BeagleLogic: A BeagleBone Based 14-channel 100Msps Logic Analyzer - <AUTHOR> https://github.com/abhishek-kakkar/BeagleLogic/wiki <comment><USER2> I've got an eye on the DangerousDSO: [http://dangerousprototypes.com/docs/Dangerous_DSO](http://dangerousprototypes.com/docs/Dangerous_DSO)

" Dangerous DSO is a new logic analyzer/oscilloscope prototype we've been using in the lab. It combines a 16 channel logic analyzer with one 50MHz oscilloscope channel with +/-10volt DC range. The combined tool shows what your signal does between 0 and 1, which helps pinpoint noise and other electrical glitches.

Our goal with the D-DSO is to make the simplest possible oscilloscope reference design. It doesn't have range selection or AC coupling, it's a basic design that shows the bare minimum needed to capture an analog signal. "

They also have the Logic Pirate for $30 which does SUMP: [http://dangerousprototypes.com/docs/Logic_Pirate](http://dangerousprototypes.com/docs/Logic_Pirate)

Logic Shrimp for $35: [http://dangerousprototypes.com/docs/Logic_Shrimp_logic_analy...](http://dangerousprototypes.com/docs/Logic_Shrimp_logic_analyzer)

And of course the Open Bench Logic Sniffer for $50: [http://dangerousprototypes.com/docs/Open_Bench_Logic_Sniffer](http://dangerousprototypes.com/docs/Open_Bench_Logic_Sniffer)

</comment><comment><USER3> This is really neat. but it isn't a logic analyzer. I realize that is more than a bit pedantic but let me explain.

The feature this provides is really a binary oscilloscope. One picks a sample rate, and perhaps a trigger pattern and then once you get triggered you copy the state of the binary bits into memory at the pre-determined rate.

What you get is samples of the pins across a period of time, and you have no idea really what the state was of the pins when you "weren't looking". Which is to say between samples.

Logic analyzers actually work a bit differently. A logic analyzer is sensitive to the _transition_ of the bit regardless of when it happens. Time is the _dependent_ variable, rather than the _independent_ variable.

The reason analyzers work that way is because digital logic is very sensitive to clock _edges_. That is when the magic happens, falling clocks, rising clocks, either way stuff happens relative to the clock edge.

One of the more common problems in logic is a propagation delay causing spurious outputs. Think of it this way, lets say changes in signal A and signal B are racing toward an exclusive OR gate. The change is said to be propagating through the logic. And lets say the change has both signal A and signal B set to the same value, but it opposite their current value. If signal A arrives at its place at the gate 5 ns before signal B does, then when it arrives, the gate output will change from '0' to a '1' state, and then when B catches up 5ns later, it will change back to 0. Logic down stream of the gate will see a 5ns "pulse", the output will go high, and then low again 5ns later. This is a "propagation glitch".

If you sample these pins, once every 10ns, you have a good chance of seeing exactly what you expect, the pins are one state, the output is 0, the pins are a different state, the output is still zero.

However if you have a free running clock and you capture exactly the time the pins change and you see that the output actually changes twice before your sample period is over. You might imagine an implementation of this as some number of input capture pins each sharing the same 32 bit nanosecond scale clock running. When ever the pin changes you copy the clock value into memory. If the pins don't change you don't copy anything, and every 4 seconds you push a marker (clock overflow for a nanosecond clock). You read back all of that data, a series of time stamps for the pin changes, and you can line them all up on the display and verify things like setup and hold times, worst case propagation delays, signal skew across different length traces. All the things that help you analyze how the logic is working.

That isn't to say that a "binary" oscilloscope isn't useful, it very much is. But you have to understand what you can't see in order to know where your blind spots are. My manager at Intel way back in the day always had an oscilloscope run at 16x the speed of the fastest clock to minimize this effect. And Tektronix made a very expensive instrument called the DAS9000 to try to catch these sorts of glitches in the wild.

So whenever you are sampling the signal, rather than capturing the signal, try to keep in mind what is happening when the sampler isn't looking. :-)

<comment><USER4> Hi, developer of BeagleLogic here! Thanks for sharing your insight on logic analyzers here, it was really helpful (and something to keep in mind for v2 ;) ).

I've tested BeagleLogic with 24 MHz SPI and I think that's the best I can expect this to capture, so it's something that's mostly intended for hobby use, plus you can connect it over your network for remote debug - but that's not something I've looked into much as of now (though you can use netcat). And BeagleBones are getting popular today so you can use something you have around as a potentially useful debugging tool, to me that sounds awesome.

The objective I had while building BeagleLogic is to showcase an application of high-speed DAQ with the PRUs on the BeagleBone Black (and now the Green as well). The biggest USP is that the PRUs are able to capture data directly into 512 MB of RAM, so there's a lot of samples one can potentially capture. Plus the samples are exposed to userspace via '/dev/beaglelogic' once it's running on the BBB so you can write your own code to capture data and process it the way you want.

