GitHub censored my research data - <AUTHOR> https://gwillem.gitlab.io/2016/10/14/github-censored-research-data/ <comment><USER3> GL sent me this statement. For the record, I didn't publish vulnerable systems, I published stores that have malware.

\---

Willem,

GitLab has opted to remove the list of servers that you posted in your snippet. GitLab views the exposure of the vulnerable systems as egregious and will not abide it. While GiLab reserves the right take further action, up to and including termination ([https://about.gitlab.com/terms/](https://about.gitlab.com/terms/)), we have chosen not to terminate or lock your account.

Please know this decision was not reached lightly and we appreciate your understanding on the matter.

Regards, GitLab

GitLab Support Team GitLab, Inc.

<comment><USER4> And even if it were (a list of vulnerable systems, that is), why the fuck do they think that they should censor serious journalism? If you operate a public venue, then it is an important societal role of journalism to report on it if that public venue poses a risk to the public, whether that might also have negative consequences for the people operating it is completely irrelevant.

<comment><USER5> You mistook "free and accessible" with "public".

You may exercise freedom of speech but not on server that belongs to a private company - it is their right to limit what kind of content they like.

But in an essence you are right - companies should exist to benefit society, but it is not how it exactly works right now.

</comment></comment></comment><comment><USER6> We at GitLab believe the author did not responsibly disclose this security information in a proper manner, and today we removed the list of hosts in accordance with our terms of service ([https://about.gitlab.com/terms/](https://about.gitlab.com/terms/)).

The author says that he contacted "about 30 merchants directly", but the published list includes over 1000 merchants. Most merchants were neither informed nor given a chance to respond in a timely manner. We did not feel comfortable hosting information that could be construed as an open invitation for malicious users to exploit.

<comment><USER7> This is completely unacceptable. You're treating this as though the author was publishing a list of _vulnerabilities_ about sites. That's not what the author did. The author published a list of sites that are already infected with malware and thus are dangerous for users to visit. This is a public service and there is zero expectation of "responsible disclosure" to the sites. The only thing that disclosing to the sites without telling the public does is protect the reputation of the site, but there's no expectation for anyone to try and protect the reputation of sites that are serving malware.

> _We did not feel comfortable hosting information that could be construed as > an open invitation for malicious users to exploit._

The sites were already exploited. That's the thing. At best I can see the argument you're making being "we don't want the sites to get exploited a second time", but that really shouldn't be a concern. The sites were already exploited, there's nothing left to protect. And publishing a list saying "this site has malware on it" doesn't actually tell anybody _how_ the site was vulnerable anyway, unlike disclosing security vulnerabilities which by their very nature informs people how to take advantage of them.

<comment><USER8> I agree. GitLab's reputation has taken a pretty big hit in my opinion. I kind of expected GitHub's reaction, but had hoped for something better from GitLab (if nothing else, just to differentiate themselves from their opposition).

<comment><USER9> Definitely stuffed my opinion of them. I thought they were for the people and made good decisions.

Nope - corporate suits - and they give us a response which doesn't even make logical sense. Do they think we're idiots?

</comment></comment></comment></comment><comment><USER10> Archive of the list on Gitlab which is now 404:

[https://web.archive.org/web/20161014133252/https://gitlab.co...](https://web.archive.org/web/20161014133252/https://gitlab.com/gwillem/public- snippets/snippets/28813)

<comment><USER11> A pastebin link with spaces converted to newlines, apparently for purposes of copy/paste: [http://pastebin.com/rYqEeuNm](http://pastebin.com/rYqEeuNm)

</comment></comment><comment><USER12> Do this kind of thing on your own domain.

I have a list of major sites with currently active phishing pages.[1] This is basically a join of PhishTank and DMOZ. Nobody seems to be upset by that.

Google is at the top of the list because of their hosting business. It's not just Google Sites. You can put a web site in a Google Spreadsheet cell, which Google doesn't seem to check as a possible phishing site.

If you host for others, or offer a URL shortening service, you need automated checking against all available phishing lists or you will be exploited.

[1] [http://sitetruth.com/reports/phishes.html](http://sitetruth.com/reports/phishes.html)

<comment><USER13> Okay, so assume he hosted the list himself and is now DDoS'd.

Now what? I'll give you a budget of $100 a year.

<comment><USER14> Well there is Frantech / BuyVM. We had a VM we used as a proxy for about $15 a year + the $3 IP DDoS filtering. We had several proxies on top of our Limestone Networks server (they didn't offer protection at the time - <USER2> this is cheaper).

Game servers become hot targets by kids who just don't care and do anything to get your server taken down, whether it be competition or a user got banned or just about any reason they can sum up to try and find any given approach to take your service down.

Edit:

Forgot to mention the free CloudFlare option as well (unless they stopped doing this, haven't had to deal with these things in a few years, but I have a feeling it's still about the same, there's likely even more offers now out there).

</comment></comment></comment><comment><USER15> > I understand that Github doesn't have the resources to investigate each and > every DMCA notice.

The DMCA as written really encourages no investigation whatsoever on the part of the service provider, this is pretty much how everyone acts. File a counter-notice with the service provider if you don't think your content violates anyone's copyright.

In this case, if Github took it down because of a DMCA notice, i think Github actually behaved _better_ than Gitlab. Github is simply following DMCA, if you file a counter-notice, they'll probably restore it -- if they don't, and say it's not an issue of copyright, it's just that they don't want to host your material, then at that point they'll be behaving similarly to Gitlab. Gitlab did not take it down because of a DMCA notice, they took it down because they decided it was 'egregious' and they just didn't want to host it.

[https://help.github.com/articles/guide-to-submitting-a- dmca-...](https://help.github.com/articles/guide-to-submitting-a-dmca-counter- notice/)

I can't find any gitlab docs on filing a DMCA counter notice. Their DMCA policy at [https://about.gitlab.com/dmca/](https://about.gitlab.com/dmca/) is short and solely targetted at those claiming infringement, there is no description of how to file a counter-notice.

In this case, I think github wins. The terrible parts of github's counter- notice policy (10-14 days until your content comes back) is part of the DMCA law. Take it up with your congresspeople. [http://io9.gizmodo.com/the-dmca- how-it-works-and-how-its-abu...](http://io9.gizmodo.com/the-dmca-how-it-works- and-how-its-abused-1616830093)

However, reading OP again -- it's not clear to me that Github took it down because of DMCA. They may simply be acting exactly like Gitlab, taking it down because they don't want to host it, unrelated to DMCA. But I wanted to clear up some things about the DMCA, since OP mentioned it.

<comment><USER16> >>>it's not clear to me that Github took it down because of DMCA.

Exactly, there seems to be a common misunderstanding that if anything is taken down then it because of DMCA, there are number of ways content may be removed from a platform, be it GitHub, Facebook, YouTube, etc. Not all of it is DMCA.

In fact for large platforms that offer take down processes outside of DMCA I would say the vast majority is not, for example anything taken down via ContentID on Youtube is NOT a dmca take down.

</comment></comment><comment><USER17> How exactly does publishing a list of malware-infected stores fall under the DMCA? I always thought DMCA was meant to be for copyright infringement cases.

I didn't see the list, but did it by any chance contain the logos of the online stores? If it did, the DMCA notices make sense.

<comment><USER18> it falls under the DMCA because the DMCA mandates a takedown-first and check the validity later workflow. To be in compliance, a site _must_ respond to any DMCA takedown notice as quickly as reasonably possible, regardless of how fraudulent it might be.

