have an incorporated company."

There was a lot of pushback from HN on those terms:

[https://news.ycombinator.com/item?id=17725751](https://news.ycombinator.com/item?id=17725751)

</comment><comment><USER5> I am still not sure about the $5k. Why not $15k, which is what someone working minimum wage should expect to earn in a year?

The target population seems to be people who come from poorer backgrounds. $5k can be a lot of money for someone making only 3x that per year, but it doesn't seem anywhere near enough to get said person to focus on a project and _especially_ not enough to get them to work on it and found a company. If the goal is to get "lost Einsteins" to spend time creating things and building companies, then you must give them the _time_ luxury to do so and $5k just seems on the very low end of possibilities.

What am I missing?

<comment><USER6> There's an explicit global angle here. In many parts of the world $5k is way more than minimum wage for a year

<comment><USER5> I understand, but then wouldn't you reach 5x more people if you handed out $1000 instead?

I'm not against the idea, I'm wondering where the $5k is coming from. It just seems arbitrary and not very much without a proper justification.

</comment></comment></comment><comment><USER7> At first I thought this seemed a bit like a scam, but on further reading, ignoring the $5k as that is a bit of a loss-leader, the terms of the $100k investment seem very well considered at this point.

At a max of 20% of a funding round you don't have to be concerned that one investor is going to hold all the power. Though they may attempt to bring other investors in, you are able to maintain the balance in the investment.

Daniel's history with Cue, having been through multiple rounds and an acquisition are also good signs for an early investor.

I don't have the time to dig into the specifics, but I like this more than I thought I would. What are others thoughts? Am I missing something? How can we help others not have the initial reaction that I had if it would actually benefit them?

</comment><comment><USER8> I thought the earlier feedback from HN was especially critical and cynical. I'm curious to know how much of the update to the offer came from the feedback here vis-à-vis the applicants themselves.

<comment><AUTHOR> HN is a wonderful fuzzer on optimism, so I'm sure it'll find some negative angle here as well. HN caused us to _think_ about it, but we made the decision after talking to applicants. Most didn't seem to mind. A few did. We figured it was worth another revision. We're a startup, too. Launch. Talk to users. Iterate. Etc. Etc.

</comment></comment><comment><USER9> Glad that they clarified this, as I was confused about the details of the original offer. The "and raise money from investors" part makes this much more attractive to me.

</comment><comment><USER10> I don't get it? At first I thought you write an application and if its good enough you get 5k to explore it, but on the get started page is suggests you have to work on the project for weeks and submit updates every Sunday.

How much work do you have to do to join the competition?</comment>


Show HN: S-Cache – Secure storage for cryptographic secrets, modeled after sudo - <AUTHOR> https://github.com/rongarret/scache <comment><USER2> The mention of setuid thing for storing personal secrets seemed a little odd, so I looked at the code. It seems the only thing that has been updated recently is the README and Makefile. scache.c has a few things that trip up new C programmers. A read of some resources on secure C programming is advised. A good place to start is:

[https://security.web.cern.ch/security/recommendations/en/cod...](https://security.web.cern.ch/security/recommendations/en/codetools/c.shtml)

The program checks to ensure it is running setuid. In that context the following are particularly dangerous:

\- The path to the cache file is determined by looking at the HOME environment variable. Anyone that is calling that can set HOME to whatever they want, causing the cache file to be created in or deleted from any directory. It's better to use getpwuid(getuid()) to find the home directory of the running user.

\- The use of stat() (instead of lstat()) and fopen() (instead of open() with O_CREAT|O_EXCL) opens the door to symlink attacks. This can allow creation of arbitrary files.

\- popen() is used without clearing the environment. I think that most systems clear particularly dangerous environment variables from setuid programs (e.g. LD_PRELOAD, LD_LIBRARY_PATH) but there could be others (documented or not) that influence the behavior of the program called by popen() in a way that can be exploited by an attacker. Generally, a privileged program will drop privileges and sanitize the environment before calling subprocesses. popen() is not a rich enough interface to make that easy.