I know that there are still a lot of rough edges but what you can expect to see the BeagleLogic ready-to-run image for the BeagleBones getting released more frequently. If there's anything you'd like to see in the project, have suggestions or ideas, please let me know at feedback AT <name of project> DOT net . Thanks! --Abhishek

PS: If you'd like to read what happens under the hood you might want to see this blog post - [http://theembeddedkitchen.net/beaglelogic-building-a- logic-a...](http://theembeddedkitchen.net/beaglelogic-building-a-logic- analyzer-with-the-prus-part-1/449)

For those who are on hackaday.io, you can follow BeagleLogic at [https://hackaday.io/project/4395-beaglelogic](https://hackaday.io/project/4395-beaglelogic)

<comment><USER3> It is a very cool project Kumar, and as you have pointed out an excellent example of high speed data acquisition. Doing this with the Beaglebone and a cape is much more cost effective than some of the rather expensive instruments you might buy to work with LabView or similar packages.

With a small bit of work and a flash 10 bit ADC you could have a very nice 10 - 50Mhz oscilloscope data gatherer as well. I've seen similar units used in test systems where a test waveform is programmed and the samples are compared to insure they are within bounds of the test, an indication is raised when they are not allowing an automated process to take action.

I have a number of Beaglebone boards and look forward to playing around with your code.

</comment></comment></comment><comment><USER5> Talk that goes into the details of the Beaglebone's PRU: [https://www.youtube.com/watch?v=ZNz45v9Uesg](https://www.youtube.com/watch?v=ZNz45v9Uesg)

</comment><comment><USER6> That's quite smart, using the two 200MHz PRU cores to do the capture. It's also a sad commentary on the state of CPU designs, where we now have GHz processors that can't sample the state of an IO pin in 200ns to save their life.

<comment><USER7> > It's also a sad commentary on the state of CPU designs, where we now have > GHz processors that can't sample the state of an IO pin in 200ns to save > their life.

Not really! It's much closer to a general purpose microprocessor than a microcontroller. How many desktop PCs can sample GPIO pins at all? Much less at some kind of rate that you find reasonable. You're going to use the parallel port? Sorry, that's about three layers of abstraction away from the actual processor.

Complicated things are complicated and the beaglebone is a full, real computer. I think it's comparable to desktops around the turn of the century. I don't think a PIII could sample GPIO pins at 100MHz even if it had any, which it didn't.

<comment><USER5> PRUs give you good latency because of no/shallow pipelines (CPUs have a pipeline to increase throughput). Also ... no interrupts!</comment></comment></comment>


"Make people want something" - counterpoint - <AUTHOR> https://pbs.twimg.com/media/BIjuNDECYAAjPzt.png

<comment><AUTHOR> In response to <http://alvybrooks.com/ycposter>.

An interesting counterpoint by @pricklynettles on twitter.

How much startup failure is not making something people want, and how much of it is failing to make people want it?</comment>


Billionaires Dumping Stocks, Economist Knows Why - <AUTHOR> http://www.moneynews.com/MKTNews/billionaires-dump-economist-stock/2012/08/29/id/450265

<comment><USER2> Firstly, it's not uncommon for billionaire stock owners to shift big money around. Since they're such big traders that the market follows, they can also apply to the FCC to have transactions temporarily withheld until completed so as to avoid running the price of a stock up. They could see a better opportunity to invest, and be in the process of buying up a US stock right now. Maybe not, but this alone is no reason to sound the alarm. Buffet and the others still have a LOT of U.S. investments.

Second, the "historic performance" of stocks currently is a bit over-hyped. The S&P 500 is just back to 2007 levels, and we've seen some brutal drops since the middle of the month. [1] The stock market is NOT sunshine and roses.

All said, though, I personally believe Wiedemer is correct, though perhaps not to that scale. We should be terrified about "federal easing." It's a fact that the Reserve can't keep interest rates this low indefinitely, and trying to "stimulate" the economy in this manner was never supposed to be a long-term strategy.

It's a fact that interest rates will rise, and when that happens housing prices will fall. Gains gains in real estate, construction and manufacturing, which have just started coming back online, will tumble and fall. The Fed has been reckless, fearing criticism that it's not doing enough.

[1] [https://www.google.com/finance?cid=626307](https://www.google.com/finance?cid=626307)</comment>


We just launched Extractiv, our Semantic Web as a Service - <AUTHOR> http://www.extractiv.com

<comment><AUTHOR> Some direct links for more information:

Live Demo: <http://www.extractiv.com/demo.html>

Documentation: <http://wiki.extractiv.com>

<comment><USER2> There's no 'box below' on your demo page that I can see.

<comment><AUTHOR> What browser/OS are you using?

<comment><USER2> iPad, at the time. I see it's fine on Firefox today.</comment></comment></comment></comment>


Ask HN: Why did Andrej Karpathy take down the Stanford CS231n videos? - <AUTHOR> https://twitter.com/karpathy/status/727618058471112704 <comment><USER2> "Advocates for the deaf on Thursday filed federal lawsuits against Harvard and M.I.T., saying both universities violated antidiscrimination laws by failing to provide closed captioning in their online lectures, courses, podcasts and other educational materials."

