Dennis Ritchie's first C compiler on Github - <AUTHOR> https://github.com/mortdeus/legacy-cc <comment><USER2> Coincidences... I thought "How come Warren Toomey (one of the guys of the Unix Heritage Society [1]), has never posted this?"

Turns out, this Github-repo is just a mirror/copy of his work, but with attribution [2]. Still worth reading through there, tuhs also stores some extremely old UNIX versions.

[1] www.tuhs.org

[2] <http://cm.bell-labs.com/cm/cs/who/dmr/primevalC.html>

Edit: Warren has written a paper on restoring ancient UNIX versions and C-compilers, you might like it [3]

[3] <http://epublications.bond.edu.au/infotech_pubs/146/>

Edit2: Now that I've thought a little bit about it, I'm not happy that the sources are on GitHub in this form. This is Warren's work - he did a lot of work in getting these tapes to work again, and "mortdeus" just copied the work and didn't even change the folder-names - "last1120c" is the first tape, "prestruct" the second. And you still need Warren's Apout emulator to get these files to work.

<comment><USER3> > Edit2: Now that I've thought a little bit about it, I'm not happy that the > sources are on GitHub in this form.

If one releases code under an open license and people use/copy/fork it, why should you or the original author be unhappy. (As long as the license terms are not being broken.)

If we had to worry about this each time we forked/cloned someone's work, it would make code reuse very hard.

[Edit]

I am working on some Python charting. I found Pychart, which I found interesting: <http://home.gna.org/pychart/> . Because it is in bzr which I don't work with, I put it on github. Should I be worried that someone will feel offended with it?

<comment><USER4> If you're within the terms of the license, you're fine. The developer should say so in the license (or choose another license) if they don't want it reproduced anywhere. A link to the original is common courtesy, however.

In the case of the C compiler, I think the modifications are under the same license as the original, but I'm not totally certain. If they aren't it would be cause for concern.

</comment></comment></comment><comment><USER5> Reading Dennis Ritchie's code is as close to reading a religious text as I'll ever come. The straightforward elegance of it is so inspiring!

<comment><USER6> The lack of type noise makes it easier to read too.

<comment><USER4> I can't disagree more! Everything is an int -- Basically untyped, in C terms! Maybe less noisy, but hard to figure out what's going on.

</comment></comment></comment><comment><USER7> The declaration of printf is both scary and pretty cool.

What happens when you have more then 9 substitutions specified in the string? :D

edit: decided the code was a bit long to have pasted into my post. Can find it at the bottom of <http://cm.bell-labs.com/cm/cs/who/dmr/last1120c/c03.c>

<comment><USER8> This is the compiler's printf(), not the one that gets linked in with compiled code. As long as the compiler itself doesn't have more than 9 substitutions, it's OK. Your code will link with a different one.

</comment></comment><comment><USER9> I'm ashamed for having to google his name but for others like me here's a glimpse:

"Dennis MacAlistair Ritchie (born September 9, 1941; found dead October 12, 2011) was an American computer scientist who "helped shape the digital era." He created the C programming language and, with long-time colleague Ken Thompson, the Unix operating system"

<http://en.wikipedia.org/wiki/Dennis_Ritchie>

<comment><USER10> You should have seen HN when he died. It was that hell week of a bunch of early computer pioneers all passed away...

<comment><USER11> To be honest, I don't remember much of a hullaballo when either Dennis Ritchie or John McCarthy died. There was a post or two on each event, but nothing like when Steve Jobs died (when literally the entire front page was posts about his death).

(All three events were in October 2011 - Jobs, then Ritchie, then McCarthy)

</comment></comment></comment><comment><USER12> He already used the right brace style (hanging braces, cuddled else) and the right indentation (tabs, not spaces).

<comment><USER13> Somehow over the years learning C on my own, perhaps because it seemed more consistent to me, I got used to writing

        if(foo) {

omitting the space after control statements' names, which is almost never done - except in very early C code. (It's not just this: V7 Unix often omits the space as well.). I should probably settle on a less idiosyncratic personal style, but I can't help but take a little heart from seeing "my" style in such a famous codebase. :)

<comment><USER14>
        if(foo)

I avoid doing this because it looks like a function call.

<comment><USER15> In an appropriately powerful language, it could be a function call.

<comment><USER16> This is all very well if you have a friendly, high level scripting language like Ruby, but I'm definitely glad I don't have to write a C compiler where functions can take arbitrary blocks of code.

<comment><USER17> > In an appropriately powerful language, it could be a function call.

> This is all very well if you have a friendly, high level scripting language > like Ruby, but I'm definitely glad I don't have to write a C compiler where > functions can take arbitrary blocks of code.

That's a surprisingly good setup because in Smalltalk(one of ruby's main ancestor languages)

if/else is a method which takes a block closure.

        a ifTrue: [ l log: 'a is true'] ifFalse: [ 'a is false']

while

in ruby if else is a syntatic construct

        if a
            l.log ('a is true')
        else
            l.log ('a is false')
        end

probably more for perceived clarity/comfortability then speeds sake.

</comment></comment></comment></comment></comment></comment><comment><USER18> Is this written in C? If so, what compiled this? Sorry for the noob question, I'm just a little lost.

<comment><USER19> Looks like a very early dialect. C assumes everything is an int unless specified otherwise. You can declare parameter types after the function name. So:

      init(s, t)
      char s[]; {

would be equivalent to:

      int init(char s[], int t) {

This still works with modern compilers.

I'd be interested if anyone has any more info about this:

      waste()		/* waste space */
      {
      	waste(waste(waste),waste(waste),waste(waste));
      	waste(waste(waste),waste(waste),waste(waste));
      	waste(waste(waste),waste(waste),waste(waste));
      	waste(waste(waste),waste(waste),waste(waste));
      	waste(waste(waste),waste(waste),waste(waste));
      	waste(waste(waste),waste(waste),waste(waste));
      	waste(waste(waste),waste(waste),waste(waste));
      	waste(waste(waste),waste(waste),waste(waste));
      }

Found in last1120c/c10.c

<comment><USER20> From the linked description (<http://www.cs.bell- labs.com/who/dmr/primevalC.html>):

A second, less noticeable, but astonishing peculiarity is the space allocation: temporary storage is allocated that deliberately overwrites the beginning of the program, smashing its initialization code to save space. The two compilers differ in the details in how they cope with this. In the earlier one, the start is found by naming a function; in the later, the start is simply taken to be 0. This indicates that the first compiler was written before we had a machine with memory mapping, so the origin of the program was not at location 0, whereas by the time of the second, we had a PDP-11 that did provide mapping. (See the Unix History paper). In one of the files (prestruct-c/c10.c) the kludgery is especially evident.

<comment><USER19> Doh, I completely glossed over the readme and went straight to the code. That makes sense -- Thanks!

Cool to think that that waste function can still compile with todays compilers. A quick disassembly it seems to take up 751 bytes compiled on x64 using clang on O0.

</comment></comment></comment></comment><comment><USER21> Also see my B compiler that was inspired by these early C compilers: <https://github.com/aap/abc>

<comment><USER22> Gorgeous! Have good fun, thx for the link

</comment></comment><comment><USER23> Someone should check that thing for back doors!

<http://cm.bell-labs.com/who/ken/trust.html>

<comment><USER24> Too late. Ken Thompson already put the back door in his B compiler.

</comment></comment><comment><USER25> If you like c compilers, also check out <http://bellard.org/tcc/> and <http://bellard.org/otcc/>

The later is a c compiler in about 1kb of source code! It's quite functional and can compile itself.

The first link is what came out of it: A compiler so fast, that it can boot Linux from source code in a few seconds: <http://bellard.org/tcc/tccboot.html>

</comment><comment><USER26> It felt weird being able to read it and understand (on a high level) what was happening.

<comment><USER27> I didn't understand anything but I want to. Where do you start reading to follow the flow?

</comment></comment><comment><USER28> Can anyone explain the naming of files? c00.c, c01.c etc

<comment><USER21> c0 is the first pass (c to intermediate), c1 is the second pass (intermediate to assembly), c2 is the optimizer. c0 is built from files beginning with 'c0' and so on.

<comment><USER28> Thanks for the explanation

</comment></comment></comment><comment><USER29> Can anyone get this to compile and run?

Does anyone know what hardware the assembly language files are for?

Maybe you could produce a modified version with the archaic features removed, compile it with a modern compiler, then use the binary produced to compile an unmodified version. Or maybe there are still binaries of really old compilers that can understand this code floating around out there.

Any ideas?

</comment><comment><USER30> I don't understand this

        main(argc, argv)
        int argv[]; {

Is that still valid today?

<comment><USER5> It's called a K&R style function definition, which was the way to do it _back in the day_. Basically, you define your parameter names first, then you define the parameter types immediately after the function but before the opening curly brace. It's definitely not recommended today and can result in undefined behavior if your compiler doesn't recognize it. If you're working with legacy code, though, I'm pretty sure you can set some C compilers to allow for it.

To explain further:

        main(argc, argv)
        int argv[]; {

is equivalent to:

        int main(int argc, int argv[]) {

The old style definition works because C had a default type of int, so the type specifications for the function main and the parameter argc could be omitted.

As for int argv[]? What that actually represents is an array of memory addresses that hold the command line arguments given. Obviously this becomes a problem if you're on a 64-bit system, where int and (void * ) are two different sizes. However, I checked this out on my 64-bit machine and it works just fine:

        int main(int argc, unsigned long long argv[]) {
          char *firstarg = (void *)(argv[1]);
          printf("%s", firstarg);
        }

which, given "./a.out pickles" will print "pickles" (argv[0] gives the memory address of the cstring "./a.out"). I'm guessing that, in the case of a compiler, the memory addresses of arguments are more relevant to have than the arguments themselves.

<comment><USER31> The 1999 ISO C standard dropped the "implicit int" rule, so this:

        main(argc, argv)
        char *argv[];
        {
            /* ... */
        }

is illegal (strictly speaking, it's a "constraint violation"). Note that it's

        char *argv[]

not

        int argv[]

But this:

        int main(argc, argv)
        int argc;
        char *argv[];
        {
            /* ... */
        }

is still perfectly valid.