There are other smaller issues (e.g. memory leaks, unclear handling of buffer sizes, failure to check returns from functions that could fail, etc.). Additionally, if home directories are on NFS, it is quite unlikely that this program will be able to create the file with root ownership ("root squash"). I don't immediately see how these could be exploited.

Another comment mentions a bunch of prior art. Those are probably better things to be looking at than trying to invent something new in this space. That being said, there are a number of interesting concepts that the author needed to explore to get to this point. Hopefully this comment is helpful in understanding some next steps to take in understanding some of the pitfalls of C programming and setuid.

(edited for formatting)

<comment><AUTHOR> Thanks for the tips. I'll fix those issues.

</comment></comment><comment><USER3> As you might imagine, there is some prior art in this space.

In broadly portable Unix userspace, there is GNOME Keyring. It takes special caution to pin secrets in memory (prevent swapping them to disk) and to zero out secrets before freeing them. For session-lifetime password store, it never writes the secrets to disk at all. Keyrings are encrypted with a key derived from a master password for each ring. I don't know what key derivation algorithm is used. For persisted secrets, I imagine they are stored encrypted on disk using something derived from the keyring password.

In the Linux kernel, there is the infrastructure behind the user interface keyctl(1). I am basically unfamiliar with it aside from knowing it exists.

On MacOS, there is Keychain. Ditto.

On Windows, there is the CryptProtectData / CryptUnprotectData family of functions, which theoretically ties the encryption to the current user. Using that nice primitive, one can just encrypt and then write out to any old file on disk.

</comment><comment><USER4> Not sure how I feel about the comparison to the shadow passwords file -- the shadow file doesn't contain the raw password, but a hashed version.

If someone steals the shadow password file, they still have quite a bit of computation to do to crack the credential.

<comment><USER5> I'm a little confused here. The author compares S-Cache to 'sudo'. 'sudo' is a command that lets an unprivileged user run a privileged command. S-Cache lets a process access a secret without having to manage it. The process (in a sense) is not _privileged_ enough to see the secret but rather delegates this to S-Cache. The author (as far as I can tell) does not mention the shadow passwords file. Can you explain more?

<comment><USER6> The mention of the shadow file is in the README:

> S-Cache is an SUID-root executable that works by storing the secret in a > file that is owned by root and only readable by root. Its security is thus > comparable to the security of shadow passwords.

<comment><USER5> Thank you. I didn't notice that before.

</comment></comment></comment></comment><comment><USER7> It's been a few years since I've used GCC, but I believe you'll want to compile with security flags (e.g. -fPIE -fstack-protector and friends)</comment>


Ask HN: Suggestions for a 14-yr old software-developer-in-training? - <AUTHOR>

My 14-year old has shown an interest in software development. He attends a magnet high school that focuses on math and science. While the intro-level CompSci class he took this past year was taught in Java, a few higher level classes are taught in Python.
While he has the opportunity to take formal classes at school, much of what he has learned has been self-taught. For instance, he's figured out how to create a custom Bukkit Plugin for Minecraft in Java. Now, he's working on a simple HTML5 game using Node.js and incorporating Socket.io to support realtime, multiplayer (two players for now) play.
As a parent, I'm constantly walking a fine line between letting him do his own thing OR guiding him -- gently most times, more forcefully on occasion :-) -- to topics/concepts in software development, like source control using Git, that I believe will help him enjoy software development AND be a better developer.
What topics, concepts, programming tools, languages, projects, general advice, etc. would you suggest for a 14 year-old who is interested in software development? <comment><USER2> 1) Collaboration. Figure out some way he can work with other people his own age, talking to them about code and coding. The sooner he starts clearly communicating his insights the easier his life will be.