Torrent available:

[http://mega.co.nz/#!0FtFyCjJ!_hXJXCBNN-rZgJXuw-mpAb-D- MHS4AJ...](http://mega.co.nz/#!0FtFyCjJ!_hXJXCBNN-rZgJXuw-mpAb-D-MHS4AJ8hZS- QYnSXd4)

Or:

[http://academictorrents.com/details/46c5af9e2075d9af06f280b5...](http://academictorrents.com/details/46c5af9e2075d9af06f280b55b65cf9b44eb9fe7)

Archive.org:

[https://archive.org/details/cs231n-CNNs](https://archive.org/details/cs231n-CNNs)

</comment><comment><USER3> He listed these reasons why Stanford took them down: [https://twitter.com/karpathy/status/727622433046335488](https://twitter.com/karpathy/status/727622433046335488)</comment>


Ep.io, a new python WSGI hosting company - <AUTHOR> http://www.aeracode.org/2011/1/11/new-ventures/

<comment><USER2> So, in less than a year we've gone from zero scalable django hosts to 3/4... The pricing on this looks neat too — they are explicitly saying that small community sites will likely fit within the free quota, presumably as a loss leader to get developers to use them for multiple projects?</comment>


Candy Crush Maker Opens At $20.50, Already Down 10% - <AUTHOR> http://www.businessinsider.com/king-ipo-2014-3?utm_content=bufferc5d92&utm_medium=social&utm_source=facebook.com&utm_campaign=buffer

<comment><USER2> I don't understand these smartphone-game-makers going public. There seems to be a trend: they are all based off one game, have little (or none) in terms of net revenue, and do poorly in the market. Zynga: down ~50% since it went public.

<comment><AUTHOR> There's been next to no news about how Don Mattrick was going to rejuvenate Zynga, either.

<comment><USER2> KING did not do very well at all...

[http://www.bloomberg.com/news/2014-03-25/king- raises-500-mil...](http://www.bloomberg.com/news/2014-03-25/king- raises-500-million-in-candy-crush-maker-s-u-s-offering.html)</comment></comment></comment>


New NIST password guidelines: don't require character types or rotation - <AUTHOR> https://pages.nist.gov/800-63-3/sp800-63b.html#memorized-secret-verifiers <comment><AUTHOR> Operative bit in 5.2.2: "Verifiers SHOULD NOT impose other composition rules (mixtures of different character types, for example) on memorized secrets. Verifiers SHOULD NOT require memorized secrets to be changed arbitrarily (e.g., periodically) unless there is evidence of compromise of the authenticator or a subscriber requests a change."

I'm cautiously hopeful that this will supply needed ammunition for those advocating for saner password rules and policies in organizations big and small.

<comment><USER2> They should settle on requiring a memorable, yet high entropy password that is impossible to conpromise. For example the string "IpromiseIamauthorizedtoaccessthissystem". This string is very high-entropy (does not appear anywhere in Google, is 9 words, a mixture of upper and lowercase. For someone trying every character combination, it would take over a thousand years to crack. It includes a second factor (the promise) by definition. In short it should be the REQUIRED secure password for all applications.

<comment><USER3> Bruce Schneier disagrees with you:

[https://www.schneier.com/blog/archives/2014/03/choosing_secu...](https://www.schneier.com/blog/archives/2014/03/choosing_secure_1.html)

The main point from his essay is anything that can be remembered can be hacked. He then softens that statement to show a way to take your memorable phrase and turn it into something stronger.

<comment><USER4> Schneier is simply wrong there.

He wanted to rant and therefore didn't read the description of the "xkcd scheme" with enough concentration to understand it.

Legions of security people debunked Schneier, but unfortunately he didn't have it in him to retract his claim and update his post.

This blog post is the best example you can give of Schneier quitting academic discourse and becoming a pundit.

<comment><USER3> Can you point to a good debunking?

<comment><USER5> Here you go: [https://security.stackexchange.com/questions/62832/is-the- of...](https://security.stackexchange.com/questions/62832/is-the-oft-cited- xkcd-scheme-no-longer-good-advice)

<comment><USER3> After reading through most of that, it seems that the big problem with the XKCD scheme is that it's often impractical. Too many sites restrict password length and so you are forced to use the Schneier modification to get more entropy per character.

If you make a password from an alphabet of 64 characters (upper and lower case, digits, and some special characters), there are 6 bits per character of entropy so a ten character random password could have 60 bits of entropy.

If you are choosing words from a list 4000 words long, there are 11 bits of entropy per word and so you would need to string together five random words to get a password of equal strength. The big problem then is having enough space to type that many characters.

<comment><USER5> Yep, unfortunately for passphrases the maximum acceptable password length on web sites tends to be the #1 factor limiting their use. I created sample passphrases and tried them on a handful of different sites to measure the problem. See starting slide 31 in this presentation (PDF): [http://www.passwordresearch.com/files/How%20Secure%20Are%20M...](http://www.passwordresearch.com/files/How%20Secure%20Are%20Multi- Word%20Random%20Passphrases%202.01%20-%20ISSA.pdf)

<comment><USER3> Do you know why sites would set a low limit? I can understand limiting to, say, a couple hundred characters, but 16 is ridiculous. These days, all anybody is going to store is a salted hash so the passphrase length should be mostly irrelevant.