As long as you're okay being found guilty of perjury by a US court, or have no plans to enter a US jurisdiction in the near future, you can get any content you want taken down from any site that's required to follow the DMCA.

<comment><USER19> DMCA is a copyright law. It requires a takedown for alleged _copyright_ violation. That doesn't apply here. The stores don't have copyright over their domain names on a list.

<comment><USER20> Yes. So to get something taken down, all you have to do is _allege_ copyright violation. If you're not concerned about perjury in the US courts, the claim doesn't have to have merit.

Service providers have a choice:

a) follow the DMCA takedown process and be shielded from all liability, whether or not the claim has actual merit

b) evaluate each takedown notice to decide if the material falls within the scope of copyright, ignore takedowns where _in the service provider 's opinion_ the material is outside the scope of copyright, and should it go to court, be forced to defend that position on its merits instead of having an automatic liability shield

What sensible service provider is going to choose option b?

</comment></comment></comment></comment><comment><USER3> Gitlab CEO just called me and apologized, will restore data shortly.

I am personally very sorry that GL got in a bad light here. They had misinterpreted my data and have acknowledged that. For comparison, I have heard nothing from GH over the last two days.

Gitlab, you rock.

<comment><USER21> FWIW, if GitLab sees this: Well done. We were planning on buying their hosted service (GitHost) for my employer next week and after this story initially broke I was going to table that and use something else. This has restored our faith in GitLab as a company.

<comment><USER22> Thanks Charlie, glad to hear that. For reference our response blog post is [https://about.gitlab.com/2016/10/15/gitlab-reinstates- list-o...](https://about.gitlab.com/2016/10/15/gitlab-reinstates-list-of- servers-that-have-malware/)

</comment></comment></comment><comment><USER9> GitLab and GitHub are both pretty active on HN. I look forward to their response - where is it already?!

I'm especially disappointed by GL. GH is already too big to care about such things.

</comment><comment><USER23> There is a service [http://www.cryptograffiti.info/](http://www.cryptograffiti.info/) which can be used for posting sensitive information that should not be removed or hidden. It allows to write a message and store it in Bitcoin blockchain as a transaction. It costs near 0.0015 BTC or $1 per kB. Large files can be posted as magnet links to torrents with them.

Even if the service's site had been shut down, everyone would always be able to obtain the transaction from it's hash using any bitcoin client/blockchain explorer, convert it to ASCII and read the text.

I'd like to note that it is worth to sign with GPG all messages posted that way in order to have ability to post updates and verify authorship.

</comment><comment><USER24> After briefly looking at [https://github.com/github/dmca/tree/master/2016](https://github.com/github/dmca/tree/master/2016) there doesn't appear to be any DMCA request for gwillem's content, so maybe it wasn't removed through the DMCA process?

</comment><comment><USER25> Definitely feels like a bad interpretation on Gitlab's part, but not done out of malice.

The person was not exposing sites that nobody previously knew about -- the sites were already compromised, there is nothing to compromise again except maybe having more than one attacker in your compromised account. The damage is already done, though.

These are likely web applications that were not kept up to date so the responsible security disclosure already happened when it was reported for WordPress/Drupal/Joomla. It is the site owners responsibility to pay attention to those security disclosures, which they likely failed to do.

And those compromised sites, in my experience, are usually attacking and infecting other sites and servers on the Internet. That makes them a public nuisance and so public disclosure is necessary so they can be appropriately blocked/isolated.

</comment><comment><USER26> Discussion of origin of the list here

[https://news.ycombinator.com/item?id=12707860](https://news.ycombinator.com/item?id=12707860)

</comment><comment><USER27> Article doesn't say that gitlab censored the list, though the gitlab link is a 404.

Also, are they actually using DMCA to get these lists taken down? If so, isn't there some penalty for filing a false DMCA?

<comment><USER28> The first comment mentions it was taken down about an hour ago.

<comment><USER27> Hmm. I didn't (still don't) see any comments. Maybe it's a mobile thing.

</comment></comment></comment><comment><USER29> List is at [http://p.cweiske.de/366](http://p.cweiske.de/366)

</comment><comment><USER30> For once, the Gitlab employees on HN don't comment on a Gitlab-related story.

<comment><USER31> Hum... [https://news.ycombinator.com/item?id=12712996](https://news.ycombinator.com/item?id=12712996)

<comment><USER32> It's a new account that offers no proof that they are legitimately speaking on behalf of Gitlab.

</comment></comment></comment><comment><USER33> Perhaps distributing this list is a use case for IPFS?

[https://ipfs.io/docs/getting-started/](https://ipfs.io/docs/getting-started/)

</comment><comment><USER34> > I understand that Github doesn't have the resources to investigate each and > every DMCA notice. However, it still took me by surprise that Github censors > data so easily.

Send a counter-notification asserting that the data is not under copyright and have it put back up. Assuming this is really DMCA.

</comment><comment><USER35> So it seems the real bug here is that a site that is hosting malware is doing so because its actually vulnerable to being hacked, was hacked, and malware was installed. So posting the site name identifies a vulnerable site (which is wrong) and stops informing people that those sites have malware on them (which is an issue as well).

That is quite the catch 22. And of course many of the sites owners are clueless and don't even know how to patch or fix their systems.

My isn't that that a mess?

<comment><USER36> It's not wrong to expose negligence which endangers others.

</comment></comment><comment><USER37> Isn't pastebin the correct site to post lists like this?

<comment><USER38> Not if you want to update it.

Also, Pastebin has some shady practices. One example: they offer HTTPS support as a premium feature.

<comment><USER39> I am sorry, but I fail to see how offering https support as a premium feature could be considered "shady".

<comment><USER40> All web traffic should be encrypted, regardless of purpose. This increases the work that nation-state level adversaries must do to effectively spy on the population. And it's cheap and easy to do these days.

<comment><USER39> It's not a question if its easy to do or not. Yes I prefer an encrypted connection over one that is not.

BUT! the point here is the op claims this is a shady practice to provide https to their paying customers.

A shady practice is if they take your personal information and sell it to another without telling you. Shady is when companies lie to their customers.

And this situation is not.

<comment><USER40> Fair enough. I don't think this is a "shady" practice either. But I think it's an old, out-dated practice to charge extra money for a feature that should be on by default.

</comment></comment></comment></comment></comment></comment><comment><USER41> Would be fun to see if the list is censored on Google docs.

<comment><USER42> You should host the list and post a high visibility link (i.e. news article). You'll probably discover real quick the pressures that caused GitHub and GitLab to buckle so quickly.

</comment></comment><comment><USER38> Isn't it the whole point of GitLab that it's decentralized? As in, you can roll your own instance and stop worrying about censorship?

I'm pretty sure someone here has a GitLab instance that is willing to share for this purpose.

<comment><USER43> And get DDoSed by the malware guys who don't want their victims know they are in the list and fix their site. It would be an altruistic offer but I would think twice about it.

However it's a problem and we need a solution.

A torrent? Yes but Google won't index it.

A file on S3 wouldn't work because they could just download it as many times as needed to make the bill skyrocket. Better than a DCMA.

Anything that is unaffected by DDoS, costs no money, can be indexed?

Edit. One more requirement: not easy censorship.

<comment><USER44> Blogspot/Blogger?

<comment><USER43> DMCA, again. I forgot that constraint.

</comment></comment></comment></comment><comment><USER45> Back to the original problem of skimming.

I think the fastest way to get sites fixed is to run a script that crawls sites in the list, parses their Twitter and posts a warning there with link to original article.

Can someone help with that?