2) Whatever coding he thinks is fun. Even precocious childhood (and the best parts of adulthood) are about play. I'd encourage automation and code in as many areas of his life as possible: let him get a smartphone if he writes an app for it first. Let him get hosting when he finishes his game. Rewards are a great way to guide without getting in the way of letting him do what he thinks is fun. Even if he wants to head off into writing prolog code it's not likely to do any lasting damage at this point ;-)

3) Hardware/networking. Much of good programming comes down to interacting with and adapting to users; much of good networking and use of hardware comes down to ignoring the users and telling them what they should do. Let him disassemble boxes, put them back together again. See if he can scavenge working machines from discarded towers. If there's a local non-profit that refurbishes machines they are a great way to get into this and find a good community.

4) Other things that enhance a sense of aesthetics, communication and creation. Musical instruments are popular, public speaking or theater help enormously in getting ones ideas out into the world, reading and writing poetry is fantastic training for creating clean code. A design background and art classes can be enormously beneficial when doing web development.

5) The history of computers and software. If he learns about Turing and Hopper and Kay as people it'll make the contributions they made to software that much more interesting, and again it brings it back to "software is fun in part because it is about people." Lego Turing machines and cutting up wire into nanoseconds and fooling around with Scheme and listening to Steele's talk on How To Grow A Language are all great ways to start feeling like you are part of a larger community, doing amazing things together, rather than a lone magician in a tower.

<comment><USER3> I really agree with the choice of pursuing an interest in music. Understanding how rhythms, counts, and more come together to make something greater is fundamental to the building of software.

Learning to find the patterns in music is much like finding the patterns in a problem, and a solution to know you 'got it'.

</comment></comment><comment><USER4> Hi there!

I'm an engineering intern at an edtech startup in SV with explosive growth. I'm also 16 years old, still in high school and from the other side of the country (DC metro area). I'm still in the process of starting up my blog detailing my experiences as a teen entrepreneur and developer in Silicon Valley. If you or your son are interested in my experience or some advice from me, please feel free to shoot me an email at fouad [at] classdojo.com.

</comment><comment><USER5> I can only say keep building, refining, starting new. I am 21 years old and am doing basically the same things you are helping your son do in his spare time. I am about to graduate with my bachelors in Software Engineering. I never had anyone to help teach me anything before college. Who knows where I'd be if I had someone like you there the whole time. I'm sure he'll go far if he keeps at it and enjoys it.

</comment><comment><USER6> He clearly has a strong interest and is very self-motivated. When introducing theory, be careful not to reduce his enthusiasm and excitement. If you plan to introduce some fundamental programming concepts, perhaps, start by helping him improve his existing code. He might also be interesting a game development platform such as Unity3d, which has support for C#, JavaScript and a Python- based language.

<comment><USER7> _When introducing theory, be careful not to reduce his enthusiasm and excitement._

Agreed... unless he just plain shows a lot of interest in theory for theory's sake, I'd say to make sure to always have an application for any theory you introduce, that demonstrates the value of what you're showing. Or even if you can't _literally_ demonstrate it, at least an explanation that's as context relevant as possible.

Example: If you start talking about sorting algorithms and runtime complexity, explain how a bad decision here could cause lag / latency in one of his projects. IOW, tie the theory back to something he can easily relate to.

Otherwise, if he already thinks he wants to be a developer down the road, I'd say you'd be doing him a favor by teaching him some of the things that you tend to _not_ get in a CS degree program... that is,the "software engineering" stuff. Revision control, release strategy, testing, etc.

Anyway, it sounds like your son is in a pretty good place already, so you might want to be careful not to push him to hard, to the point where programming becomes a chore and he starts to tune out.

Finally, there are a couple of books that might help whet his appetite for hacking, such as Levy's _Hackers: Heroes of the Computer Revolution_ or Kidder's _The Soul of a New Machine_ or Rosenberg's _Dreaming in Code_.

<comment><AUTHOR> _I'd say you'd be doing him a favor by teaching him some of the things that you tend to not get in a CS degree program... that is,the "software engineering" stuff. Revision control, release strategy, testing, etc._

That's a great point. I wonder how many high schools (or colleges, for that matter) teach the "software engineering" stuff, the practical, "vocational" skills that software developers need.