Edit: that's a pretty nice slide deck. Thanks for the pointer.

<comment><USER6> > These days, all anybody is going to store is a salted hash so the passphrase > length should be mostly irrelevant.

Since I still run into services where the "forgot password" mechanism emails your current password in the clear, this is unfortunately not as true as one would hope.

</comment></comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER7> This part is very good advice:

      When processing requests to establish and change memorized
      secrets, verifiers SHALL compare the prospective secrets
      against a list of known commonly-used, expected, and/or
      compromised values.

So, no rotation, no character set rules, but the password better not be already known. They specifically refer to comparing against a corpus of known broken passwords. Very good.

<comment><USER8> I wrote a tool a while back that's excellent at this. It produces a 1MB file that you can do a straightforward search against and use to blacklist 161,000 different common passwords.

[https://github.com/robsheldon/bad-passwords- index](https://github.com/robsheldon/bad-passwords-index)

I want people to use it. I gave it the most permissible possible license. Please people, use it. I'll even update it Real Soon Now.

<comment><USER9> I like your license choice. Is there a reason you chose Unlicense over CC0? I've never heard of it before. The text is a bit shorter than CC0 which is nice. Creative Commons recommends against using CC licenses for software so as not to step on the toes of the GPL which doesn't seem applicable if you really want public domain. [1]

[1] [https://creativecommons.org/2011/04/15/using-cc0-for- public-...](https://creativecommons.org/2011/04/15/using-cc0-for-public- domain-software/)

<comment><USER8> Oof. I don't remember exactly, but I do remember spending a lot of time (too much time) deciding between various license options. I _think_ in the end I chose Unlicense primarily because it's easier to find Unlicensed projects on Github.

</comment></comment></comment></comment><comment><USER10> This bit caught my attention:

>Memorized secret verifiers SHALL NOT permit the subscriber to store a "hint" that is accessible to an unauthenticated claimant. Verifiers also SHALL NOT prompt subscribers to use specific types of information (e.g., "What was the name of your first pet?") when choosing memorized secrets.

I wonder if Mastercard and Visa will reconsider this policy.

<comment><USER11> Wait? You mean you answer those questions with real data?

My answers to those (when required) always look like this:

> "What was the name of your first pet?" JBK?a0ly(VE3E-|-@BADZFPS<1Fh$X23

Where the "goop" is generated, and remembered, by my password manager ([https://github.com/zdia/gorilla/wiki](https://github.com/zdia/gorilla/wiki)).

<comment><USER12> You really think if I call in trying to impersonate you and that question comes up the customer service person is going to require me to recite that and not accept "Oh, I just put some random garbage in" as a solution? Something that seems like a realistic answer, but is totally wrong is likely a better choice.

<comment><USER13> I routinely get into my own accounts by saying "oh, I don't remember wat I set that to" for multiple security questions until I get questions I don't need to look up the answers to.

It really is scary, in that even my bank will fall back on things that are either easy to obtain or easy to guess, because they clarly have to deal with too many people who either genuinely have no clue, or like me can't be bothered to look up what I've answered. "Telephone banking password? I have no idea what that is. Did I set one? Sorry, can't remember..."

</comment></comment></comment></comment><comment><USER14> Previous related discussion around these rules here: [https://news.ycombinator.com/item?id=13016948](https://news.ycombinator.com/item?id=13016948)

</comment><comment><USER15> > _" When processing requests to establish and change memorized secrets, > verifiers SHALL compare the prospective secrets against a list of known > commonly-used, expected, and/or compromised values."_

This has to be applied to the whole password (which it implies anyway) or you end up with the rather silly situation which I encountered the other day when I had to create a temporary password for a Microsoft service. It absolutely refused to accept even a very secure password if there was a portion that was not secure.

For example: a password similar to "$4(password(!monsT3rDiet%@" was rejected. But if I removed the word "password" and made the string shorter (and therefore less secure), that was okay!

</comment><comment><USER16> "If Unicode characters are accepted in memorized secrets, the verifier SHOULD apply the Normalization Process for Stabilized Strings defined in Section 12.1 of Unicode Standard Annex 15 [UAX 15] using either the NFKC or NFKD normalization."

I had not even thought about normalization before in this context, but I could see it being an issue if a user moves to a new device. But what if new composed characters are added to Unicode, does that mean the user can no longer log in with NFC passwords? I guess that K in NFKC is important.

<comment><USER17> NFC decomposes composed characters that were not present in the first version of Unicode, for precisely this reason.

</comment></comment><comment><USER18> I'm not sure if accepting unicode characters is a good idea. It would make it more secure but you can very easily get locked out of your own account if you try to login from another device without the correct input method.

Here's one extreme example of it: "I included emoji in my password and now I can't log in to my Account on Yosemite"([https://news.ycombinator.com/item?id=10742351](https://news.ycombinator.com/item?id=10742351))

<comment><USER19> A somewhat similar issue appears with Bitlocker in Windows. When you set your password you are using your custom Windows keyboard layout, such as sv-SE (Swedish). But then when you are prompted to enter your password during boot to decrypt your computer the keyboard is always en-US.