As for this:

        int main(int argc, unsigned long long argv[]) {
          char *firstarg = (void *)(argv[1]);
          printf("%s", firstarg);
        }

it's not a constraint violation, but its behavior is undefined (unless your compiler specifically supports and documents that particular form as an extension).

<comment><USER5> We're talking about the code from the actual source files, not the standard.

Look here (lines 22 and 23): [https://github.com/mortdeus/legacy- cc/blob/master/prestruct/...](https://github.com/mortdeus/legacy- cc/blob/master/prestruct/c00.c)

The compiler code states int argv[], not char _argv[] (I assumed this is why the OP asked for clarification in the first place, since char_ argv[] is much more common).

You're right, in theory this is undefined behavior, but in practice on a 32-bit system, sizeof(int) will almost always be equal to sizeof(void *). I was just demonstrating how one could recreate the code in the compiler while on a 64-bit architecture.</comment></comment></comment></comment>


Linode Security Advisory - <AUTHOR> https://blog.linode.com/2016/02/19/security-investigation-retrospective/ <comment><USER2> _Update: also, read this comment_ right away. [https://news.ycombinator.com/item?id=11136948](https://news.ycombinator.com/item?id=11136948)

I find this update very hard to follow. Can someone tell me if I'm misreading it? I'm going to quote it twice, and then attempt to summarize:

 _After examining the image from our July investigation, we discovered software capable of generating TOTP codes if provided a TOTP key. We found software implementing the decryption method we use to secure TOTP keys, along with the secret key we use to encrypt them. We also found commands in the bash history that successfully generated a one-time code. Though the credentials found were unrelated to any of the unauthorized Linode Manager logins made in December, the discovery of this information significantly changed the seriousness of our investigation._

and then:

 _The findings of our security partner's investigation concluded there was no evidence of abuse or misuse of Linode's infrastructure that would have resulted in the disclosure of customer credentials. Furthermore, the security partner's assessment of our infrastructure and applications did not yield a vector that would have provided this level of access._

 _Linode's security team did discover a vulnerability in Lish's SSH gateway that potentially could have been used to obtain information discovered on December 17, although we have no evidence to support this supposition. We immediately fixed the vulnerability._

Here is my read of what this says; I'd like to know if I'm wrong.

"One of our customers got owned up in July, and gave us an attacker source address within Linode. We pickled up the attacker's host. In December, we examined the pickled host, and found secrets related to the way we store 2FA credentials, indicating that our credentials database may have been compromised. In conclusion: we have no idea how that could have happened."

Am I missing something else?

<comment><USER3> Yeah, they really gloss over the fact they have no idea how the TOTP secret key was compromised, which worries me the most.

<comment><USER4> They changed the 2FA to use a microservice, so _whatever_ the vulnerability was before, if the 2FA is now on an isolated server, that vulnerability shouldn't have access to the new 2FA key.

<comment><USER5> I think it's fairly important to note that they're NOT currently using the microservice for the 2FA, and they're NOT using bcrypt right now.

The blog post states they're "working towards" these changes, they're not currently in place. It's fairly unlikely that they're using the same secret key as the one they found on the server, but it's fair to assume that they are still using salted SHA-2 for your passwords and the same 2FA setup right now.

They likely won't roll out the major changes until they roll out the "new and improved" Linode dashboard they're coming up with.

<comment><USER6> The article didn't state that. The article stated they are rolling out soon. The new dashboard will be an open source project. So you'll know when that gets released. There is no link to the project yet so assume that part isn't started yet. So the microservices should be released in a timely manner. Let's hope with the new focus on transparency if there are any delays they will keep us posted.

<comment><USER5> Isn't that exactly what I said? o.O I said they will "likely" get rolled out with the new dashboard, not that the article said they would lol. But, they never stated when it would happen anyways, so "delays" aren't really a thing when there's no deadlines.

</comment></comment></comment></comment></comment></comment><comment><USER7> The page's title "Security Investigation Retrospective" fits the content better than the current HN's "Linode Security Advisory": it is about last July's breach that caused January's password reset; what happened and what they've done about it.

</comment><comment><USER8> Not sure what to think about Linode anymore, on the one hand from a pure reliability point of view they have been bullet proof, had a few issues during the DDoS in December and I've always found their support to be good (the few times I've used them in 7 years).

On the other hand they've had security issues fairly regularly and their response to the DDoS was pretty poor.

That said if I was a cynic I'd say they probably have one of the best setups for dealing with future attacks (old joke about never firing an employee who made an expensive mistake because he'll never make that mistake again) and _finally_ seem to be taking security seriously, for me the list of changes all sound good (particulary open sourcing Linode Manager and tokenising CC's had to reset a card because of them once before).

We are slowly moving a lot of stuff back to a DC up the road but we still have some stuff with them.

<comment><USER9> I feel DO's level of service is on-bar. I've gotten multiple discounts from DO for "annoyances" I wasn't even annoyed by.

<comment><USER10> This is because DO is desperate to retain customers. I don't know if it's still the case, but a year or so ago the CEO was personally handling customer service, responding via email and adding credits to people's accounts. If the CEO has that much time on his hands, to personally handle every customer dissatisfaction, then the customer base must be quite small.

I think for me the largest red flag was DO not even having bandwidth monitoring in place. The only reason there were no bandwidth limitations was because they were not even physically tracking bandwidth usage. How do you launch a hosting platform without something as basic as being able to monitor bandwidth?

<comment><USER11> DO aren't small: [http://news.netcraft.com/archives/2015/05/01/digitalocean- be...](http://news.netcraft.com/archives/2015/05/01/digitalocean-becomes-the- second-largest-hosting-company-in-the-world.html)

</comment></comment></comment></comment><comment><USER12> >Linode's security team did discover a vulnerability in Lish's SSH gateway that potentially could have been used to obtain information discovered on December 17, although we have no evidence to support this supposition. We immediately fixed the vulnerability.

Yeah, LiSH was exploited like 3 years ago...

Unless it's been completely redesigned it's probably still got heaps of vulnerabilities, screen wasn't designed for untrusted input.

>CC Tokenization: Although our investigation yielded no evidence of credit card information being accessed, we are taking advantage of our payment processor's tokenization feature to remove the risk associated with storing credit card information.

Nobody thought about doing this when every customers card plaintext card info was taken years ago?

Anyway, the entire blog post is bullshit. It completely fails to address their previous security track record. A single hack isn't that big of a deal, but this has happened to Linode countless of times.

</comment><comment><USER13> It seems like the post creates more questions than it answers, but it's great that they are sort of transparent. I guess it's due to ongoing investigation.

But it is quite surprising that someone was able to acquire the key for the token generation and they seem to have no explaination for it. And wow, they only started tokenizing credit cards now? And SHA-2 for password hashes?

THB, after reading this post my confidence in them hasn't really increased. It feel like: "We fucked up, but are not exactly sure why but will fix some issues nevertheless".

<comment><USER14> > SHA-2 for password hashes

They're moving on from them, but they're going to leave SHA-2s sitting there and wait _until_ everyone logs in to upgrade to bcrypt hashes at rest.

Not getting a super competent vibe off of these folks.

<comment><USER15> Waiting until login until you upgrade to bcrypt is a requirement is compotent password storage. At this point in time all Linode should know is SHA-2(password) and they can't use that to derive bcrypt(password).

The way upgrade should work is that the user provides their password, which is verified with SHA-2 and then hashed with bcrypt and stored again.

In order to do this without people logging in Linode would have to bcrypt hash the SHA-2 hashed passwords and then keep doing that for all password validations.

<comment><USER14> > Waiting until login until you upgrade to bcrypt is a requirement is > compotent password storage

It's not even remotely competent. This blog makes it clear they're not even sure how their secret key was stolen. These hashes could be walking out their backdoor as I type this. Keeping vulnerable hashes at rest is insane.

It would be far more competent to bcrypt the SHA-2s, so that at least when the hashes wander out the backdoor they haven't really found, peoples passwords aren't trivially attackable.

> In order to do this without people logging in Linode would have to bcrypt > hash the SHA-2 hashed passwords and then keep doing that for all password > validations.

No, they'd just have to replace Bcrypt(SHA-2(password)) with Bcrypt(password) once the customer finally logs in.

It's an immediate net upgrade to the resistance of at-rest Hashes to brute force attacks with zero downside.

<comment><USER15> That will work as a way to strengthen the hashes (a few other people pointed that out as well).

My point was that if you have a system which can go straight from SHA2(password) to bcrypt(password) then the system must be storing the plaintext of the password, which would be very bad.

<comment><USER14> > My point was that if you have a system which can go straight from > SHA2(password) to bcrypt(password) then the system must be storing the > plaintext of the password, which would be very bad.

Yes, I understand that. It's just completely irrelevant to the question of whether or not it's competent practice to store vulnerable hashes indefinitely, awaiting customer log in.

Again, it is not a competent practice. Wrap vulnerable hashes in strong ones immediately; they're a huge liability to leave sitting in your storage even when you don't have evidence that there's a backdoor in your systems that you cannot seem to find.

</comment></comment></comment></comment></comment></comment><comment><USER16> Two things in their "What We're Doing About it" section really surprised me because they are things I would have expected a company of their size and sophistication to have done long ago:

> we are taking advantage of our payment processor's tokenization feature to > remove the risk associated with storing credit card information

> we are hiring a senior-level security expert

</comment><comment><USER17> Hey There,

I'm a PagerDuty employee and am the same individual who made this post on the last HN thread:

* [https://news.ycombinator.com/item?id=10845985](https://news.ycombinator.com/item?id=10845985)

Unfortunately, there are some facts in Linode's post that are not correct.

>On July 9 a customer notified us of unauthorized access into their Linode account. The customer learned that an intruder had obtained access to their account after receiving an email notification confirming a root password reset for one of their Linodes. Our initial investigation showed the unauthorized login was successful on the first attempt and resembled normal activity.

This is almost correct. Someone got in to our account on the first try. They knew the password and a valid TOTP token. Although, Linode's email isn't what notified is, it was our intrusion detection system.