<comment><USER7> _That's a great point. I wonder how many high schools (or colleges, for that matter) teach the "software engineering" stuff, the practical, "vocational" skills that software developers need._

Not enough, from what I've seen.

</comment></comment></comment></comment><comment><USER8> Watching open source project discussions to see how people interact there. Look at a higher qualifications units and see what is covered, eg the HND I just finished included project management, forensics and business structure.

</comment><comment><USER3> My teenage years were intensely productive. I had the right mix of mentors, synergy with my circle of tech friends and the limitless opportunity to create for the sake of creation. As most people get older the ability to do this goes away with having to pay bills. Living at home is one of the best times of your life to create.

My advice for you as an advisor is this: Teach him how to channel his energy and not be all over the place. Learning to be effective, disciplined and focused, on however many interests is critical. This one ability will serve him for the rest of his life if he can master it under your guidance. If you like, harness his energy into a particular direction for the odd project and let him chart his course otherwise.

This is for your son.

How to be in any situation:

\- Learn to be a self-directed individual. Looking to others to be taught is not the path of a developer.

\- Learn to be a self-study. Everything he will ever learn will always become obsolete. Years ago, some language and framework was hot, to be replaced by a new one today, and tomorrow.

\- Don't fit in. The greatest gift of geekdom is being comfortable being unique and seperate, even from other geeks. Don't fall for the entreporn of fitting in, you resisted it all through out school, why give in to followers?

\- Open: Give something 5 minutes to sink in before judging. Don't become a religious fanatic about your tools to fit in. Users don't give a hoot about what you code in, only if you can build something that solves their problem well. This is the single most mind closing thing you can probably do when you're young, forget about older.

\- Become an insanely curious individual. Try to understand how people deal with information in their lives in any place. You'll get faster.

\- Learn to focus your curiosity to have a start, and end point. This year, I made a goal of taking every little project I hacked on and simply launching it to it's own domain. It's been refreshing, only for $9/year per domain.

\- Learn the difference between being a creator and a consumer. Playing games is consuming someone's world and can have it's value as long as it's not greater than the time you're spending creating.

What is worth doing at that age:

\- Build for the sake of building.

\- Experiment for the sake of experimenting.

\- Explore your curiosity. Find new interests to explore and try to connect them.

\- Don't prematurely optimize. Run as far, and fast as you can from any developer who talks about doing things perfectly but does not launch anything, ever, themselves because their projects are never done or ready to release.

\- Learn the difference between building something that interests only you and helps others solve the problems they have.

\- Release prodigiously. I still have code from the late 90's when I was 17 that's running just fine on the web. It's not pretty but the tens of thousands of hits on it remind me to fight confusing activity with results.</comment>


The Documentation Dilemma - <AUTHOR> http://37signals.com/svn/posts/3073-the-documentation-dilemma

<comment><USER2> I don't think you can keep designers and developers in sync for mobile platforms.

I work with some amazing designers and some amazing iphone hackers, and it still takes a team of four programmers a whole month to implement something that a designer comes up with in a week.

Maybe eventually the tools will improve, but iPhone and Android are not web enough to be so rapid.

<comment><USER3> IMO that presents an opportunity: If 1:1 throughput isn't possible given the platform, what are the different ways we could approximate it? If we have to do design in advance, how much should we do, and which parts? All of these become useful challenges that can increase the role of feedback in your design when you take them on as such.

</comment></comment><comment><USER4> Great article. The company I work for recently decided to ditch the IAs and go straight to prototyping. At first, I thought the decision was crazy. But the truth is, people want to _see, feel and interact_ and they won't be "done" until they can do that.

When we talk about responsive design, it's usually to mean something about fluid width / device happiness. Going straight to prototyping with the actual application is just an extension of this mentality.

Here are a few reasons why:

\- Clients will try the prototype in configurations/devices that you don't have and can't test without employing an army of testers.