It's fun figuring out how to type Swedish and special characters on a foreign keyboard layout. Of course no part of the UI indicates this layout issue.

I think Unicode is good. I think companies should fix their broken input instead.

<comment> loup-vaillant Shame on Microsoft, then. My Ubuntu Linux laptop was installed with the default settings for full disk encryption, and it uses my favourite layout right there at boot time.

<comment><USER20> A BIOS is 7bit ASCII - if you want anything more than that you need to load a ramdisk with drivers. If you're loading a ramdisk with drivers then you may as well also load a keylogger.

You'd also need to recreate that ramdisk if your hardware fails, and good luck booting from non-root encrypted volumes.

Using EN-US for boot disk volumes is pretty good advice.

Microsoft have thought this through - their recovery keys are ASCII numerals only and are entered using _function keys_ since they're the only universal keys.

edit: relevent Technet: [https://technet.microsoft.com/en- us/library/ee449438(v=ws.10...](https://technet.microsoft.com/en- us/library/ee449438\(v=ws.10\).aspx#BKMK_Key)

<comment> loup-vaillant And where exactly the keylogger is supposed to come from? Has your laptop been tampered with during lunch? Then I'm afraid bitlocker is just as screwed as my Ubuntu. Or has the laptop been owned during use (remote vulnerability, double click on a malware…)? Same thing.

I'm not sure I see the point of this limitation. At a first glance, it seems using the BIOS only doesn't buy us much.

<comment><USER21> May I suggest a hardware keylogger?

Noone will ever figure out that the fat plug at the end of the USB cable is a keylogger =)

<comment><USER22> Any recommendations on a good keylogger software please? Have anybody tried this one [https://www.refog.com/](https://www.refog.com/) , I read only positive reviews on it. Thanks in advance.

</comment></comment></comment></comment></comment></comment></comment><comment><USER23> I never understood thecidea of having to change my password periodically. The password was good last month, why isn't it good now?

<comment><USER24> The rationale was that if, password hashes got compromised, the attacker would only have until the next forced rotation to crack the passwords and take over accounts.

edit: or, in particularly terrible systems, if plaintext passwords were leaked.

Of course, that's only useful if it doesn't affect any other password security concerns, and it turns out that users who are forced to change their passwords frequently pick worse passwords, which is a bigger problem than the scenario this was supposed to protect against.

<comment><USER25> > it turns out that users who are forced to change their passwords frequently > pick worse passwords

I can vouch for this. My rotating password at work is _______1, followed by _______2, then _______3, and so on. If a year-old hash gets cracked, it won't take a rocket scientist to know that the password right now is _______4.

<comment><USER26> Get a password manager already, and let it just generate random passwords for you. Typing in passwords is so lame. :) If you are on macOS I highly recommend [https://github.com/ravenac95/sudolikeaboss](https://github.com/ravenac95/sudolikeaboss) (and by extension 1Password).

<comment><USER27> This would be fantastic if work allowed me to install one. Sadly, some of us work in locked down environments so resort to such silliness to get through the work day.

<comment><USER26> I'm sorry. that sucks. That's just stupid. I could see employers requiring you to use their password manager, but ugh, not allowing use of one is just gross.

That said, lastpass can work without any modifications to your local machine(i.e. it can work without any browser plugins even) tho it's not very fabulously integrated, it does work... Assuming of course they don't block access to the lastpass website and JS.

<comment><USER25> Does it work to allow me to log in to my machine or to unlock it? (Serious question. If so, then I will happily use a 16 character blob of entropy)

</comment></comment></comment></comment></comment></comment></comment><comment><USER28> "Memorized secrets that are randomly chosen by the CSP (e.g., at enrollment) or by the verifier (e.g., when a user requests a new PIN) SHALL be at least 6 characters..."

Does this include credit/debit card PINs?

"Verifiers also SHALL NOT prompt subscribers to use specific types of information (e.g., "What was the name of your first pet?") when choosing memorized secrets."

I take it this proscription applies to the actual passphrase, not as part of an account reset mechanism? If so, that's too bad, I really don't like these questions let alone the storage of the answer. Are these answers secrets though? If so, send like it's proscribed, and also they have to be salted and hashed in which case the answer itself isn't being stored.

</comment><comment><USER29> They also discourage biometric use: [https://pages.nist.gov/800-63-3/sp800-63b.html#biometric_use](https://pages.nist.gov/800-63-3/sp800-63b.html#biometric_use)

</comment><comment><USER30> Super relevant because today I got the annual reminder to check my Social Security statement online.

Go to login, password expired. Expires every 6mo. Also, requires punctuation. I type in a typical strong/long password and it says "weak" until I append ! to the end and magically now it's "STRONG!"

</comment><comment><USER31> At my publicly traded company I was told that they have to do password rotation because of Sarbanes Oxley. Is there any truth to that?

<comment><USER6> I'm less specifically familiar with SarbOx details than HIPAA, but I suspect the former, like the latter, requires sexurity processes that address particular issues and your institution has adopted procedures (possibly from a third-party canned set) to satisfy those that require rotation. A lot of "required by HIPAA" mythology has this origin, and what I understand of SarbOx is that it's generally similar in this regard.