>On July 12, in anticipation of law enforcement's involvement, the customer followed up with a preservation request for a Linode corresponding to an IP address believed to be involved in the unauthorized access. We honored the request and asked the customer to provide us with any additional evidence (e.g., log files) that would support the Linode being the source of malicious activity. Neither the customer nor law enforcement followed up and, because we do not examine customer data without probable cause, we did not analyze the preserved image.

This is partially correct. We informed Linode that we saw suspicious activity within their network, and reached out to them to inform them. We provided any and all logs we had. We also informed them that we passed the info on to law enforcement, in case they wanted to proactively preserve the data. The knew we had no further information, and as such didn't ask for anything additional.

>On the same day, the customer reported that the user whose account was accessed had lost a mobile device several weeks earlier containing the 2FA credentials required to access the account, and explained that the owner attempted to remotely wipe the device some time later. In addition, this user employed a weak password. In light of this information, and with no evidence to support that the credentials were obtained from Linode, we did not investigate further.

The story behind the mobile device is totally incorrect. The user did not lose their device, the device had been restored (intentionally wiped) 9 months prior to the compromise. The user got a new device, and never set up MFA on their new phone after wiping the old one. The device was, and still is, in the user's possession. The device has not been powered on in a long while.

The user who was compromised was no longer in possession of their MFA secret. They deleted it, intentionally, with no backups existing.

If anyone here is going to be at Velocity 2016 in Santa Clara, or at Monitorama PDX 2016, I'll be giving talks on how PagerDuty was compromised back in July. This includes _full_ details of how this happened, including the details of the mobile device referenced above. There are some details in my talk that don't line up with the blog post provided by Linode. :)

<comment><USER18> This is very helpful information. Can you say if you've moved to a different provider or if you're now racking your own machines? And if you do have a new provider, can you say who you are and how you evaluated them?

I have been doing some research in my (limited) spare time to try to find a new provider, but I still have not made the switch from Linode.

<comment><USER2> If you follow the link he posted, you'll see they switched away from Linode almost immediately after the July breach.

<comment><USER18> Indeed I did read it - my question wasn't "did you move" but "to whom did you move".

</comment></comment></comment></comment><comment><USER19> I've been a happy Linode customer for a long, long time. With that I have to say the fact that they released this late on a Friday afternoon leaves a bad taste in my mouth. That in turn leaves me with doubts about the veracity of their statements. I'll probably be looking at alternatives now.

<comment><USER20> Me too (for about 5 years), but this was the last straw. Seriously. Recently moved to a dedicated kimsufi (worst support but great VFM hardware-wise).

<comment><USER21> I thought this kimsufi thing sounded interesting so I looked it up, and ... wow the processors in the systems they offer are old. Where do they even get these things? Must be leftover from OVH?

      Xeon E5504 - 45nm process, launched 2009
      Core i5-2300 - 32nm process, launched 2011, discontinued 2012

And the Core i5 does not support ecc memory, of course, so what kind of servers has it been sitting in for 4 years?

<comment><USER22> kimsufi === OVH.

</comment></comment></comment></comment><comment><USER23> > We have been working with federal authorities on these matters and their > criminal investigations are ongoing.

I cringe when I see companies say this. As if we're supposed to feel like the "hack" was somehow more sophisticated than spearfishing or social engineering because there's feds on the case.

There's a hole in your security. Diligently look for that hole. If it's a mistake own up to it fully and apologize. Make your system robust. If you don't have the talent in your organization to do this, then hire more talented engineers. Compete with other companies for good people.

<comment><USER24> Disclaimer: Linode employee

Regardless of the severity of the means, the fact is that this sort of attack is entirely illegal and involving law enforcement is a clear requirement.

<comment><USER2> That's fine, but I think the parent is implying (probably correctly) that involving law enforcement isn't really doing anything for the customers of the service. Sure, what happened was a crime, and if the attackers are really unlikely they could end up getting arrested in a couple years. "And?"

</comment></comment></comment><comment><USER25> I've been using Linode for years and I haven't had too many problems with the service itself. That being said, this makes me think twice about staying with them. If I wanted to switch, is the only real competitor Digital Ocean or are there any other good choices?

<comment><USER26> [http://oktawave.com](http://oktawave.com) and [http://vultr.com](http://vultr.com) are said to be good. I haven't used them though, I personally use baremetal servers at Hetzner.

<comment><USER27> I use vultr to host freebsd servers. Have no problems with it but it is young and it definitely shows. Good host provider to keep an eye on.

<comment><USER28> Same. I have been using it for a cheap freebsd website instance, for just over a year now. So far, I have needed very little interaction with support, so I can't speak to how good it is.

</comment></comment></comment></comment><comment><USER29> I learned to not to trust Linode after incident around 2012-01-23: I emailed them asking if they would compile a new kernel without the /proc/pid/mem local root exploit; they manually patched and compiled a new 3.2.1-linode40 kernel. I booted into it, but it repeatedly locked up my VPS after ~10-12 hours of runtime. No monitoring or automatic reboot on their side, and both lockups happened right before I went to sleep. Did they bother notifying anybody about their buggy kernel, which many people probably booted into? Nope. Nothing.

</comment><comment><USER30> "Linode Security Advisory" is a very misleading title.

</comment><comment><USER31> Should Linode have not stored their key in a smartcard/hardware security module and calculated the TOTP using that?

</comment><comment><USER12> I'm just going to leave this glassdoor review here:

[https://i.imgur.com/sJd56AT.png](https://i.imgur.com/sJd56AT.png)

<comment><USER32> I left a Glassdoor review about Linode that was removed because I mentioned an employee (anonymously) who rubbed his genitals on coworkers' keyboards as a joke. This was reported to and covered up by management because the employee was essential. Anyway, Glassdoor responded to ostensibly a Linode complaint by removing my review several weeks after I left it. So they do watch it.

There's a lot more to the story, for sure. It's the worst of the bro culture, or at least it was when I left. At my next employer they looked over Linode employees as recruiting opportunities after hiring me, and came to ask me about potential candidates, and the only one they were interested in was genital rubber. I laughed and said I'd quit.

<comment><USER33> Employee Disclaimer: It's not 2011 and Mike is not working at Linode anymore. You really don't get what it's like working at Linode TODAY. I'm sure everything your stating was terrible for you but it's not an accurate representation of what the company has become.

<comment><USER32> The same people are running the company who did then, who were responsible for setting the culture of the company, covering for employees who did unspeakable things (worse than what I've said here), and pretty much instructing employees to lie to customers.

Also, all the people who quit Linode and ran to this coast after I left have kept me very apprised of what working at Linode is like TODAY. I still communicate with your colleagues quite regularly, too.

It is important to reiterate here, as I have before, that I wish Linode no ill will. I'm becoming more comfortable with calling spades spades, but I do not wish Linode to fail. I actually hope a lot of this stuff can be fixed, whatever that entails, but I have a serious gripe with some events that have transpired since 2011, from security to personal. If Linode would start being a little more honest about their gaping security troubles, and not rely upon people like me and Tim who actually know the truth to just shut up about it (I'm getting braver as Tim does, and I appreciate how willing he is to not let PagerDuty be tossed around by Linode's deceit), I'd be a bit happier. We're crossing into knowingly compromising the safety of the Internet, PII, and a number of production infrastructures that still run on Linode in some cases, and I _do_ care about that.

And again, that tone of deceit is set from the top.

<comment><USER34> > _You know that. Don 't be disingenuous._

> _And you know it._

That's unduly personal. Please remain civil.

<comment><USER32> I mean, I was responding to a personal comment that directly and personally told me I don't "get" things (and which included what can be reasonably interpreted as a veiled threat by mentioning my departure year from a throwaway account, to make clear that I'm a known quantity in the equation). I'm really trying, here, Dan. We've talked about this over e-mail, but it's getting really tough to contribute here with arbitrary boundaries that are inconsistently enforced, and that a penalty remains on my account for some comment I made in the past that doesn't even matter any more.

I bit my tongue on you detaching this subthread because I've learned that moderation is opaque and largely not welcome to outside opinion, but I agree with Ryan up there and suspect you detached the thread to hide where I went with it. I'm fine with that (honest). Just wish you'd say that.

I've edited, regardless. Is that better?

<comment><USER34> Yes, that's much better. You took out the personal attack, which was all that was needed.

I don't have the least opinion about Linode or "where [you] went with it". My concern is with civility on Hacker News. That's not an arbitrary line, though I'd never claim we make every call correctly.

The GP seemed to me merely to be saying that the company had changed since you left. That doesn't seem personal, nor a threat, but perhaps there are subtleties I'm missing.</comment></comment></comment></comment></comment></comment></comment>


AI researchers use heartbeat detection to identify deepfake videos - <AUTHOR> https://venturebeat.com/2020/09/03/ai-researchers-use-heartbeat-detection-to-identify-deepfake-videos/ <comment> Pick-A-Hill2019 'PPG is also being used to identify deepfakes because generative models are not currently known to be able to mimic human blood movements.'

Gotta admire the outside the box thinking approach.</comment>


Show HN: Encrypted, synced, offline first todo list - <AUTHOR> https://encrypted-todos.com/ <comment><AUTHOR> This is a PoC I worked on over the last week while I've had a little bit of free time.

In general I'd love to have an ecosystem of apps (calendars, notifications, etc) built on this type of platform, I've done a lot of the ground wrt. encrypting/decrypting/signing/verifying general operations.

Tech wise it's deployed on Netlify (the backend is just a Netlify function) with:

\- Frontend: React, Grommet, web.crypto.subtle

\- Backend: Node.js, Mongo, native crypto module

</comment><comment><USER2> I looked into your challenge handshake logic, and it looks legit. Really impressed. Do you have a solution for pw derived keys?

(Also, you have a few UI issues: login exists across browser sessions, stuff like that. Feel free to ping me to talk more.)

<comment><AUTHOR> 1\. PW derived keys. Yes this is on V2 of the roadmap. It is definitely possible today, however a bunch of research our end is required to ensuring the security of private keys we hold (this includes an audit)

2\. Logins across browsers. Securing private keys is definitely still part of V1, this is easy locally, just need to make it part of the UI. UI/UX is definitely our weak point

</comment></comment><comment><USER3> Is it possible to consult code on Github?