</comment><comment><USER46> And just like that, we discover how helpless the average Joe is against corporate money.

Let's crowdfund an AWS s3+CloudFront hosted site. DDosing that is no easy feat, and if corps do try it, the logs can prove their complicity, which has legal implications I presume

<comment><USER47> It's an endless cycle. The Man keeps you down, so you throw together resources and collaborate to have a crowdfunded solution. It becomes successful, grows, hires some employees to maintain things, keeps growing, and becomes The Man.

</comment></comment><comment><USER48> @gwillem thanks for doing this important investigative work.

</comment><comment><USER49> As soon as I read this I assumed it was as a libel prevention method.

I'd be curious whether Gitlab/hub could be held responsible for proving the accuracy of the claims? (That was my initial assumption as to the reason they were taken down.)

</comment><comment><USER50> Why is a third-party required to publish the list, couldn't it be hosted on the blog post itself? That would have the advantage of being to archive the whole thing on a single page.

</comment><comment><USER51> To be fair, maybe some automated method that hub/lab owners have not vetted the data overall. I hope your list stays up/public personally as long as you are willing to take responsibility for its upkeep. I wish there was some format to submit this list (and your responsibility for keeping up with it) to vendors on the lookout for this kinda stuff (up to them to decide inclusion).

</comment><comment><USER52> Please post it to pastebin.com or something like that! put up a torrent I want to know which sites so i can steer clear of them.

</comment><comment><USER53> What is the problem to publish on your own site?

<comment><USER54> It would probably get DDOS'ed just as quickly.

<comment><USER55> Just put it behind the free Cloudfare protection.

<comment><USER56> >Only limited DDoS protection and mitigation is provided to domains on a free or Pro plan through "I'm Under Attack" mode. If you are looking for advanced DDoS protection and mitigation and frequently suffer sizable DDoS attacks, please consider looking at our Business or Enterprise plans.

[https://support.cloudflare.com/hc/en- us/articles/200170186-D...](https://support.cloudflare.com/hc/en- us/articles/200170186-Does-CloudFlare-offer-DDoS-protection-to-Free-and-Pro- plans-)

</comment></comment></comment></comment><comment><USER28> I don't know enough about these kinds of situations yet to form a reasonable argument for-or-against. Is what was done considered a kind, favourable thing for the developers behind those sites or is it something that shouldn't have been displayed?

<comment><USER57> It doesn't matter what is kind for the devs, it matters that their website has malware causing their user's data to be compromised.

</comment></comment><comment><USER58> "Moderated", not "censored". Neither GitHub nor GitLab have stopped the message going out from outlets other than their own. Would we be comfortable calling the moderators here on HN "censors"?

</comment><comment><USER59> I tried to pay in several of these shops. Most didn't even had the functionality to pay with card. The only one in my sample where I was able to get to the payment form had redirected me to the proper payment gateway.

</comment><comment><USER60> [http://gogsys33repvmfz5.onion/](http://gogsys33repvmfz5.onion/) Free gog git server in Tor.

Also, it will ask for an email on registration, but it isn't verified and no email is sent.

</comment><comment><USER61> I wonder how google acts, if you dump the list here:

[https://www.google.com/safebrowsing/report_badware/](https://www.google.com/safebrowsing/report_badware/)

<comment><USER62> That's covered in the article:

> I have, prior to publication, submitted all URLs and malware samples to > Google's Safe Browsing team. They have since only acted upon a small portion > of the sites.

</comment></comment><comment><USER63> Money talks. Uness it's consumers' money being stolen, it seems.

</comment><comment><USER64> Now I see. I thought this was a list of stores hacked through the current vulnerability. This is a list of stores hacked through 1-2y old vulnerabilities.

</comment><comment><USER65> Post it on a WordPress.com blog or host it on an OVH box or put it behind CloudFlare. All of these are quite censorship resistant in my experience.

</comment><comment><USER66> The article states the lists were taken down but does not say why. Perhaps there will be an explanation forthcoming from Github or the researcher.

</comment><comment><USER67> The only way this will get fixed is if a script is written to take advantage of the vulnerabilities and clean the sites affected.

</comment><comment><USER52> Post it to Pastebin.com or make a torrent!

</comment><comment><USER68> Well, as an absolute last resort, you can use Freenet or Dat to store your list.

</comment><comment><USER69> Have you thought about contacting Adblockers or even Browsers? They might be interested in this data to block the sites for the average Joe.

<comment><USER70> From the article:

7\. I have, prior to publication, submitted all URLs and malware samples to Google's Safe Browsing team. They have since only acted upon a small portion of the sites.

<comment><USER69> When I read that I assumed it was Google Search team, not Google Chrome team

</comment></comment></comment><comment><USER71> I'm kind of with Gitlab on this one, just publishing a list of broken sites isn't going to help them get fixed. Most of the owners probably barely know the Googles from the Facebooks, so even if you email them saying 'you have this JavaScript thing that's bad' they won't understand and will blow you off.

OP doesn't go into details of how they check the stores, but I'd assume they have some sort of script as they checked 255k. If that's the case it would be trivial to send an automated email if malware is detected, and include links explaining how to fix it.

It won't resolve everything but it's a lot nicer than naming&shaming businesses who have effectively done nothing wrong. What I mean is they probably hired a developer or team to build their website, and assumed that they would build a secure website - they didn't go out purposely and find someone to build them a site that would be hacked.

<comment><USER13> > I'm kind of with Gitlab on this one, just publishing a list of broken sites > isn't going to help them get fixed.

So the malware should be allowed to continue stealing credit card numbers just because the site owners don't know any better?

Is that really a position you wish to defend?

<comment><USER71> No I don't agree that it should be allowed to continue, but how is naming&shaming people going to fix anything? Nothing is going to come of this, other than maybe some other hackers will see them as weak targets. Do you expect this list to be read on prime time CNN or something? People who want to buy something online aren't going to search through GitLab to check if the site has been hacked (maybe they should though), they just look for the green padlock and assume it's safe.

As I said, and GitLab suggested, OP should at least contact them. If you contact them and they say they won't do anything, now that's a different story...

<comment><USER72> > So far, between Oct 10 and Oct 14, 631 stores have been fixed. [0]

So it sounds like does a pretty good job of fixing things

[0] [https://gwillem.gitlab.io/2016/10/14/github-censored- researc...](https://gwillem.gitlab.io/2016/10/14/github-censored-research- data/)

</comment></comment></comment></comment><comment><USER73> The malisious code on those websites isn't your bussiness guys. If their owners wish not to respond and not fix it -- they have a right to do so. Why are you all so anxious? It has nothing to do with you all. Just don't buy from them, that is simple.

Needless to say, I've seen most of those websites for the 1st time.

The world is unfair? No, it's fair and this proves that it is fair.

<comment><USER74> What a stupid comment. Here is a list of thousands of sites that people other than you _do_ visit and buy from, causing their cards to be skimmed, and your response is 'stop being so uptight'?

Imagine if this is instead a list of real world ATMs. The correct response is not "well ive never seen these ATMs before just don't use them, duh", it's "how the fuck can this be allowed to happen and how do we fix it".</comment></comment>


Nate Silver's Lessons for Big Data from the Unpredicted Trump Victory - <AUTHOR> http://thenewstack.io/lessons-big-data-unpredictability-trump-win/ <comment><USER2> The USC Dornsife/LA Times Daybreak Election Poll

[http://www.latimes.com/politics/la-na-pol-usc-latimes- poll-2...](http://www.latimes.com/politics/la-na-pol-usc-latimes- poll-20161108-story.html)

did a significantly better job than Nate Silver and 538 in estimating the level of Donald Trump support.