<comment><USER32> > sexurity

Typo?

<comment><USER13> Some security processes _do_ feel a bit like bdsm.

</comment></comment></comment></comment><comment><USER33> It says "SHALL be generated using an approved random bit generator." What are some examples? debian /dev/urandom? dotnet RNGCryptoServiceProvider? others?

Who approves this stuff? Does anybody know?

<comment><USER34> Edit: Confirmed info here

[http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP...](http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-90Ar1.pdf)

Source: [https://www.nist.gov/news-events/events/2016/05/random- bit-g...](https://www.nist.gov/news-events/events/2016/05/random-bit- generation-workshop-2016)

</comment></comment><comment><USER35> Good to see that after all this time dodging corporate pressure to implement counter-productive measures, the guidelines themselves have changed for the best :)

</comment><comment><USER36> >Unicode [ISO/ISC 10646:2014] characters SHOULD be accepted as well. So, can passwords contain emojis under these guidelines?

<comment><USER37> Yes. The larger the character space, the better. In fact, even today, I'm astounded by services that let me set passwords with "high" ASCII characters, like íÑVTx¾]õ^ÖcÉ^x½0ÞØý½

</comment></comment><comment><USER38> They appear to be dangerously unaware of modern memory-hard PBKDFs such as Argon2, winner of the [https://en.wikipedia.org/wiki/Password_Hashing_Competition](https://en.wikipedia.org/wiki/Password_Hashing_Competition)

</comment><comment><USER39> Interestingly enough, I just recently released a password strength library which can help enforce these exact requirements. [https://github.com/GoSimpleLLC/nbvcxz](https://github.com/GoSimpleLLC/nbvcxz)

</comment><comment><USER40> Wait, 10,000 iterations of the has function? That's surprising, and of questionable value.

<comment><USER41> Yes, at least. _and_ in combination with a slow hashing function such as PBKDF-2, where the current recommendation for server side hashing is 100K+ iterations.

The workload is ideally set to something that is acceptable to users, but considerably slows down brute-force attempts by attackers.

Please educate yourself some more before making statements on the value of things that surprise you, they might be there for a good reason.

<comment><USER40> The brute force would have to be on a raw database dump, and is probably in no rush to complete. Also, speed being hardware dependent, the attacker could simply get more, or wait for the advance of Moore's law so that what was "slow" last year is now fast. Deliberately slow hashing is just shouting into the wind.

Your comment about "please educate yourself" was not constructive.

<comment><USER42> You don't seem to understand the scale here. Normal, non-secure hash functions can be calculated at a rate of hundreds of millions per second, and can easily be brute-forced within a few hours. Current rule of thumb for PBKDF2 (for example) is to choose an iteration count corresponding to around _two_ hashes per second, and the work is not parallelizable. That turns those hours of work into _millenia_.

If it really concerns you, proper practice is to store the iteration count alongside the hash and salt, so you can easily go through and add more iterations if you want as computers get faster.

</comment></comment></comment></comment><comment><USER43> That code points are counted as a single character is absolutely mandatory, but there's no requirement to allow passwords over 6 characters? Interesting choices.

</comment><comment><USER44> 184.108.40.206. Memorized Secret Verifiers

I prefer plain English aka "passwords"

<comment><USER45> I like the implications of "pass phrase"

</comment></comment><comment><USER46> Obligatory XKCD on this topic:

"Password Strength"

[https://xkcd.com/936/](https://xkcd.com/936/)

</comment><comment><USER47> Finally some common sense in guidelines (appearently, some people need guidelines for this stuff because they have no common sense).

</comment><comment><USER48> pwgen

</comment><comment><USER49> [https://www.random.org/passwords/?num=4&len=8&format=html&rn...](https://www.random.org/passwords/?num=4&len=8&format=html&rnd=new) FTW

<comment><USER50> I prefer the passphrase: [https://xkcd.com/936/](https://xkcd.com/936/)

Also, I feel _very_ funny using generated password from a website. If I need a new password, I can just generate one in Python or something.

<comment><USER51> I have this macro saved in ipython. Note that I use a subset of symbols that's easy to type on most(?) keyboard layouts withoutany gymnastics:

      %load pwm
      import random as r
      import string as s
      def pw(n=12):
        return "".join([r.choice(
                           s.ascii_letters \
                          + s.digits \
                          + "|!@#$%&/()=?+\-_.,;:")
                         for x in range(n)])

<comment><USER52> ruby -e 'rand(34*10).to_s(34)'

I prefer not to have to use the shift key in passwords, and the 34 instead of 36 ([0-9a-z]) solves my german/us layout problem in a very golfy way.

<comment><USER53> Both your and parent's password generators are not secure: they use non- cryptographic random number generators, which have limited entropy.

<comment><USER13> That matters very little if you are manually generating an occasional password here and there for personal and an attacker have no reason to know your specific method of generating the password.