<comment><AUTHOR> Not currently. Which I agree makes it 10 times more difficult to verify if this is secure.

I'm currently working on adding a kanban/trello board type page to this using the same backend. Maybe after that and cleaning up the code I can consider open sourcing it</comment></comment>


Ask HN: Why is the word "Cyber" objected to and what are the alternatives? - <AUTHOR>

<comment><USER2> Are you referring to this exchange, from about an hour ago? [https://news.ycombinator.com/item?id=9171357](https://news.ycombinator.com/item?id=9171357) .

My guess is that the term comes from the Wiener's cybernetics, dating from around 1950. It was used in pop culture in "Cybermen" from Dr. Who, and "Cyberspace" in SF through Vinge's "True Names" and Gibson's "Burning Chrome" and "Neuromancer", which lead to the cyberpunk movement.

As such, it's more been associated with social commentary and business and political philosophy and not with technical language. It become popular in general culture and political discourse in the 1990s as part of the popularization of the Internet.

I can therefore make a couple of conjectures. 1) it's dated, 2) it's viewed as an outsider (eg, non-Internet software developers) intrusion, and 3) politicians, bureaucrats, and other people in authority tend to use it to drive analogies between meat-space and cyberspace, like 'cyberattack' and 'cyber Pearl Harbor' when such analogies often seem stretched, and used to justify increased government influence and oversight of the internet.

</comment><comment><USER3> Because it's associated with people who have no idea what they're talking about, or are marketing to those who have no idea what they're talking about[0].

Alternatives: Computer? Depends on the circumstance.

[0] [http://threatpost.com/csi-cyber-we-watched-so-you-didnt- have...](http://threatpost.com/csi-cyber-we-watched-so-you-didnt-have- to/111440)</comment>


The Ultimate List of Monthly Blogger Income Reports - <AUTHOR> http://www.cashflowdiaries.com/blog-income-reports/

<comment><AUTHOR> It doesnt make any sense really. I started my blog 3 months ago and ive made a tiny bit of money but if I was making money like that I would quit my job and blog for a living. It can be done apparently.

</comment><comment><AUTHOR> The #1 Blogger on the list made 142k last month. Yes that is $142,000 in one month. The last ranked blogger #41 made $-195.41.

Kinda crazy!

</comment><comment><USER2> I cant believe how much some of those blogs are making.</comment>


Government-funded inventions that Apple compiled into its devices - <AUTHOR> https://mastodon.social/@Catsandcatsandcats/104699133832574667 <comment><USER2> I wasn't aware siri was developed by DARPA.

<comment><AUTHOR> Quoting from here: [https://www.sri.com/hoi/siri/](https://www.sri.com/hoi/siri/)

 _" Siri, the first virtual personal assistant, arose from decades of SRI research in artificial intelligence (AI). The technology was developed through the SRI-led Cognitive Assistant that Learns and Organizes (CALO) project within DARPA's Personalized Assistant that Learns (PAL) program, the largest- known AI project in U.S. History, and joint work with EPFL, the Swiss institute of technology._

 _" SRI spun off Siri, Inc. in 2007 to bring the technology to consumers, raising $24 million in two rounds of financing._

 _" In April 2010, Apple acquired Siri, and in October 2011, Siri was unveiled as an integrated feature of the Apple iPhone 4S."_</comment></comment>


The Ultimate Game Boy Talk (33c3) [video] - <AUTHOR> https://www.youtube.com/watch?v=HyzD8pNlpwI <comment><USER2> Similar talks for C64 [1], Atari 2600 [2] and even exotic "Galaksija" [3] computer (ZX 80 clone) are available as well.

[1] [https://www.youtube.com/watch?v=fe1-VVXIEh4](https://www.youtube.com/watch?v=fe1-VVXIEh4)

[2] [https://www.youtube.com/watch?v=aNyebnxV9R8](https://www.youtube.com/watch?v=aNyebnxV9R8)

[3] [https://www.youtube.com/watch?v=DIwC9vdqfqw](https://www.youtube.com/watch?v=DIwC9vdqfqw)

<comment><USER3> There's also one for the Amiga 500:

[https://m.youtube.com/watch?v=BbVAvDbzXFk](https://m.youtube.com/watch?v=BbVAvDbzXFk)

<comment><USER4> A real eyeopener.

Too bad Amiga was mismanaged from the word go, and that the less than upgradeable 500 was the face of the platform, as it was really ahead of its time in terms of internal design.

But over time the more upgradeable, and cloned to hell and back, IBM PC won out. In particular once the chipsets gained DMA and new expansion buses.

<comment><USER3> I agree that Amiga was mismanaged from the word go, that was the main issue IMO (they waited far too long before pushing for an upgraded chipset, and they should never have forced the Amiga team to relocate, causing most/all of the original team to leave).

As for expandability, whilst the A500 wasn't as expandable as the A2000, I'd say it was expandable in the ways most users would care about. For example, this expansion allowed users to add a faster CPU (and an FPU), add more RAM and add a hard drive:

[http://amiga.resource.cx/exp/gvp530](http://amiga.resource.cx/exp/gvp530)

</comment></comment></comment></comment><comment><USER5> As long as we're linking personal GB emulators... :-)

Here's mine, written as one file of less than 5000 lines of C: [https://github.com/binji/binjgb](https://github.com/binji/binjgb). It's very accurate, based on few of the most commonly used GB emulator test suites (Blargg's and Gekkio's).

Interestingly, there are still many questions about the specific timings of the Gameboy PPU and APU. An interesting case pointed about by LIJI128 is that no accurate emulator can run Pinball Deluxe; they all crash in some way: [https://www.reddit.com/r/EmuDev/comments/4n71ea/gb_pinball_d...](https://www.reddit.com/r/EmuDev/comments/4n71ea/gb_pinball_deluxe_fails_to_run_on_any_emulator/).

<comment><USER6> Nice C code! Took a look and seems very solid.

I was unaware of the GB test suites. Thanks for sharing that tidbit.

</comment></comment><comment><USER7> Amazing!

More or less relevant: For an university project where we made a Game Boy emulator, I wrote a presentation framework on the Game Boy itself, in which we recorded the design video:

[https://drive.google.com/file/d/0BzPtU6SpBQZzVVdZZ0kxNGhqVjg...](https://drive.google.com/file/d/0BzPtU6SpBQZzVVdZZ0kxNGhqVjg/view?usp=sharing)

Source: [https://github.com/pepijndevos/gbpaint/blob/presentation/mai...](https://github.com/pepijndevos/gbpaint/blob/presentation/main.asm)

<comment><USER8> That code is very clear. Nice. Did you ever go back and write for the GB?

<comment><USER7> That's my most recent project, but I wrote a paint program and some Pokemon hacks before that.

</comment></comment></comment><comment><USER9> I wish someone made something about "The Ultimate x86/x64" talk that covered all of the features of modern (x86/x64) processors.

<comment><USER10> It'd be a couple days long, though...

<comment><USER9> That's fine. It's worth it. Hell, make it + set of lectures + a book + homework exercises and sell it as a college architecture corse.

<comment><USER11> Sooo why not just watch a college architecture course?

<comment><USER9> They are usually very poor in quality. They are also usually stuck in the 70s of architecture development.

</comment></comment></comment></comment></comment><comment><USER12> LOL this made me remember of a stream about a guy developing a game boy emulator in Python.

By the way, this is the link: [https://www.livecoding.tv/michielha/videos/ZeNNa-a-python- ga...](https://www.livecoding.tv/michielha/videos/ZeNNa-a-python-game-boy- emulator-36)

</comment><comment><USER3> Great talk, tempted to try some Game Boy development now! Apart from the development tools/resources mentioned at the end of the video, any others to recommend?

<comment><USER13> I was at this talk in Hamburg and it inspired me to tidy up a gameboy dev project I started in Feb. I wish I'd seen this before I started.

BGB (mentioned at the end) really is the best emulator for development, and it works pretty flawlessly in wine (on both OSX and linux). [http://bgb.bircd.org/](http://bgb.bircd.org/)

Aside from that, there is a gameboy cpu manual / cheat sheet (handily printable as an A5 booklet) [1] and by some incredible stroke of luck, there was a university course in Wichita that taught assembly programming via programming gameboy roms [2].

[1] [http://marc.rawer.de/Gameboy/Docs/GBCPUman.pdf](http://marc.rawer.de/Gameboy/Docs/GBCPUman.pdf)

[2] [http://cratel.wichita.edu/cratel/ECE238Spr08](http://cratel.wichita.edu/cratel/ECE238Spr08)

shameless plug: the project I started is available on github here [3] - i'm working on figuring out how to build native ruby extensions so I can have the assembler be built on install, rather than dirtily bundling pre built binaries for OSX use.

[3] [https://github.com/rkachowski/rubygb](https://github.com/rkachowski/rubygb)

<comment><USER3> Thanks for the links, looks like they're great resources to kick start GB dev.

With your project, I'm not sure I understand it yet, is it a tool for creating and running makefiles that work with a GB assembler? If that's right, I can see it being useful.

<comment><USER13> That's pretty much it, yeah - as well as collating common tools + providing some basic templates for creating projects (getting to hello world requires a lot of boilerplate initialization).

</comment></comment></comment></comment><comment><USER14> Having attended the talk in person, it was probably one of the best uses of animations and diagrams in a presentation I've ever seen.

<comment><USER15> Agreed. If you discover how he achieved it, let us know please!

</comment></comment><comment><USER16> Another well designed recommended video about the same topic: "The Game Boy, a hardware autopsy", [https://www.youtube.com/watch?v=RZUDEaLa5Nw](https://www.youtube.com/watch?v=RZUDEaLa5Nw) .

</comment><comment><USER17> One of the most interesting parts of the talk was the fact that the boot code checks that the game contains the Nintendo logo @19.15. Very smart way of keeping control of the game releases. They have always been very good at keeping their games and copyrights.