<comment><USER3> No it didn't, it overestimated the popular vote too much in his direction and was off by about 5 points. Most polls were better than that.

[http://thehill.com/blogs/pundits-blog/campaign/315145-one- la...](http://thehill.com/blogs/pundits-blog/campaign/315145-one-last- look-2016-polls-actually-got-a-lot-right)

Since the 538 stuff is mostly a summary of all of those other, better polls, they got the popular vote pretty much bang on. Their modal of how that translated to the electoral college was better than any other model too.

Except for the "Donald Trump will win the popular vote, therefore he'll definitely win the electoral college, oops he didn't win the popular vote, but let's just pretend we're polling the electoral college instead" model.

<comment><USER2> USC Dornsife picked the winner. Other polls did not.

Trump got 46.1 percent of the popular vote:

[http://www.cnn.com/2016/12/21/politics/donald-trump- hillary-...](http://www.cnn.com/2016/12/21/politics/donald-trump-hillary- clinton-popular-vote-final-count/)

That is almost the same as the 46.8 percent of the popular vote for Trump that USC Dornsife predicted. Pretty close to spot on.

The other polls, including 538, underestimated the size of Trump's support.

<comment><USER3> It had Clinton a) losing the popular vote, and b) at 43.6%, a prediction of -3.2 points behind Trump versus a reality of +2.1 to Clinton, giving a total miss of 5.3% when other polls got much closer and got the popular vote winner correct.

538 did not conduct polls, only aggregate other people's. And as I said, those polls, and 538's aggregate of them correctly predicted Trump's support, including the fact that it was less than Clinton's.

<comment><USER4> "only aggregate other people"... and apply a "weight" to each. Not that he shouldn't, most of the polls were push polls. I got a real kick (and a nice check from predictit) out of the AZ polls showing H ahead by using a ~20% dem over-sample.

<comment><USER3> Yes, they weight the polls, and in doing so got a very accurate results for the popular vote.

Individual state polls had more variance than the national polls, but those were wrong in both directions, both over and understating Trump's support, mostly depending on the number of less educated white people in the state, who were apparently hard to poll, or to estimate their likelihood to actually vote.

Both you and the other poster seem to be trying to create a narrative that Trump's popular support was underestimated, when really it's just the interaction of where his support was and the electoral college system that fooled most models, though notably not the 538 model, which gave Trump a decent shot at winning. Btw, you almost certainly don't know what an "oversample" is, you should read up on that, as you use the phrase as if it is some devious way to skew the polls in one direction. Actually, while I'm on the topic, you seem to have got the wrong end of the stick about what a push poll is too. Those are devious, but do the really apply here. Just a Wikipedia summary should be enough to set you on the right path.

<comment><USER4> "accurate results for the popular vote" is irrelevant for good reasons.

<comment><USER3> I think you're in the wrong thread, this one is about who "did a significantly better job than Nate Silver and 538 in estimating the level of Donald Trump support", not who would win the electoral college.

<comment><USER4> Funny, because that's the only level of support that matters. 538 got it wrong where it counts.

</comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER5> The biggest problem with Nate Silver was that he was a victim of fake news. He got caught up in the fake news, believing that Trump have no chance.

Anybody who actually went to a Trump rally would see with their own eyes, that what Trump said was totally different from what the TVs claimed he said. They could see that the whole media was lying about Trump.

If Nate Silver had went to just one Trump rally, he would have seen that too, and he would have known that Trump was going to win. Would have been able to tweak his data set, and would have made a better prediction.</comment>


A Realist's Guide To Marketing In 2013 - <AUTHOR> http://www.forbes.com/sites/onmarketing/2013/02/12/a-realists-guide-to-marketing-in-2013/ <comment><USER2> Isn't it somewhat ironic that Forbes purports to educate the reader on modern marketing techniques with a site which seems hell bent on putting you off reading it using some of the most annoying web adverting I've ever seen. Setting filters to block.

<comment><USER3> Aside: WebKit may be the jQuery of browser engines, but Firefox with NoScript makes browsing media sites far less annoying. And with all the external script calls, they load faster and use less system resources as well. I read a recent Phonorix article, and a box flashed on the screen momentarily. I thought it might have been an image related to the article, so I did a "Temporarily allow all this page" from the NoScript menu. I had to repeat that 12 times to get all 29 of the external scripts to load. Media sites are just getting ridiculous these days.</comment></comment>


Ask HN: Will we see a raft of new or improved remote solutions for home working? - cirrus-clouds The current pandemic sweeping the world has meant that many people are now confined to their homes including school kids, university students, office workers, and of course eldery and immunocompromised individuals.
Do you think we will see an explosion of online, remote-friendly software solutions to the many different situations people find themselves in?
The scope and possibilities seem wide-ranging: improved online education platforms (more than just video + quiz), user-friendly Learning Management Systems (LMS), tools for online health management, online medical diagnostics and consultations. The list goes on.
Will this also highlight the shortcomings of current solutions and how clunky and poorly designed many solutions are?
What are your thoughts? <comment><AUTHOR> A lot of the solutions already exist. This might be the push to the shove. Also known as the inflection point. Hindsight will prove if this is the moment of the true leap.</comment>


Why Hacking Exists - <AUTHOR> http://modicus.blogspot.com/

<comment><AUTHOR> Argh, sorry.. first submission ever. I goofed up and didn't permalink: <http://modicus.blogspot.com/2008/07/why-hacking-exists.html></comment>


The A-Z of Programming Languages (2008) - <AUTHOR> http://lambda-the-ultimate.org/node/2873

<comment><USER2> Thanks for the great resource!

Similar interviews are in the following book from 2009. (I am not related to the book, I just read it years ago)

 _Masterminds of Programming: Conversations with the Creators of Major Programming Languages_

[http://www.amazon.com/Masterminds-Programming- Conversations-...](http://www.amazon.com/Masterminds-Programming- Conversations-Creators-Languages-ebook/dp/B0043D2EEU/)

 _[...] exclusive interviews with the creators of several historic and highly influential programming languages [...]

• Adin D. Falkoff: APL

• Thomas E. Kurtz: BASIC

• Charles H. Moore: FORTH

• Robin Milner: ML

• Donald D. Chamberlin: SQL

• Alfred Aho, Peter Weinberger, and Brian Kernighan: AWK

• Charles Geschke and John Warnock: PostScript

• Bjarne Stroustrup: C++

• Bertrand Meyer: Eiffel

• Brad Cox and Tom Love: Objective-C

• Larry Wall: Perl

• Simon Peyton Jones, Paul Hudak, Philip Wadler, and John Hughes: Haskell

• Guido van Rossum: Python

• Luiz Henrique de Figueiredo and Roberto Ierusalimschy: Lua

• James Gosling: Java

• Grady Booch, Ivar Jacobson, and James Rumbaugh: UML

• Anders Hejlsberg: Delphi inventor and lead developer of C#_

(Neither the _The A-Z of Programming Languages_ nor _Masterminds of Programming_ interviewed Niklaus Wirth (Pascal, Oberon, etc.).)

</comment><comment><USER3> Cool resource. Super annoying that you read two paragraphs and then have to click through five "Next" pages to read a single interview, though. Ah, the advertising model. I suppose I shouldn't complain.</comment>


Formal Verification Tool Competitions - <AUTHOR> https://alastairreid.github.io/verification-competitions/ <comment><USER2> It's kind of a shame that this subset of research is kind of stuck on C as a standard. I feel like higher abstraction languages would potentially be easier to reason about, as well as personally more useful to me.