<comment><USER51> True. Otoh I just told the attacker my specific method :-) And I'd prefer a system that was secure enough that doing so wasn't a problem.</comment></comment></comment></comment></comment></comment></comment>


A Modest Proposal to Reign in Sociopaths - <AUTHOR>

SOPA, Aaron Swartz... when will it stop? Never?
We wring our hands and shake our fists. We petition our political rulers. All for naught.
You see, politics attracts sociopaths and control freaks. And absolute power drives them to frenzy.
Sociopaths don't do mercy. Control freaks don't relinquish control.
Bit by bit, they steal our freedoms and crush resistance.
And we beg them to stop. All for naught.
So, do we ignore them and let them be?
No!
There's a technical solution to all this. And it's well within reach.
Light!
Roaches thrive in darkness. Perhaps bright lights are in order?
Bright lights to scatter the roaches and to keep them at bay.
Bright lights to wake those asleep and to inform their consciousness.
Bright lights to expose and shame.
Five or six corporations own our TV networks, TV stations, newspapers, publishers, movie distributors, and many of our politicians. Why use their platforms to make change?
Bright lights. Our platform. Our terms.
Let's build and promote a bright lights social platform for identifying bad laws, bad prosecutors, bad judges, and bad politicians.
There will always be sociopathic, politically opportunistic prosecutors and writers of bad, unconstitutional laws. But let's make them pay. On our platforms; our terms.
SOPA was a warning. The torture of Aaron Swartz, a call to action.
Let's use the internet to restrain sociopathic control freaks before they make it impossible to do so.
Don't ask for new laws. Post editable proposals online with hyperlinks, voting, mobile, and other social features.
Don't beg for the removal of bad laws. Post a list of laws that just must go. Let our fellow citizens participate effortlessly.
Etc. Etc.
Does any of this make sense? If so, let's hear it. If not, the status is quo. <comment><USER2> When I see some of these HN self posts, I feel like I'm reading a 70's bulletin board.

</comment><comment><USER3> Best damn fucking idea ever.</comment>


Show HN: A tool to purchase and monetize internet connectivity - <AUTHOR> https://www.trekknet.com/ <comment><USER2> Very interesting idea, but I think people looking for wifi are not the people who want to pay for it...

Perhaps a non-monetary payment like a free internet connection, but you need to watch an ad every few minutes on the app

</comment><comment><USER3> It's an interesting idea but doesn't that go directly against the TOS of most phone providers?

<comment><USER4> Do ISPs make a distinction between service to the home and business?</comment></comment>


"Your Sense of Entitlement Is Staggering." - <AUTHOR> https://groups.google.com/d/topic/d3-js/zHcH-FIEroE/discussion <comment><USER2> The replies from the D3 community are inspiring: such a patient and helpful group of people.</comment>


The Attack on Truth - <AUTHOR> http://chronicle.com/article/The-Attack-on-Truth/230631/

<comment><USER2> TL;DR: "Humans (across the population) are incredibly, incredibly stupid, and refuse to change their (emotional) minds in the face of overwhelming evidence. Being/acting/living smart is a choice that an alarming percentage of people fail to make."

Sounds like this article could have been written any year after language was invented.

<comment><USER3> I think the key point is:

> _" There is simple ignorance and there is willful ignorance, which is simple > ignorance coupled with the decision to remain ignorant."_

I'm not so sure if being _willfully_ ignorant really was an option for many people up until recently.

<comment><USER4> Willful ignorance has always been an option, and there is no reason to believe there has been significant change in the last millennia with respect to individuals.

Willful ignorance implies knowledge that is available, but disregarded since it isn't desired; and, the knowledge someone holds is not dependent on its validity.

What has changed is the availability of different ways of thinking and the increased number of ways they go unchallenged in public discourse. With the addition of the internet/mass communication, the memes that self reinforce the strongest allow their carriers "know" with more "evidence backed" certainty than ever (albeit with more competing ways to doubt them too).

</comment></comment></comment><comment><USER5> There's a sad note of "it was okay when _we_ were doing it" which suffuses the article. A good lesson why scientists should rely on argument and evidence instead of memetic weapons that don't care what direction they're being pointed in.

<comment><USER6> >A good lesson why scientists should rely on argument and evidence instead of memetic weapons that don't care what direction they're being pointed in.

It's a poor fact-stopping argument that doesn't point both ways?</comment></comment>


Show HN: Why is Bitcoin down? - <AUTHOR> http://whyisbitcoindown.co/ <comment><USER2> reminds me of the Bastard Excuse From Hell, BTC version</comment>


Amazon EC2 vs Rackspace Cloud - <AUTHOR> http://gasoftwareblog.com/home/2011/3/31/amazon-ec2-vs-rackspace-are-all-cloud-hosting-services-the-s.html

<comment><AUTHOR> Good comparison.

It would be nice to see Rackspace add in firewall control, bring their new load balancer platform to the UK and have some control over the mapping of ip addresses (like Amazon's Elastic IP's).

</comment><comment><AUTHOR> Another very useful feature of Rackspace is their iPhone & iPad app for managing servers on the move.