<comment><USER18> Thanks, I had skipped to random parts and missed this one. Here is a transcript:

"The game has to have a copy of that Nintendo logo inside. If it doesn't match, the game does not boot. This was meant so that Nintendo could control which games are released for the platform, because all games had to contain the logo, which is not just a copyright violation but also a trademark violation if you include that and don't have Nintendo's permission".

Neat :)

<comment><USER19> It's a legal trick that doesn't actually work. Sega tried the same trick and lost when they took it to court in 1992.

[https://en.wikipedia.org/wiki/Sega_v._Accolade](https://en.wikipedia.org/wiki/Sega_v._Accolade)

</comment></comment></comment><comment><USER20> It is an interesting overview of Game Boy development: it includes hardware description (CPU, memory map, etc.), per-line interrupt ("raster effects"), palette, priorities, layers, sprites, sound, etc.

</comment><comment><USER21> This is a really great talk. I have worked on a gameboy emulator in the past in Nim,[1] sadly I didn't get enough time to finish it.

The amount of features offered by the Gameboy does seem rather overwhelming after watching this video.

1 - [https://github.com/dom96/gbemulator](https://github.com/dom96/gbemulator)

</comment><comment><USER22> Very cool. When I was in high school, I tried my hand at developing Game Boy games using a C compiler. Lots of good memories.

Really hoping they do that Super Nintendo talk next year.

</comment><comment><USER7> How was the game boy able to do the OAM scan in 20 cycles? You need to do 2 memory reads per sprite(status and y location), times 40 is 80 reads, means 4 reads per CPU cycle.

<comment><USER23> I don't know anything about GB programming other than watching the video, but my understanding is that it's not doing memory reads but rather transistor logic to determine which sprites have priority on that line. This is also why you have that 10 sprite limit, as the 10 active sprites end up getting pushed into hardware comparitors for that line.

Explanation starts around 46 minutes into the video.

<comment><USER7> Right, so these 10 sprites are definitely not in RAM, but in transistor logic, but at the start it has to scan 40 sprites in OAM, which means checking 80 bytes, and copying 10*4 bytes to the comparators.

</comment></comment></comment><comment><USER24> I'm very interested in the Kong Feng GB Boy Colour he mentioned, I'd love to know how they copied the GameBoy CPU etc. through decapping.</comment>


Linux Performance Analysis and Tools [pdf] - <AUTHOR> http://www.socallinuxexpo.org/sites/default/files/presentations/scalelinuxperformance-130224171331-phpapp01.pdf

<comment><USER2> Here's a direct link to the pdf[1] because the socallinuxexpo site returns a 404.

[1] [http://www.brendangregg.com/Slides/SCaLE_Linux_Performance20...](http://www.brendangregg.com/Slides/SCaLE_Linux_Performance2013.pdf)

</comment><comment><USER3> This makes me want to run to Solaris. How disgustingly fragmented, mostly unusable piece of crap Linux performance and profiling tools are. As someone who has seem even top break due to kernel changes, seen perf segfault time to time and seen that the dtrace ports (or SystemTap for that matter) most of the times lock up/panic the system - Solaris (or any other modern UNIX variant like HP-UX) feel so much more reliable, cohesive and just a better overall experience in profiling and performance analysis departments.

Well at least perf works most of the time on Linux.

<comment><USER4> Out of curiosity, why _don 't_ you run Solaris?

<comment><USER3> Lack of X86 hardware support of course.

</comment></comment></comment><comment><USER5> Couldn't have asked for better timing. I'm currently debugging performance issues on a production machine and the summary of tools on slide 16 is really useful. I like the breakdown into beginner, intermediate and advanced.

For anyone skimming, be sure to check out Methodologies (slide 86), which covers 4 different approaches to performance analysis.

</comment><comment><USER6> full blog post with video (was on HN already once or twice) [http://www.joyent.com/blog/linux-performance-analysis-and- to...](http://www.joyent.com/blog/linux-performance-analysis-and-tools- brendan-gregg-s-talk-at-scale-11x)

</comment><comment><USER7> Video available online as well. [https://www.socallinuxexpo.org/scale11x/presentations/linux-...](https://www.socallinuxexpo.org/scale11x/presentations/linux- performance-analysis-and-tools)

</comment><comment><USER8> Multiple links in the title? That's cool.

And the slides are too, of course.

<comment><USER9> The Scribd link is added automatically and is just another way to browse the pdf.</comment></comment>


A survival guide for people with Asperger syndrome - <AUTHOR> http://www-users.cs.york.ac.uk/~alistair/survival/ <comment><USER2> "It can often be an effort to have a shower or a bath three times a week and to wear deodorant but it is much easier to talk to people if you feel you are clean and if you cannot be smelt. Remember, if you smell you might not be aware of it. "

You have got to be kidding.

<comment><USER3> why?

<comment><USER2> Who doesn't know that. I don't think that has anything to do with having Aspergers.

<comment><USER4> There is a theory that people with autism-spectrum disorders have trouble modelling what is going on in other people's minds, and this is what makes social situations hard for them.

If this theory is true, then a person with Aspergers who is not annoyed by his or her _own_ body odor would have trouble realizing that the odor might bother other people.

</comment></comment></comment></comment><comment><USER5> Step 1: Go to your doctor and see if you actually have Asperger's. If you don't, stop using it as an excuse.

<comment><USER6> Is there some tendency for people to falsely claim they have Asperger's disorder?

</comment></comment><comment><USER7> I think some of this is useful for normal, not-very-social people.</comment>


Automatically Backup and Host Your Delicious Bookmarks - <AUTHOR> http://www.favbot.com/import-delicious.html

<comment><USER2> If you believe in open data, I urge you to email email@example.com, and ask that the delicious data is made available outside of favbot. That way, it isn't just put in another walled garden.

[Disclosure: I want to hack more code that uses social tagging data.]

Here was my email:

Dear FavBot,

Could you update your delicious importer, and please add an option to allow users to publicly share their delicious links?

There are a bunch of researchers who would like to use social tagging data. Getting a clean data set, from consenting users, would be awesome. So if you could help this process, since you have built the data collector, that would be great. It would also be a good way to promote your site.

If you can collect the data, I can get you hosting for the bulk dump.

Best, Joseph

<comment><AUTHOR> All public data imported will be publicly available. No lock-ins.

If users want to share their private data with the world, they can do that too.

<comment><USER3> Is favbot planning to charge user for their service in the future ?

</comment></comment></comment><comment><USER4> The submission title should clearly state that this is an importer for a different service, not an independent delicio.us backup tool as it currently claims. There are several easier ways to backup delicio.us that don't require handling the password to an external site.

If you want to promote a product that's perfectly fine, but at least do this openly.

<comment><AUTHOR> OAuth will be up soon. Imported Delicious data will be hosted as is. Yes, backing up Delicious is not the only thing that Favbot does but Delicious data will be made available separately too.

</comment></comment><comment><USER5> <https://secure.delicious.com/settings/bookmarks/export>

<comment><AUTHOR> The difference is, Favbot will let you use your Delicious bookmarks online (in addition to its other features).

</comment></comment><comment><USER6> backup is not a verb</comment>


Amazon Employees Pledge to Walk Out as Part of Global Climate Strike - <AUTHOR> https://docs.google.com/document/d/1joUIg5O5pRS_R2OqXoJzbuCXcQ0trL9ki8XO2aO0prg/ <comment><USER3> Is this a Silicon Valley thing? People becoming far too attached with what their company is doing. Even if I had been working there for 5 years, I would never bat an eye at anything my company did in it's own name -- I'm my own person and have my own beliefs, why should I expect a multinational enterprise to buckle to my feelings? If at any point I felt like my company was doing something that went morally against what I believe is right, then I would straight up leave. The thought that I'd get up and go to my manager to complain at how the executives could do something as atrocious as go against my moral compass sounds impossibly childish. Then, on top of that, virtually skipping work so I can complain even further, I'm surprised no one gets fired on the spot.

I'm not concerned with whether or not this was sanctioned or expected, or if these people will lose their jobs or not, I just can't connect with this idea of assimilating my personal views into a corporation's identity.

<comment><USER4> What, then, is your comprehensive alternative?

We probably, at this stage, need to approach this issue with a certainly level of moderated-panic, and attempt to address it on al lines across all levels.

It stands to reason that if the general population can influence corporate decision making that might have a knock-on effect to cause companies to influence government decision making.

I'd hazard a guess that Jeff Bezos ability to influence government policy far exceeds mine by orders of magnitude.

<comment><USER3> >We probably, at this stage, need to approach this issue with a certainly level of moderated-panic, and attempt to address it on al lines across all levels.

What does this mean? I have been hearing the terms "global warming" and "crisis" for almost 20 years now, yet it is almost always followed up with talk -- talk about how others could change their lifestyle choices, talk about how organizations can change how they function, talk about how we can talk even more to the right people. Very rarely have I ever seen a plan -- a formulated, step-by-step guide on what people or organizations must sacrifice in order to bring about a better future, and even less so people who actually act on that plan instead of simply reiterating it to anyone within earshot.

I would absolutely not be surprised if this event, which some consider to be "necessary" on any level, does nothing to impact Amazon to change anything to improve the climate situation -- as far as they can see from my perspective, they see 900+ employees, some of whom are probably part-time and not getting paid anyways, with no actual plan of how global warming should be solved with respect to Amazon, but want to feel good for a time, feel as though they are making some level of actionable change on the world, until their time is over and they go back to work while they patiently wait for

>one of the most innovative companies[0]

to come up with a plan themselves. I've seen it time and time again, it solves nothing, achieves nothing. And I'd bet it all on black that this earns them nothing but contempt from their supervisors/managers.

[0]: [https://docs.google.com/document/d/1joUIg5O5pRS_R2OqXoJzbuCX...](https://docs.google.com/document/d/1joUIg5O5pRS_R2OqXoJzbuCXcQ0trL9ki8XO2aO0prg/edit)

<comment><USER4> I believe you have neglected to response to the _most important_ part of my comment:

 _What, then, is your comprehensive alternative?_

<comment><USER3> You ask for an alternative as if there is a solution already being proposed, and yet, I see none.

<comment><USER4> I can definitely understand that perspective.

Perhaps my earlier comments were too harsh, given I definitely feel defeated with regards to climate change. My current approach is to simply _not care_ , as the added stress of caring didn't help and didn't do any favours to my general well being.