\- Clients see conflicts with their business logic and your understanding of their needs before the roots are too deep.

\- You can actually write articulated unit tests, framework and data structure based on something you know inheritably works.

\- No one gets left out of the process. Nothing can turn a project sour more than a member of your team that feels alienated and parachuted into a half- baked creation.

Of course, with any approach, you need boundaries and a defined scope. When your client understands specifically what scope is, and that you're watching for it, the results are predictable.

<comment><USER5> Note, there's also a well-established way to convince non-enlightened clients not to use a prototype - make it report scary errors (depending on the sophistication of the client), and warn them that it will take a long time to debug.

</comment></comment><comment><USER6> Design documents are really no different than code that's been written but not tested. Just as with any other code, you want to test the assumptions made in the documentation early and often. You don't want to build up a large mass of documentation that hasn't been at least prototyped, just as you don't want to write reams of code that you haven't yet run.

</comment><comment><USER7> Interesting points, particularly about clients only caring about the deliverable. Some agency-type companies I've worked for have seemingly added documentation-generating steps, just because it added on hours that could billed.

If you need a UX person to do wire frames before a designer does the visual design, you get a whole bunch of extra billable hours on a project. The funny part was that clients rarely got what they were looking at it when presented with wireframes. They constantly thought they were visual design mockups, so the feedback they gave on them was never particularly helpful.

</comment><comment><USER8> I don't understand how this works at scale. This seems to be a strategy for a one or two person team.

<comment><USER3> You scale it by identifying which scopes of work are dependent on others and which scopes are independent. Any independent scopes can be designed, developed, and reviewed by small teams working at pace together, parallel to other teams. They key is how you break the work down into scopes, and how you see their interdependencies at a given moment and over time.

</comment></comment><comment><USER9> Documentation isn't the issue.

Learning the correct amount, type, and depth of documentation that is fruitful is key.

In this case, prototyping seems obvious to do when you know how it should be, or a starting trajectory. When you don't, and/or there is management/design by committee, I'm sure there's other large problems besides IA documents.

Documentation exists in two forms:

\- for those operationally familiar with a system.

\- for those not familiar with a system.

I almost like having two sets of documentation, a high level quick-guide and a deep down exploration in the same document. Part of it is as much design as is necessary to explain things. Simple things don't need oodles of diagrams. You better believe complex things, once figured out benefit from them.

Documentation also exists to capture the intellectual capital of your organization. It may not be referenced or used, but as an organization matures past 5 years of being in it's current way of business, or grows larger than 10-15 people; true, impactful turnover becomes a real issue.

</comment><comment><USER10> Some time ago I was on a very large project where the hired design firm refused to create any art assets until the IA was completely finalized. I had never heard of an IA at the time, and in retrospect I have nothing but disdain for the concept. I agree with the article that the true value comes from actual design prototypes. Things people can look at, touch, play with and ultimately determine if they like or don't like.

The design firm ended up being fired. They put two "UX" experts on our project and they billed an amazing number of hours. After a few weeks of trying to get a real visual prototype from them, they said we still needed to answer more questions for their documentation. They would only let a designer work on the project an hour or two a week, and even once they were satisfied, the art assets were almost impossible to wriggle out of them.</comment>


The Greatest Problem That We're Not Discussing: Climate Change - <AUTHOR> http://bamboozled.ca/greatest-climate-change/

<comment><USER2> Can we just ban Bamboozled.ca? This guy writes a post on GW, submits it to HN (and probably other places) then a few days later DELETES to post on his blog, rewrites the post with few if any changes, then submits it again.

<comment><AUTHOR> Criticism acknowledged - I'll fuck off.

Basically, I was trying to get HN to bite on this issue. I just started the blog, so I would modify wording of the post if the submission failed.

<comment><USER2> I'm glad you recognize the irony of asking for a discussion then deleting it. I wouldn't mind if you just kept the posts live.

</comment></comment></comment><comment><USER3> Are we really not discussing this?</comment>