Sure I know C11 but it's just not a tool that solves the problems I'm interested in.

<comment><USER3> A lot of embedded code is written in C. A lot of safety critical code is embedded code. This is unlikely to change in the next decade or two.

<comment><USER4> The problem is that in safety critical contexts you are using special subsets of C (e. g. like in MISRA C). I would probably make more sense to analyze languages like Ada/SPARK or Rust which already have some safety considerations respected in their designs.

</comment></comment></comment><comment><USER5> Termination competitions seem fascinating.

Are they restricted to certain subclasses of programs where the Halting Problem is solvable?

Or are they more focused on bounded termination - Will this general program terminate in at most N steps? Are there techniques that help answer this question in compressed time?

<comment><USER6> They overapproximate. This means that may say something probably doesn't terminate even if it terminates. The idea is that if it says it terminates, then there is a proof it does.

<comment><USER7> Not necessarily. For instance, CBMC has been participating in the Termination category with an approach based on Bounded model checking, an underapproximation technique. Thus, they always produce correct result, but their analysis might not terminate (or may terminate with an "unknown" verdict).</comment></comment></comment>


Is the VW emissions-test bypass a consequence of developer culture? - <AUTHOR> http://www.newyorker.com/business/currency/an-engineering-theory-of-the-volkswagen-scandal <comment><AUTHOR> This article makes the claim that engineering culture easily can lead to long- lasting misfeatures. The author surmises that the emissions workaround started as a debugging hack, and gradually got institutionalized. The author compares it to the flight simulator easter egg in Excel 97 (but makes clear the different scale of consequences).

It also says modern cars have 100 megalines of code.

I wonder how plausible these things are? If the engineering-culture explanation is plausible, I wonder if our profession needs some kind of registered professional engineer status? I wonder if we need a code of ethics that we're each personally answerable to?

</comment><comment><USER2> Please don't editorialize the titles of stories you submit to Hacker News.

[https://news.ycombinator.com/newsguidelines.html](https://news.ycombinator.com/newsguidelines.html)</comment>


Google Refine - a power tool for working with messy data - <AUTHOR> http://code.google.com/p/google-refine/ <comment><USER2> Refine rules! I've built some stuff that ya'll might find useful for hooking it up to the web (specifically CouchDB):

<https://github.com/maxogden/refine-uploader> <https://github.com/maxogden/refine-processor> <https://github.com/maxogden/refine-python> <https://github.com/maxogden/refine-ruby></comment>


Live Feed of Starship SN5 Hop Test - <AUTHOR> https://www.youtube.com/watch?v=5QbM7Vsz3kg <comment><AUTHOR> Can't wait to see if they can pull this off.</comment>


Ask HN: When to Use Matplotlib, Seaborn or GGplot for Python Plotting? - <AUTHOR> There are a lot of libraries for Scipy plotting, and I'm getting a bit confused. I want to know, when should I use which one?<p>I have read a very good discussion (http://pbpython.com/visualization-tools-1.html), but I still want to know more. <comment><USER2> I'd use the one I was most familiar with.</comment>


How RAID-6 dual parity calculation works - <AUTHOR> http://igoro.com/archive/how-raid-6-dual-parity-calculation-works/ <comment><USER2> Here's someone doing the math to generate matrices for higher amounts of parity: [http://www.spinics.net/lists/raid/msg44948.html](http://www.spinics.net/lists/raid/msg44948.html)

</comment><comment><USER3> i would rather go with this : [https://www.kernel.org/pub/linux/kernel/people/hpa/raid6.pdf](https://www.kernel.org/pub/linux/kernel/people/hpa/raid6.pdf) for much better in depth coverage...

<comment><USER4> > This article is for computer engineers who would like to have a high-level > understanding of how the dual parity calculation works, without diving into > all of the mathematical details.

That is more in depth, but is a lot more math heavy, which the author specifically states they are trying to avoid.

</comment></comment><comment><USER5> I come from a different math background, and it always surprises me people don't explain erasure encodings in terms of polynomials.

We all know that a polynomial of degree n is basically defined by n points. So a line is defined by 2 points.

If I need to encode the 2 pieces of info [a,b] I can just generate a polynomial ax+b and sample it at 2 points to recover the info. If I sample it at 3 points I can lose any one point and still recover [a,b]. The concept generalizes to higher dimensions and discrete values.

afaik that's basically it.

</comment><comment><USER6> From the article:

> This article is for computer engineers who would like to have a high-level > understanding of how the dual parity calculation works, without diving into > all of the mathematical details.

I believe that is the value proposition for reading: gaining an understanding of RAID-6 parity calculation while glossing over the math-y bits.

</comment><comment><USER7> Why does it need separate parity formulas? It would be easier to put the same simple xor in both parity blocks.

<comment><USER8> Suppose you have four disks and lose two. Consider a set of blocks where you lost two data blocks and still have two parity blocks. The parity blocks would be identical and you would not be able to recover data for either of the two missing data blocks.</comment></comment>


Functional Reactive Programming with Bacon.js - <AUTHOR> http://blog.flowdock.com/2013/01/22/functional-reactive-programming-with-bacon-js/

<comment><USER2> I am not an FRP expert but I've played around with both Elm [1] and Flapjax [2]. With both libraries, I ran into a basic mismatch with what I wanted to do. They both make it very easy to have static controls create dynamic behavior. You create the controls, observe them, and then combine their signals to output whatever dynamic output the program has.

But most interesting web UIs are not static->dynamic; they instead involve dynamic and circular dependencies. Pressing the "add new todo" control doesn't just dynamically affect the display, it also creates new controls that need to get added into the set of observable things that affect the display. This idea, of modifying existing observables to include new observables, is somewhat problematic. In examples I've seen, it ends up leading back to code just as unfortunate as imperative callbacks.

If you can use Bacon to create an entry for TodoMVC [3] showing how to have dynamic->dynamic dependencies, I'll be sold.

[1] <http://elm-lang.org/>

[2] <http://www.flapjax-lang.org/>

[3] <http://addyosmani.github.com/todomvc/>

<comment><USER3> Have a look at pyykkis' implementation of TodoMVC using Bacon.js, Transparency and Backbone Models. I think he accomplishes just that.

[https://github.com/pyykkis/todomvc/blob/bacon- transparency-r...](https://github.com/pyykkis/todomvc/blob/bacon-transparency- require/labs/dependency-examples/bacon_transparency_require/src/app.coffee)

<comment><USER4> It looks like events from newly added controls are captured here using asEventStream with jquery's event delegation.

More about event delegation here: <http://api.jquery.com/on/>

$('#container').asEventStream('click', '.someclass')

If an element with someclass is ever added as a child of #container, clicks on it will fire events. This is true even if the someclass element is added after the asEventStream call.

</comment></comment></comment><comment><USER5> TL;DR: Reactive Programming ≈ Sequence Comprehensions + Futures.

This looks pretty similar to a .NET library called Rx (Reactive Extensions). We're using it in a MonoTouch iOS app and I found it to solve some problems in a very convenient way. If you used functional style in your code, you know it shines in mapping/filtering/aggregating/reducing sequences of data. In .NET LINQ sequences have type of IEnumerable. You can think of Rx's IObservable as of IEnumerable's odd twin brother. The main difference is you IEnumerable is "cold" by its nature: it produces new items when you ask for them by calling MoveNext(). It doesn't do anything by its own. It's also synchronous.