It's all looking like a lot of _too little too late_. But, fortunately, at my age, I'll probably miss the worse of it.

We probably need to simultaneously drastically limit carbon emissions and draw down atmospheric carbon / remove CO2 from the oceans. And I can't see how that's going to happen prior to things getting a lot worse.

Having said that, we did act collectively to implement the Montreal Protocol[1], so there's a bit of a precedent for acting at this scale... but there were fairly straightforward alternatives to ozone depleting gas.

1\. [https://en.wikipedia.org/wiki/Montreal_Protocol](https://en.wikipedia.org/wiki/Montreal_Protocol)

<comment><USER3> No offense taken, I've been downvoted a lot and I can understand people have very passionate beliefs on issues of this scale, I'm also passionate in my belief that talk, protests and walkouts, while they have an impact on awareness and of course the right people being aware of the issue may get us somewhere, does not get us anywhere in today's age.

Everyone knows of global warming, I don't want to see more talks, more protests and more blame, I want to see plans being enacted, laws being enforced, the world actually improving, but that's not what I see in this Amazon spectacle.

<comment><USER4> Yeah, I reckon that's probably what everyone wants to see by this stage: actual changes. So I see these walk-outs and protests[1] as a sort of _throw ya hands in the air cos won 't somebody fckn do something already_ sort of action.

(For what it's worth, I didn't down vote any of your comments. I typically up vote anything I engage in, and usually only down vote comments that are shallow or abusive).

1\. [https://www.abc.net.au/news/2019-03-15/students-walk-out- of-...](https://www.abc.net.au/news/2019-03-15/students-walk-out-of-class-to- protest-climate-change/10901978)

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER5> >The employees are also asking for zero contracts with fossil fuel companies that use Amazon's AI technology to help them accelerate oil and gas extraction,

This type of stuff will be the bane of large companies migrating to cloud. A lot of large companies are involved in defense initiatives, law enforcement, fossil fuel extraction, mineral extraction etc. If they have to worry about what latest moral crusade will try to get you kicked off the cloud platform, they will be a lot more reticent about migrating to cloud.

In addition, if you were a fossil fuel or car company that makes gas burning vehicles, how confident are you that one of those people that is walking out to try to get you kicked off the platform, won't try to be a "hero" and use their insider access to try to sabotage your operations or leak confidential data? I mean if the cause is worthy enough, all sorts of activities that would be illegal are considered justified. I mean if a person thinks they are literally saving the planet from destruction, sabotaging an oil company's cloud infrastructure seems like something that they would at least seriously consider doing.

I think Amazon and the other cloud companies need to come down hard and state unequivocally that cloud services are not fodder for political crusades, and they will allow all companies that are conducting legal business activities, to be able to use their cloud.

<comment><USER6> > If they have to worry about what latest moral crusade will try to get you > kicked off the cloud platform, they will be a lot more reticent about > migrating to cloud.

Equating climate change activism with all other forms of social justice is a common trend I see. They seem so different to me–the difference between empirical reality and ideology. While the outcomes of climate change will be ideological–save climate refugees or preserve competitive advantage and wealth–the immediate concern of attempting to mitigate the impacts of climate change are relatively rational.

> if you were a fossil fuel or car company that makes gas burning vehicles

Have you tried putting on your role-playing hats and empathising with some of the points being made on the environmentalist side?

<comment><USER7> The problem with most climate change activism is that it's hyper-targeted against the offender du jour and all of the others are largely ignored. It's a global-scale problem that demands global-scale solutions; the vigilantism isn't doing anything other than providing a straw man for the opposition to knock down.

<comment><USER8> Then by all means you should show Sierra, 350, Sunrise, ER, and all of the other folks out there how to do it better.

I mean this sincerely: I've been deeply involved in political and civic activism for the past couple years, and have learned a ton, especially from other people—but I also find it deeply frustrating when seemingly well intentioned folks offer unspecific feedback on how the significant investments of time, money, and energy I and others around me could be spent activisting better.

<comment><USER7> The goal is policy change, and that requires convincing people to vote for things. The path that makes that happen is education, policy advocacy, and ultimately gaining political office.

Direct action, however, tends to put more emphasis on the activists themselves as the problem instead of whatever their platform is. This is only useful when it demonstrates a sufficient commitment by a large number of people, which can demonstrate wide popular support— rallies, peaceful protests, etc. that involve enough people to potentially change the outcome of an election.

My problem is really with the publicity stunts done by a small number of people. From outside, it looks like an egotistical act and, if not dismissed entirely, hurts the reputation of everyone doing useful work in the same field. Antagonizing people is a poor way to convince them of anything.

As for why I don't go into politics myself, it isn't my calling and I don't have the temperament to be successful at it. I believe I'll do more concrete good in the world by being kind and helpful to those I meet in this journey we call life than by trying to force my concerns to the forefront of attention.

</comment></comment></comment></comment></comment><comment><USER9> > The employees are also asking for zero contracts with fossil fuel companies > that use Amazon's AI technology to help them accelerate oil and gas > extraction

To me, it seems like activists spend too much time focusing on the producers of things like fossil fuels, and not enough time on the consumers.

I have nothing against companies which are producing fossil fuels, in general, since they are usually producing a product that has at least some genuine value in many cases. If everyone stopped drilling for oil immediately, it would certainly have incredibly negative consequences. I do have a problem with people who are excessively using these types of products, since they are creating waste that damages the environment - if everyone stopped driving their car everywhere and instead biked when they were able to, it would certainly have a very positive effect.

</comment><comment><USER10> Be interesting to see if Amazon supports the employee strikes as much as google - I think with google a lot of the strikes and walkouts were supported by management and/or no consequence. So it was a "strike" but everyone got paid still.

Is Amazon this progressive as well? Ie, will it pay everyone if an employee was needed but unavailable?

<comment><USER11> Amazon seems far far more cutthroat than Google. They'll get PIP'd and thrown into the pressure cooker as punishment until they quit.

<comment><USER12> Antecdotally - the folks who have organized internal things like this at Amazon generally continue to work there. The folks who did the same at google seem to have gotten fired.

</comment></comment></comment><comment><USER13> If I were their manager I'd want to handle it like any other absence. If an employee has a history of unscheduled ghosting, whether for protesting, watching soap operas or whatever, treat them the same. If it _is_ scheduled or otherwise arranged with a supervisor, no problem. Politics need not enter into it.

<comment><USER14> That sort of misses the point of protest via a walk out. You can't have civil disobedience without the disobedience.

</comment></comment><comment><USER15> Do these people really think there is no environmental impact to creating these "zero emission" vehicles? That the materials aren't destructively being mined for the minerals used in the batteries and solar cells? That the engines and vehicles aren't themselves shipped multiple times huge distances by cargo ships using carbon burning engines? That the sunk environmental impact of existing vehicles is worth throwing away? That natural gas shouldn't even be considered?

I mean, a lot of these "green new deal" types of initiatives are short sighted at best, and harmful at worst. Wind, solar and nuclear power should all be on the table. Why aren't we talking about desalinization and water pipelines for hydrogen fuel?

<comment><USER3> >Why aren't we talking about desalinization and water pipelines for hydrogen fuel?

Because for these types of people, the goal isn't to enact any measurable change on their own. It's to make others feel guilty for not coming up with a solution.

</comment></comment><comment><USER16> Good for them. So much focus on "what we can do" with the climate crisis puts the onus on individuals, instead of industry.

I like that they go further than just "use EVs to deliver packages" – but instead also calling on AWS to not enable or help accelerate Oil and Gas company extraction. Although I'm sure this one will fall flat, because there's too much money involved.

<comment><USER17> >"...to not enable or help accelerate Oil and Gas company extraction."

I don't think that makes any more sense than say "not selling goods and services to individuals who own ICE propulsion cars". Or won't sell items manufactured in Chine due to dirty energy and lax enviro controls in manufacturing.

</comment></comment><comment><USER18> I'm not sure what the research says but is buying something online (+ one day shipping) more or less environmentally friendly than going to a store?

<comment><USER19> It depends, where is this hypothetical person living? I live in the middle of a city, the store close to me serves the thousands of people living in my square kilometer. Because of scale, the truck that transports new goods to the store has a low carbon emission per customer.

I have friends who live way out of town. If they have a store it serves maybe twenty people. Instead of dividing the truck's emissions by thousands of people you just divide it by twenty.

<comment><USER20> If someone has to get in their car at all to go to the shops I would say it is likely to be more carbon intensive than a delivery service with high utilisation. A shopping center in general would be generating a lot more emissions per product than a warehouse.

On the other side often things bought online come with a lot more packaging. I think Amazon is trying to cut down on this by having suppliers where possible use a box for a product that is durable enough for shipping without having to put it in another box.

</comment></comment></comment><comment><USER21> I would love to know the organizers' opinion on whether these various uses of AWS "accelerate oil and gas extraction," i.e. whether they would be allowed on AWS:

-The engineering of drill bits or other equipment that could be used for oil wells, but also for water or geothermal wells

-A business consulting firm running payroll, marketing, or accounting for an oil company

-Personal internet services for offshore oil workers

-Telemetry for drilling or pipeline monitoring equipment

-Geology research by a university that is likely to be used by oil companies

</comment><comment><USER22> It's remarkable to me that in the original article and in all these comments so far, there's no mention of energy use by AWS.

AWS is market leader in public cloud, which is probably the fastest growing class of energy consumer. Already overtaking traditional industrial energy consumers such as steel.

Assuming this market trend will continue, what can AWS realistically do to mitigate their impact?

<comment><USER23> AWS, like google and like Azure and every other cloud provider already does everything they can to minimize energy consumption because it is in their economic interest to do so.

In fact I would think the best thing industry can do to reduce energy consumption is to move their data to a cloud provider. It takes far less energy to cool one large room with servers from a dozen companies than it does to cool a dozen server rooms with private on-prem servers.

<comment><USER22> This all seems correct, but insufficiently proactive, at least not enough to satisfy activists.