IObservables, however, can both be cold and hot, i.e. they can yield items without being asked to. It's like IEnumerable but with "don't call me—I'll call you" approach. Because of this, it doesn't have to be synchronous. Long processes that emit one item at a time, which may later be transformed, processed in batches, throttled, etc, benefit from being expressed via IObservable. The benefit I found is you can easily switch between different asynchronous data source implementations.

For example, it's trivial to write an IObservable wrapper around iOS Photo Library that will yield one item at a time. Then you can write a function that compares cached items in array with new items that arrive from photo library, and return IObservable of "differences" between cached and new data. Then you group those differences using built-in methods into batches—and feed them to UICollectionView so it can _animate the updates as the application receives them from system API_.

Then you just write another IObservable implementation for getting photos from Facebook, and wrap it in a function that will pre-fetch their thumbnails before yielding them. It is also an IObservable. You already implemented updating collection view, so you just plug in your new asynchronous data source and that's it.

Need to implement a Dropbox file picker? You already implemented collection view logic, diff logic and prefetching images, so you just need to wrap Dropbox folder fetch API in an IObservable, and merge IObservable-s from nested folders.

On top of that, you can add some caching, and magically it will work for any data source.

<comment><USER4> Yep! It's super similar because Bacon.js is a descendant:

\- Microsoft creates Rx (Erik Meijer, one of the haskell developers)

\- Microsoft releases RxJS, a js implementation of Rx

\- Juha Paananen gets fed up with some RxJs wtfs ([http://nullzzz.blogspot.com/2012/01/things-you-should- know-a...](http://nullzzz.blogspot.com/2012/01/things-you-should-know-about- rx.html)) and makes Bacon.js

<comment><USER5> I did not know that! Thanks for sharing this.

</comment></comment></comment><comment><USER6> Anyone who's interested in this should also take a look at Functional Reactive Bindings: <http://documentup.com/montagejs/frb/>

Boasts of realtime, 2-way bindings between any JS object.

<comment><USER7> That's interesting! Do you have an idea how they implemented bindings between arbitrary JS objects? Polling?

<comment><USER6> It uses ES5 getters and setters to replace the property and react to changes. This is what makes it realtime, after the set all bound properties will have their new values.

</comment></comment></comment><comment><USER8> It really disappoints me when good projects are given names that trigger bad mental associations.

Sure, everybody loves bacon – except vegans, vegetarians, Jews, and other swine-shunning cultures – but I really don't want to be thinking about bacon when I'm programming. Nor do I want to evoke the smell, taste, and unhealthiness of bacon, nor the dirtiness of pigs, in the minds of people I talk to about Bacon.

Largely for this reason I will probably not try, use, or try to get my friends to use Bacon. Please consider changing the name, perhaps to something that evokes the conceptual spirit of the project, because I'd like to see more people adopting FRP techniques.

<comment><USER9> Sad to see you downvoted. Apparently responsible naming is a valid HN topic only when the library has titillating name with gender bias like upskirt [1] or pantyshot [2].

Maybe a better name would be pigfucker.js so as to more equitably offend everyone. But that's probably not necessary since I bet bacon.js was named after Francis Bacon anyway - right nullzzz? :-)

[1] <http://news.ycombinator.com/item?id=2729320>

[2] <http://news.ycombinator.com/item?id=2748669>

<comment><USER7> Choosing a name is hard if you consider coolness, pronounceableness, googleableness, politically-correctness and so on. Also at the time I was choosing a name for a hobby project, not an Enterprise Framework. Feel free to make a veggie fork :)

</comment></comment></comment><comment><USER10> Does anyone know of anything similar to this in python? I did a quick look around but came up empty

<comment><USER11> Trellis comes to mind. There's also Twisted if you're interested in event- driven programming.

</comment></comment><comment><USER12> I think this is related but not sure: <http://www.cs.umd.edu/projects/PL/arrowlets/>

</comment><comment><USER13> It strikes me that this would lend itself well to a graphical programming interface (a la Quartz Composer).

</comment><comment><USER14> Have you guys seen LiveScript?

<comment><USER15> I have and I love it although it's fairly orthogonal to bacon.js. The problem with livescript is that although its absolutely beautiful to a haskeller like me, almost no one uses it so the tooling is weak and building a big project in it is a massive risk.</comment></comment>


2008 Global Temperature Distribution - <AUTHOR> http://earthobservatory.nasa.gov/IOTD/view.php?id=36699

<comment><USER2> The greatest anomalies are in the most unpopulated areas?</comment>


Friendfeed is overvalued - <AUTHOR> http://wallen.typepad.com/wallen/2009/08/friendfeed-is-overvalued-.html

<comment><USER2> In what way is the valuation _just_ for the users? :)

$50M might let you put together an all-star tech team. But this $50M brings a team, some users, a decent "techy-loved" brand, some real-time code (which facebook wants so bad) and as a cherry on top absorbs a fairly big (or potential) competitor.

Yes the smart man might have spent the $50M on an all-star team. But the very smart man would have bought FF :)

<comment><USER3> It's funny how you can just predict the title of blog posts for days after a major deal closes.

All those people that would have done a better deal jumping up and down to show they know better.</comment></comment>


Show HN: Cross-platform file opening in Vim (with NERDTree integration) - <AUTHOR> Hey guys! I made a couple of plugins for Vim to scratch an itch I was left with after moving from Sublime (which I still come back to for a couple of features). I hope that I can share this and help some others to feel more comfortable trying out Vim and not having to abandon everything that they're used to, not to mention that being able to open files in your graphical file browser is useful in many cases.
https://github.com/erichdongubler/vim-file-browser-integrati...
and
https://github.com/ErichDonGubler/nerdtree-plugin-open-in-fi... <comment><USER2> Can you please add some screenshots?

<comment><AUTHOR> Done! I added some GIFs that show the plugins at work.

How do they look?</comment></comment>


YouTube costs Google $2 million per day - <AUTHOR> http://www.inquisitr.com/24740/youtube-costs-google-2-million-per-day/ <comment><USER2> Every other week these figures appear and every time on HN they are debunked.

The Credit Suisse analyst's report has little idea about how delivering large amounts of data on the net works. See my previous comments on this story for more information.

<comment><USER3> <http://news.ycombinator.com/item?id=546303>

</comment></comment><comment><USER4> Based on Credit Suisse's bandwidth cost estimate, it seems like YouTube would have to be pushing more than 10PB per day (petabytes). That's assuming a $0.10/GB bandwidth cost. Now, I'm sure that Google is getting a lower bandwidth cost than I can get on a dedicated server as just me with my credit card.

So, I think it's safe to assume from those numbers that Google's pushing a few dozen petabytes from YouTube every day. That's a lot of data.

</comment><comment><USER5> Maybe this is a stupid question, but why is google paying for bandwidth at all?

Why doesn't google own their own bandwidth provider? Didn't they buy up a bunch of dark fiber a while ago?

Lease it to the providers and use that to subsidize their own bandwidth. Or am I totally missing the point?

<comment><USER6> They're probably already doing settlement-free peering with various ISPs due to their sheer volume of data transfer, which would mean that they aren't paying for all of the bandwidth they're using. Otherwise, the ISPs they're peering with would have to pay someone else for the bandwidth to use YouTube.

</comment></comment><comment><USER7> There was a big media frenzy back when Google first announced its edge-caches physically located in ISP server rooms: [http://techliberation.com/2008/12/16/edge-caching-vs- prefere...](http://techliberation.com/2008/12/16/edge-caching-vs-preferential- treatment/) [http://www.dslreports.com/shownews/The-Wall-Street- Journals-...](http://www.dslreports.com/shownews/The-Wall-Street-Journals- Google-Hatchet-Job-99684) <http://online.wsj.com/article/SB122929270127905065.html> [http://googlepublicpolicy.blogspot.com/2008/12/net- neutralit...](http://googlepublicpolicy.blogspot.com/2008/12/net-neutrality- and-benefits-of-caching.html)

Why has everyone forgotten?

</comment><comment><USER8> Yes, but that is $2 million in internet dollars.

</comment><comment><USER9> Eric Schmidt was talking about how 'micropayments' were the solution. Maybe people would pay a couple cents per video.

<comment><USER5> Would you?

For me, youtube has largely replaced pirating music as a means for discovering bands (this is why it angers me so much when videos get muted). The cost for me to check out a band I might be interested in is ~$0.00.

If they started charging me for this, I would either want something that I got to keep, or I would start pirating again.

<comment><USER9> But music videos are promotional, meaning the _label_ would pay YouTube/Google for the cost of distribution. You don't get CD quality on YouTube (and I actively buy CDs because they sound better to me than MP3).

I mean TV shows, lectures and science programs - video with educational value.

</comment></comment></comment><comment><USER10> I'm guessing they can hold out long enough for flash p2p penetration.

</comment><comment><USER11> Cool! So, what else is new?

Facebook isn't making any money?!</comment>


Show HN: Virtualenv-mv – Move (rename) Python virtualenvs - <AUTHOR> https://github.com/brbsix/virtualenv-mv <comment><USER2> There is [https://github.com/berdario/pew](https://github.com/berdario/pew) which provides a better wrapper around virtual environments compared to virtualenv wrapper.

It also supports renaming.

<comment><USER3> > a better wrapper around virtual environments compared to virtualenv wrapper

This comment alone tells me there's something wrong about python's modularisation. And I'm saying this as a python programmer. Why didn't Python 3 clean up this mess? Or am I missing something there?

<comment><USER4> virtualenvwrapper isn't part of virtualenv or python. Are you saying that the existence of virtualenv tells you there's something wrong?

<comment><USER3> No, my point is rather: Why do we need virtualenv at all (and worse, more wrappers around it)? Why should, say, pip packages have any problems with each other as long as they aren't imported directly in a python sourcefile. It seems like versioning of packages isn't solved correctly at the interpreter level, that's why we have the virtualenv crutch.

<comment><USER5> _Why should, say, pip packages have any problems with each other as long as they aren 't imported directly in a python sourcefile._

Are you suggesting that package versions should be explicitly provided as part of import statements? Or that import statements should be mangled depending on the versions specified in setup.py?

<comment><USER3> > Are you suggesting that package versions should be explicitly provided as > part of import statements?

Yep, see also my suggestion in the other subthread.

</comment></comment></comment></comment></comment></comment><comment><USER6> why is this necessary? shouldn't you just delete it and recreate it?

installation via pip ought to take advantage of wheels and such, no?

<comment><USER7> Would be useful for packaging up a virtualenv in an RPM (though I avoid doing that for various reasons), if there was an option to fix the paths without actually performing the move.

<comment><USER8> Oh god. I just went through this shit show for a .deb archives. Python is an absolute nightmare to package and distribute this way.

<comment><USER9> Perhaps this is useful for you? [https://github.com/spotify/dh- virtualenv](https://github.com/spotify/dh-virtualenv)

<comment><USER8> I looked at that but didn't use it because I wanted to avoid adding yet another packaging tool into our toolbox. Instead I use virtualenv-tools and fpm. We use FPM for packaging needs and it works well enough.

</comment></comment></comment></comment></comment><comment><USER10> This should be called virtualenv-rename right, otherwise what does virtualenv --relocatable do?

Python/Java using the file system to map hierarchies of classes is such a mistake when you start using a language like Elixir; you can move any .ex files anywhere you like within your project and it just works.

<comment><AUTHOR> The script is most akin to the Unix `mv` command, in fact it uses it, so that's why I called it virtualenv-mv. I figured this would be most easily understood.

Just out of curiosity, have you used `--relocatable` much? It basically attempts to rewrite full paths into relative paths. Whereas with `virtualenv- mv`, there should be no indication that the environment has been moved. As far as `--relocatable` is concerned... I think even the author(s) regret having included it, if that gives you any indication of how useful it is.

<comment><USER10> Why would you rename a virtualenv? They should be named "env" and you should change the prompt that pops when you enter it to be something like "(VENV: projectname)".

<comment><USER11> You might want to move our copy it to another directory. I had this problem recently when I wanted to use an env that had a bunch of packages that take a long time to compile, but since it didn't work I had to reinstall them in a new env.

</comment></comment></comment></comment><comment><USER12> this is cool, ive been burned by trying to move a virtualenv before and discovering everything broke. is it possible to merge this into virtualenv? i think it would be much easier to use that way.</comment>


A Grand Unified Theory of Avocado Toast - <AUTHOR> http://www.newyorker.com/culture/cultural-comment/a-grand-unified-theory-of-avocado-toast <comment><USER2> This article is bizarre. It starts off with a story that fails to justify why avocado toast is relevant, meanders through personal antecdotes, then drones on about the history of advocados in the US. Pass.

<comment><USER3> > Today, nine out of ten imported avocados in the U.S. are from Mexico.

>A politics of avocadoism is intrinsic to this history. If you worry about the eclipse of American agriculture—or the market effects of cheap, distance- shipped produce—you'd be right to regard this international trade with disgust.

>If, on the other hand, you celebrate competitive international trade and cosmopolitan access, the avocado is a fruit of heroism.

The point that the author is making is that the "anti-avacado" sentiment is a result of anti-urban and anti-globalization/anti-globalist sentiment. It's something that cities have more access to, is relatively new, and is imported from mexico. Its a partisan division.

<comment><USER4> > nine out of ten imported avocados in the U.S. are from Mexico.

Why is the author surprised that 90% of IMPORTED avocados come from the only avocado-producing nation with which we share a land border? Why even state that figure? I'm surprised it's not higher; there must be mighty tasty avocados down in Central America.

In fact, only 70% of all avocados eaten in the US are imports. [1] So, only 63% come from Mexico.

[1] [http://pdf.usaid.gov/pdf_docs/PA00KP28.pdf](http://pdf.usaid.gov/pdf_docs/PA00KP28.pdf)

</comment></comment></comment><comment><USER5> I don't think I've ever seen an avocado in person. I was shocked to discover my apparent obsession with something I've never experienced was why I couldn't afford a house.

<comment><USER6> As someone who has seen, and regularly consumes avocados for no more than about $2.50 per fruit, I too am a bit confused about what relationship this has with my inability to afford a $250,000 deposit on a Sydney 1 bedroom apartment.

<comment><USER7> The reference is to cafes, not making it at home. Aussie cafes charge like $20 for avo toast and millennials line up to pay it.

<comment><USER8> I don't know where you're buying it but BNE CBD cafes charge barely over $10 in most cases that I see.

Still, I find avocado disgusting so I have no desire to eat it. I also own a unit though so I'm not helping whatsoever with the stereotype.

<comment><USER9> It's intergenerational cultural cringe. First it was Chardonnay socialists, then caffè latte drinkers, now it's war on avocado on toasted bread. But one might ask why avocado prices have soared from five years ago - I buy a bag of six smallish ones from Aldi these days for $6.70.