For instance, though it may not currently be economic, how about pre-cooling using renewable energy. Locating data centers next to hydro / geothermal sources? Larger UPS? Load balancing across DCs with available renewables? Other mitigations to get ahead of the issue?

</comment></comment></comment><comment><USER24> They should also join the Extinction Rebellion on October 7

[https://rebellion.global/events/2019/07/30/rebel-without- bor...](https://rebellion.global/events/2019/07/30/rebel-without-borders/)

</comment><comment><USER25> However unlikely it is, it would be awesome to see the Amazon warehouse workers join in solidarity.

</comment><comment><USER26> In other news, Amazon announces over 900 new job openings.

</comment><comment><USER27> 941/647,500 (the 2018 Amazon employee total)

<comment><USER17> Probably because if they reversed the numbers in the article, it wouldn't sell. "646,000 out of 647,500 Amazon employees will not pledge to join protest!"

</comment></comment><comment><USER28> Walk out into the car park to drive home?

</comment><comment><USER29> This (unfortunately paywalled) article from the Economist raises a lot of points discussed in this thread: [https://www.economist.com/leaders/2019/08/22/what- companies-...](https://www.economist.com/leaders/2019/08/22/what-companies- are-for)

</comment><comment><USER30> There's something really interesting going on with the flagging in this post. There are several on topic, polite discussions that have been flagged to death. (Along with some replies which, rightly, have been flagged to death.)

Maybe it's just folks expressing political views with the flag button, but it's interesting to see it used so dramatically here.

Edit: Either someone did something or a bunch of vouching happened, because a lot of comments have come back.

<comment><USER31> That's unfortunately what HN comments has become, a popularity contest where instead of replying to views you disagree with using counter arguments, you just downvote them and if their statement particularly offends your sensibilities, flag them.

<comment><USER32> Honestly, downvoting - especially as implemented here in HN where it fades out things - was a mistake. I do not understand why people still insist on it and ask people to not use it as a "disagree" button (and flagging as a "super disagree" button) when many years of evidence show that despite any effort, it will be used as such.

I can understand (even if disagree) with Reddit-the-company wanting it to stay there because it increases "engagement" with the platform (regardless of the engagement's quality) and thus gets more ad revenue, but why anyone else (and any site that doesn't monetize such "engagement") would insist on downvoting is beyond me (and i especially do not understand people acting as if the topic itself is some sort of taboo to not even be discussed and treat its existence as unquestionable dogma).

<comment><USER33> The better option would be to get rid of political BS entirely. I am incredibly sick of hearing each side scream into the wind while the other screams back. This was originally mostly a tech forum; it's grown to a size where it needs to be _only_ a tech forum. People can go to reddit if they want to scream about politics.

<comment><USER30> That's a position that's ok if and only if you are ok with the status quo. It is, in itself, a political stance.

Now, screaming into the wind is also far from ideal, but I think the answer shouldn't be "Ignore politics because I'm fine."

There are a ton of places where tech intersects with politics, whether that's in climate science, gender, mental health, medicine, art/culture, public transit (and other public shared resources), copyright, privacy, safety, etc. Strictly restricting the discussion to tech doesn't erase those intersections between tech and political domains.

<comment><USER33> Except all the issues you just raised are primarily things about which one side cares. The cares of the other are ignored or, in the rare case they are visible, flagged down.

<comment><USER30> What? These aren't boolean propositions. Each of them has a pretty complex set of connections with tech, across a variety of subdomains and interests....

<comment><USER33> Maybe a better way to describe it is as a venn diagram. If there are circles with "lefty" things and "righty" things, you took (as HN tends to do) the whole lefty circle. That includes things in the center, but not those on the right.

<comment><USER30> Ah yes, the "lefty" concerns of privacy, safety, medicine, public land use, and intellectual property and how they intersect with tech. I somehow always manage to forget that the "righty" folk are disinterested in discussion on how those topics might intersect with tech.

Again, these issues aren't binary, they aren't left v. right, there's much more to understand than just two fixed points. I didn't even dive into any specific issues. Public resources could mean parks or it could mean the Bureau of Land Management, eminent domain or subsidized bus fare. Safety and privacy could be a discussion of the TSA, or gun rights, or immigration, or facial recognition.

Those are obviously concerns that impact a wide group of people, across many different political ideologies.

You are seeing something that isn't there.

<comment><USER33> You cherry-picked stuff from the center of the diagram. Stuff like climate "science" and "gender" gets posted a good bit; these are things of which the left has made issues. My point is that the whole left circle - <USER2> important to the left and important to both left and right - are posted and discussed. Issues important only to the right are flagged down. Right-wing perspectives on political posts are flagged down. To take an example, very occasionally, I see a mention of guns that includes a right-wing perspective. Even if it's politely stated, flagged down. Example, something like: "The arguments about taking guns lowering mass shooting-rates does mot affect the right because priorities are different. The right is willing to tolerate some death as tragic but a fact of life to maintain rights, and mass shooting death rates are vastly below other public health issues any way."

Such a comment would be flagged down. A comment taking the opposing point-of- view, even much less politely, would be supported. Comments with vulgarity and rudeness are also tolerated only from certain perspectives. This disparity is particularly galling because low-ranked comments become greyed to the point of un-readability, and flagged ones don't appear at all by default. I couldn't care less about the internet points, but HN ought to leave un-popular opinions visible.

</comment></comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER34> I assume, the whole narrative is above such insignificant details as direct and indirect costs of producing "green energy?"

<comment><USER35> Not sure what you mean but Amazon is doing a lot of research into things like drone deliveries and robotic vehicles which can be powered from renewable energy.

Fuel costs money. Ultimately delivery efficiency is better for business and for the environment.

They also are encouraging all deliveries to happen on a given day of the week so they can be batched up and logistically planned better.

Seems like things are moving in the right direction.

</comment></comment><comment><USER36> Amazon's entire retail business model is built upon oil(specifically drivers moving individual packages to consumer's homes).

</comment><comment><USER37> Great! The more people strike, the more we'll get the kind of change we need.

</comment><comment><USER38> It's worth emphasizing that these Amazon employees aren't acting on their own -- they're taking part in a global climate strike: [https://globalclimatestrike.net](https://globalclimatestrike.net). Even if each person or company acting individually can't change anything, a large enough movement like this may make change possible.</comment>


How Jimmy Carter Saved Craft Beer - <AUTHOR> http://www.theatlanticwire.com/entertainment/2010/08/how-jimmy-carter-saved-craft-beer/19195/ <comment><USER2> If you look at the chart, it appears beer was on a pretty swift path to consolidation even before prohibition. It may not be that Carter saved the craft brewing industry so much as he allowed it begin.</comment>


How We Failed Our Way to a Day on the Front Page of Hacker News - <AUTHOR> http://groovehq.com/blog/hacker-news?utm_source=hs_email&utm_medium=email&utm_content=10892138&_hsenc=p2ANqtz-_eIlhyyUfA_L1NcOJnWqS0ld7WsPVP_v8BkBmSVfOYR11rbH2-q1IZXkQoHYChEKL8oIEYYi1LhVK3jFpd2ViVW6V2SA&_hsmi=10892138

<comment><USER2> > _Once he was on board, I went to work lining up a team of upvoters from > different IP addresses. Following Alex's strategy, we wanted to get as many > upvotes as we could, as quickly as possible._

That's pretty scummy.

> _Less than ten minutes after executing on our bulletproof strategy, our post > was nowhere to be found._

Good. If you're going to try to game the system, you deserve to get your posts deleted.

Also, this:

> _And interestingly, he changed the headline from "7 Lessons We Learned Going > from Zero to $30k/Month in Under a Year," to "Lessons Learned Going from > Zero to $30k/Month in a Year"._

> _Shorter, simpler, more direct. Flies in the face of the copywriting wisdom > I had been reading about specificity and numbered lists. And yet, it > worked!_

is a really revealing thing to say. It means that your plans to make the front page somehow didn't include _reading the submission guidelines_ [1]:

> _If the original title begins with a number or number + gratuitous > adjective, we 'd appreciate it if you'd crop it. E.g. translate "10 Ways To > Do X" to "How To Do X," and "14 Amazing Ys" to "Ys." Exception: when the > number is meaningful, e.g. "The 5 Platonic Solids."_

1: [http://ycombinator.com/newsguidelines.html](http://ycombinator.com/newsguidelines.html)

</comment><comment><USER3> "We weren't able to hack HN, but we didn't have to; by putting effort into publishing high-value content, we were able to get our readers to do much of the heavy lifting for us."

I understand folks want to market their business, but I'm glad this is not an easy forum to so.

</comment><comment><USER4> They've _admitted_ using bad methods to scam their way into HN. Why are we still seeing them here? Their domain should be banned outright.

<comment><USER5> It would appear that this method is more or less common knowledge at this point. I knew most of what they listed myself, although it's not something I've ever employed as you can see from my submission history.

</comment></comment><comment><USER6> "Interesting, posted by some guy named Josh, wait, that was me!"

<comment><AUTHOR> Oops. Didn't see that. I got this link in my email.</comment></comment>


Show HN: I built a service to make sense of all this password sharing - <AUTHOR> Hey HN: I'm Chino, the founder of Keyring (https://joinkeyring.com./), it's my first time posting here, nice to meet you all.
Keyring lets users safely share subscriptions between household members. No passwords revealed (so that logins don't spread) and create a custom bundle of video, music, and news subscriptions between a group. We're the cable bundle for the digital generation.
Previous to founding Keyring, I launched over 160 mobile apps, +50 of which hit the App Store's top charts and have advised two startups to exit, and have angel invested in a few startups, VinoVest (https://www.vinovest.co/) and Unlimited Tomorrow (https://www.unlimitedtomorrow.com/ - alongside Tony Robbins)
Here's how it works.
Step 1: Add subscription services to your account. Step 2: Send invitations for shared access to your households'services.
We make money off with a monthly subscription that allows you to share unlimited services with a group of 5. https://joinkeyring.com/pricing
Happy to chat directly chino (at) joinkeyring.com, @whoischinolex on Twitter, and @chino.lex on Instagram.
Here's some press we've gotten:
https://www.forbes.com/sites/robpegoraro/2020/07/08/this-app-wants-to-help-you-share-streaming-video-passwords-and-for-video-services-to-like-it/#4a2145ef44c0
https://www.producthunt.com/posts/keyring
https://thenextweb.com/apps/2020/07/08/this-chrome-extension-lets-you-share-your-netflix-and-spotify-accounts-with-friends/ <comment><USER2> Love this idea! Interested in trying out the split-and-pay option</comment>


What idea(s) do you regret not implementing?  - <AUTHOR>

Believe or not, I had the grandcentral idea ( ok it was almost like it ) way before the company launch. I am not saying I had it before they did, but when I start researching the idea and talking to developers, I did not find anything quite like it.
<comment><USER2> About 5 years back I had an idea for a free wireless system. I'd go and offer places like Starbucks and Chapters free wireless for their customers. The hardware at their end would be a simple DSL/Cable modem hooked up through a small form factor unix box with a wireless card in it and a fairly anal set of firewall rules to prevent deep abuse.