</comment></comment></comment></comment></comment><comment><USER10> I don't even bother with the toast, just eat it with the spoon from the shell. Is that weird? I am sure I am not the only one.

The reason I like them so much, is they remind me when I used to climb walnut trees to get green walnuts. The avocado somehow tastes like that white unripened walnut meat.

<comment><USER11> I do the same. But with a bit of lemon juice and pepper.

<comment><USER12> You can eat an avocado with almost anything and it its delicious.

</comment></comment></comment><comment><USER4> Every time I don't buy avocado toast, I buy something else to eat. I don't see how avoiding it helps to save money?

And, that stupid picture. For $8, I get TWO slices, each a LARGE piece of (organic whole-wheat) bread, with additional veggies and a nut spread, from some upscale vegan place in downtown Boston no less. If you're getting a tiny slice of Wonderbread with half an avocado on it like the article's picture suggests, of course you're getting ripped off.

<comment><USER13> The idea is you buy something cheaper, or have cereal. That way you save money, and have more money to put towards a house.

<comment><USER4> If the argument was "millenials eat out too much", that they are spending $8/meal×3 meals/day×365 days/year = $8760/year eating out, it would be an interesting article.

But the article is entirely about "avocado toast", a meal that, while popular, is not eaten more than once per week even by any millenial I know. Saving $8/meal×1 meal/week×52 weeks/year = $416/year is so laughably far from helping save for the down payment of a home, especially in a market where avocado toast is popular, like Boston, where it would take 100 years.

The article is vapid. It could be summed up as "get off my lawn" but because the author of this content-free piece is somehow employed by the New Yorker, he found it necessary to wrap it in a dozen paragraphs of purple prose.

</comment></comment></comment><comment><USER14> I created something called "Dinosaur Eggs" in NYC that at least one restauranter has told me he "stole" and now features in his spot in vegas.

Halved avacdo; remove the seed; fill the hole with things of your choosing.. I like nutritional yeast, chia seeds, olive oil, sea salt, habenero sauce.

I've also done blueberries, other seeds, sprouts. All delicious.

<comment><USER15> Mexican people I knew while livong there put tuna salad in it during lent

</comment></comment><comment><USER16> I had no idea Hass avocados were mainly descendants of one tree!

</comment><comment><USER17> To all the people who keep saying things like "I don't eat avocado toast but I can't afford to buy a house either. Counter example! QED LOL", you're missing the point. It's not about avocado toast obviously. The point is that millennials spend money on frivolous luxuries and then complain that they can't afford anything. He was using avocado toast as an example. Duh.

<comment><USER18> > The point is that millennials spend money on frivolous luxuries and then > complain that they can't afford anything.

They seem to be spending less (percentage wise) than the previous generation[1]. I can understand why some people would be upset if they were told, "Even though you're spending less than I did on luxuries, you're still spending too much." Particularly when they are told that getting a sandwich for lunch is a luxury they can't afford.

[1] [https://www.morganstanley.com/ideas/millennial-boomer- spendi...](https://www.morganstanley.com/ideas/millennial-boomer-spending)

<comment><USER17> Who says the previous generation spent the "correct" amount? Where in the contract that we all signed when we became adults did it say "The cosmos shall ensure that no generation should ever have to spend less than the previous generation on anything"?

</comment></comment></comment><comment><USER19> To be fair, buying coffees and lunch really does start to add up if the alternative is that it's sitting in an index fund. $20 every day for a year for ten years is around 114k at 8% interest. That is a down payment on a house in most areas.

<comment><USER20> Yes! This is the guys point.

I am probably a millennial by some definitions, but I can't stand the complainer variety that just beg for something to bitch about.

Yeah, it's not as easy as it was before for the most part. But you can still work hard and make it, assuming you're not completely under-privileged.

<comment><USER21> Far too many people are now "completely under-privileged" and will end up poor despite their efforts.

But even beyond that, humanity progresses. So many new technologies and increased efficiencies have come about in recent years. Why then, do we see the opposite effect on lay people? So many people today cannot find work or aren't being paid enough to live on even to the standards of 20 years ago. This isn't whining, this is recognising inequity.

</comment></comment></comment><comment><USER22> I eat avocado toast and I've never even seen that shit on a menu. I discovered it on my own. Somehow this 'phenomenon' is still news. Not everything has to be a 'thing'.

<comment><USER23> And yet, you can see people buying expensive avacado toast. What does your anecdotal evidence add to the conversation?

<comment><USER22> What conversation?

</comment></comment></comment><comment><USER24> This is an ad for SoFi.

</comment><comment><USER25> Step one: skip the toast.

Seriously, no toast. You don't really need carbs to eat avocado with, though it's true that corn chips go well with guacamole.

</comment><comment><USER26> > "If avocado toast costs around $8 a serving, you'd have to skip > approximately 4,900 of those beloved toasts to afford that new home."

Remember that journalists make an average salary of $37,720(according to a quick Google search). You're not going to get a lot of advice or insight into handling your money from someone who can barely afford his rent. I don't think his goal was to give advice(I'm not really sure what the article's point was, to be honest), but I suggest avoiding taking advice from journalists nonetheless.

To a first approximation, cutting a habit of $8/day for 200 days/year would immediately raise your net worth by ~$20,000 in my eyes. You can't pay your down payment in net worth, but nonetheless you could easily buy a $180,000 property with just that change alone after 4 years.

<comment><USER27> The original comment was made by an Australian, who was essentially saying "young Australians are not frugal enough to buy property", despite real house prices growing much faster than inflation or wages and spending by young people on dining out/entertainment being lower than past generations. It's actually a reference to this [1] tongue-in-cheek article which, while obviously a joke, touched a nerve amongst young people in a city where the median house price is 1.1M AUD/850USD. Also, other issues with your maths aside, $180,000 properties don't exist in Australia in places with employment opportunities.

[1] [http://www.theaustralian.com.au/life/weekend-australian- maga...](http://www.theaustralian.com.au/life/weekend-australian- magazine/moralisers-we-need-you/news- story/6bdb24f77572be68330bd306c14ee8a3?nk=ab6d3ecb1bb2f193d94d861c8652975c-1500002549)</comment></comment>


The People Who Support Linux: 19-Year-Old Aims to be a Kernel Developer  - <AUTHOR> http://www.linux.com/news/featured-blogs/200-libby-clark/724859-the-people-who-support-linux-19-year-old-aims-to-be-a-kernel-developer

<comment><USER2> Its good that he seems to have ambition. But it sounds like he's in the wrong line of work. Also the article was horrible and doesn't belong here just because it has to do with computers.</comment>


The Demand for iPhone 5s Shows that Apple Has Done It Again - <AUTHOR> http://allthingsd.com/20130920/apple-demand-for-new-iphones-has-been-incredible/

<comment><USER2> They base their entire "Apple has done it again" argument on the fact that the stores "sold out"?

There were already reports earlier that Apple will have very limited supply of iPhone 5S, so that doesn't say much.</comment>


Amazon Updates Their Login Screen for the First Time in a Decade - <AUTHOR> http://www.fastcodesign.com/3035030/fast-feed/amazon-updates-their-login-screen-for-the-first-time-in-a-decade

<comment><USER2> Interestingly, back in the day Amazon actually let you have many separate accounts on a single mail address, as that is a common use case in e.g. middle America (husband and wife sharing an address which came with their ISP, usually).

</comment><comment><USER3> I still see old login screen when I click "sign in" in incognito mode on amazon.com

Out of 5 loads Amazon showed me old screen 4 times and new screen 1 time.</comment>