The business model was to be setting up in line ad replacement on websites with a focus on local businesses. You're sitting in the coffee shop and an ad comes up for 10% off your next purchase at the book store across the corner, or a two for one this day only at the diner down the street.

I was working at Telus (big canadian telecom) at the time and they had just started cracking down on employees running side businesses that crossed over their product and service lines. I would've been fired and sued if I would've started it up, too broke to do it alone, and didn't have a clue where to go for investors or the like. I'm still tempted to do this, but free wireless has spread so much it would be hard to penetrate the market and convince people my way was the best way.

I regret not having the balls to say that three months living expenses was good enough, lets make a prototype and get a test going and pray I can find some business minded investors in time.

<comment><USER3> _"... I'd go and offer places like Starbucks and Chapters free wireless for their customers. ..."_

I wouldn't regret the decision that much if your idea revolved around _Starbucks_ or even other large aggregators of customers. Joseph Park of Kozmo fame (see e-Dreams DVD) had a similiar idea back in Web 1. The deal went down requiring Kozmo paying Starbucks for the big bucks for the rights to serve their customers with a drop-off facility in what was meant to be a partnership. That's right they had to pay for the right to access customers. (You can see more on e-Dreams here ~ <http://www.imdb.com/title/tt0262021/> )

So it might be a good idea but those with the customers aren't too interested in others servicing their customers. I don't know how you get around this.

Besides, any time you have to ask permission you are in trouble.

</comment></comment><comment><USER4> Ideas are overrated. Execution matters far more. GrandCentral is very similar to a company called ThinkLink which preceded it by about five years. Facebook coopted ConnectU's ideas. The history of high technology is replete with similar examples. Yet GrandCentral and Facebook deserve their success. They weren't the most innovative in their respective spaces, but they executed best. That's what counts.

<comment><USER5> Depends greatly on your definition of "idea."

For me, an idea is very thorough and well thought out. The execution is then trivial, except for publicity and other stuff that's really hard to control.

Ideas are far from worthless. I'll give anyone $2000 right now for a good idea that investors like enough to get me out of this near debt I'm struggling through.

<comment><USER6> Most investors don't fund ideas.

<comment><USER5> Well, I guess I'm set then since we have everything but.

Could have fooled me, but what do I know. I swore off investors for a while last year after my partner quit and things were looking bad.

<comment><USER6> But you've another problem: you're looking at investors to get you out of debt and that's another thing they don't do;)

<comment><USER5> I said:

1\. I'm not in debt.

2\. I'm not looking for investors.

Investors don't fund _people_ from what I've seen. Most fund based on the past experience of the people, how much they like them, how well they can _pitch_ themselves. But investors rarely actually fund based on the people.

</comment></comment></comment></comment></comment></comment><comment><USER7> I came up with essentially the same idea as inviteshare about 2 years ago. It all started with a "damn, where the hell are these guys getting all these invitations."

My version was a bit different in that users would have to give feedback to sites whose invitations weren't ridiculously rare, and as you gave feedback, you would earn points. Then, when the really hot invitations would roll around, users could bid on them using the points they've accumulated. Either that, or the more your feedback was rated positively, the higher up a ladder you climb, giving you priority/ more points.

That all ended with me pitching the idea to a friend of mine and having him reply "Eh, sounds cool, but I don't think anyone would use it."

Looks like my $25k was meant for another bunch. Oh how impressionable I was.

<comment><USER5> 25k?

That's really weak. You have nothing to regret.

</comment></comment><comment><USER8> This is like a group confessional,

Anyways, everyday I have to put up with my co-founder's whining about Meebo. I don't really know what they do or how they make money, but now I'm starting to see their name everywhere.

My co-founder is convinced that he had the idea behind meebo in undergrad but just was too lazy implement it.

In fact, I am going to send this link to my co-founder so he can see me go on the record in saying that he is the laziest SOB in our time zone.

That's right, I'm hating on my own co-founder. Go Meebo.

<comment><USER9> A lot of people had the idea behind Meebo. A friend and I were doing AIM bots back in 2000. Essentially we'd implemented SmarterChild before it became popular. Then when AJAX was all the rage in late 2004 and 2005, I said "Oh, wouldn't it be cool if you could put live chat up on a web page and update the display through AJAX?"

I was actually thinking in terms of the social-networking angle - you ever notice how many conversations on LiveJournal comments or FaceBook walls start out as asynchronous messages and then become conversations when both/all parties get online? There's room to make that interaction a lot more frictionless, and I have actually seen anyone go through with it. Maybe I'll be saying "Damn, I regret not implementing _that_ idea" in another 2 years.

Anyway, it's not who thinks up the idea that matters, it's who actually goes and _does_ it. Most successful ideas are pretty obvious, they're just overlooked because people think "If it were that easy, somebody would've done it already".

</comment></comment><comment><USER10> I'm more the kind of person with no big idea. I think I should start a constellation of websites and see what takes up.

Maybe one day I will have THE big idea, but for now ...

</comment><comment><USER11> I was thinking of a keyboard that has displays on keys, long before Art.Lebedev came out with the Optimus keyboard concept. I didn't think of all the functionality they came up with, I just thought of rearranging/reconfiguring the key layout to suit one's typing style. Well, I don't really regret not implementing it, because I couldn't have done it, and it's not really practical.

</comment><comment><USER12> I have ideas I executed on but didn't release due to copyright worries. They were niche but very good.

The thing that impresses me most about stuff like YouTube is not the tech (which is no mystery) but how they managed to keep going in the face of massive legal concerns. I never worry about the technical side, only the red tape.

</comment><comment><USER13> A few years back I was toying with the idea of applying citation-based ranking to ranking webpages... _sigh_...

</comment><comment><USER14> FYI, GrandCentral's concept isn't at all original. Other companies, like uReach.com, have had similar offerings (often called "Follow Me") for many years. But they're probably the first to offer it for free, and definitely the first to offer it with your choice of area code for free.

</comment><comment><USER15> It's not a good question to think about - nothing positive can result.

Anyway, I had the idea for throwback sports jerseys way back when. I was so mad when they became a hit. Now I realize execution is much more important.

</comment><comment><USER16> I had the idea of creating a social stock market type thing a couple of years ago. There appear to be a few that are moderately successful, but it's a pretty obvious idea in any case, so I'm not too worried about it.

</comment><comment><USER17> I had the idea for PornoTube (YouTube for Porn), but couldn't live with not being able to tell my girlfriend's parents what I did ;-)

Shame, it's now Alexa rank 203 - probably 10 times the size of twitter. :(

<comment><USER5> There's still lots of room for better porn sites.

The barrier to entry you mentioned keeps everyone away though...

</comment></comment><comment><USER18> don't talk about what you regret not implementing. Implement the next thing.

<comment><USER19> well said.

<comment><USER20> here here

</comment></comment></comment><comment><USER21> Connecting food delivery services to the internet in pre-flarate 1997 (cheaply by using SMS notifications).

</comment><comment><USER22> bittorrent. I had that idea before it came out. I could prove it, too, from old usenet postings, though I don't want to give away my anonymity.

<comment><USER21> Me too, and probably lots of other people. The time was probably calling for it.

<comment><USER5> I think it's a bad idea. I would not have released it until the torrent sharing was decentralized.

Or maybe he had no problems knowing that many of his users would have their lives ruined and many more would be scared away from using it. His reason for this shortcoming, along with lack of effective stenography in the protocol is now clear, he wanted to build a business around it.

<comment><USER23> Bittorrent grew out of MojoNation, a "distributed, peer to peer, file store", per wikipedia. So it already had a business sponsoring it.

Distributing content tracking is much harder than distributing the content, and if they'd waiting to solve that problem before publishing code, it probably would have died. I think there's a lesson here: don't wait to solve all your problems before you launch, because even if some of them are insoluble, the parts you have solved might be useful enough to be successful. I suppose other people have more concisely summed that up as "release early; release often", eh?</comment></comment></comment></comment>


Ask HN: What is best practice and the market leaders in CAPTCHA software? - <AUTHOR>

I need to buy a CAPTCHA solution for a very high risk payments site, looking for recommendations on best practices in CAPTCHA today and who the market leading, enterprise scale vendors are <comment><USER2> I'm not sure that a captcha should be considered part of your authorisation, identification or security framework. A captcha is just attempting to block out robots - it doesn't help you identify if a human user is who he says he is, or has the authorisation he says he has.

No captcha is 100%. And they are trivial to break using human drones in India or China who solve hundreds an hour.

That said, the best, and clear market leader in captcha technology is reCaptcha, now owned by Google (they paid $100m for it) <http://www.google.com/recaptcha>

<comment><AUTHOR> I see it as a part of defense in depth so worthwhile being part of the framework but obviously not the only authentication and authorization component.

Thanks for the reCaptcha recommendation</comment></comment>


On the Engineer's Responsibility in Protecting Privacy - <AUTHOR> https://www.rand.org/pubs/papers/P3829.html <comment><USER2> "There are many amongst us who would not hesitate to build equipment to compromise the privacy of any given individual provided the price is right. These are the whores of industry. They would not hesitate building systems and devices contrary to the public interest; their only concern is the buck."

From May, 1968.

One of many prescient insights.</comment>