It can even provision new servers using Puppet or Chef.</comment>


Jeff Bezos all in on Covid-19 - <AUTHOR> https://blog.aboutamazon.com/company-news/a-message-from-our-ceo-and-founder <comment><USER2> this is great</comment>


Ask HN: Why do some HN users have colored user names? - <AUTHOR> <comment><USER2> [https://news.ycombinator.com/item?id=3848762](https://news.ycombinator.com/item?id=3848762)

</comment><comment><USER3> Green user names is an account younger than 14 days.</comment>


Ask HN: What was the first site to use "karma" voting? - <AUTHOR> Some of the best sites on the internet use the concept of crowd-sourced rating of content and comments by/from the users. It probably doesn't matter anymore, but I'm interested to know who came up with the idea? Or who did it first?<p>- Hacker News<p>- Reddit<p>- Stack Exchange<p>- Imgur<p>- Facebook<p>- Myspace <comment><USER2> I don't think slashdot was firs to use crowd sourced rating, but I am not aware of others to have an actual functioning system at a scale of 10s of thousands in that era.

And to be fair, everything2 used the term karma before slashdot. We had the concept of karma, but it was called like modtotal or something innocuous. Nate was working on e2 and we were discussing ideas and I realized the term was way more clear so I did the UPDATE TABLE that day. 98 maybe?

<comment><USER3> (+1, Informative)

Thanks for the clarification!

</comment></comment><comment><USER4> As others have said Slashdot was very early if not the first. The way they did moderation, which is very different from basically everyone else, and still unique and interesting.

CmdrTaco did a great writeup on it back in 1999 [https://slashdot.org/moderation.shtml](https://slashdot.org/moderation.shtml)

</comment><comment><USER5> Among the lineage of web comment sites I'm familiar with, I'm pretty certain it was Slashdot. They definitely had it in 1999. Might have been 1998.

It definitely wasn't Digg. According to Wikipedia, that wasn't even founded until 2004.

<comment><USER3> I don't remember it before Slashdot either, and the founders sometimes talked about it as if it were their own innovation. Not sure if there was any "prior art" they were working from or not.

</comment></comment><comment><USER6> Not only did Slashdot do karma early or the first in it's regular form and with quite a bit more finesse than most simple up-vote-down-vote, I'm pretty sure they're the very first with automatically delegated meta-moderation:

Given your metrics on karma, visits, etc, to decide whether a rating was fair or not. Again, like moderation, not a permanent role, limited to meta-modding around 5 comments. That was a lot of fun as rated comments tended to be great or awful, the great ones often in an article I hadn't clicked so get to read through something new, and the awful ones quite amusing, Slashdot did have a large subset of trolls that were very smart, sarcastic and scathing.

</comment><comment><USER7> I think you forgot Digg, the first one that blew up and made karma voting popular. It was not the first one to use karma though, like google wasn't the 1st search engine. But before google a lot of folks didn't even know about search engines... Most concepts on the Web existed way before the Internet anyway.

<comment><USER8> Digg was just a copy of Fark with a better UI.

</comment></comment><comment><USER9> Slashdot, including the first time 'karma' was associated with digital influence afaik. Meta moderation and a cap on influence ranking was and still is the Right Way to constrain sunset score-whoring feedback loops.

</comment><comment><USER10> Probably slashdot. Certainly none of the ones you listed.

</comment><comment><USER11> Interesting survivor bias represented here. Except for MySpace, these are only extant sites. How many karma-implementing sites have vanished?

</comment><comment><USER12> Slashdot is the first "big" site I can remember...

But in 1996 or so there were a few gaming sites whose names I can't rememeber who had a sort of negative karma... I remember it being described as a "douchiness factor" a couple of times...

<comment><USER10> I think the concept of shadowbanning may have existed before slashdot. I seem to remember reading about it in the mid to late 90s on slashdot actually.

<comment><USER13> Distributed shadowbanning was implemented on Usenet with killfiles.

<comment><USER9> Don't forget the moose! cm.org

</comment></comment></comment></comment><comment><USER14> [https://www.b3ta.com](https://www.b3ta.com) have been doing it for around 20 years.

</comment><comment><USER15> I'm going to say Slashdot as well.

Did Myspace have karma style voting? I don't really remember that.

Also Imgur was BUILT to be an image hosting service for Reddit. Out of the ones on your list it's the youngest service so it definitely wouldn't have been the first in pretty much anything.

</comment><comment><USER16> Worth1000 photoshop contests site also had karma back in 2001. It was used to ensure fairness in voting and gave more voting power.

</comment><comment><USER17> stumbleupon can also be considered in this list

</comment><comment> daniel-s I'm guessing digg.

</comment><comment><USER18> Man, I feel old when Imgur, a yesterday's establishment from my point of view, can be considered a 'first' of anything.

While I also believe Slashdot to be the first one (it certainly is the first one to use the _term_ 'karma'), some two other early communities to check for prior art are Kuro5hin and Advogato.

<comment><USER9> Kuro5hin was built by Rusty on slashdot's codebase so I don't think it could have been prior

<comment><USER10> Oh man I haven't heard of Kuro5hin in years. I actually deleted my account there when I got doxed years ago.</comment></comment></comment>


Good Artists Copy, Great Artists Steal - <AUTHOR> http://jonathanischwartz.wordpress.com/2010/03/09/good-artists-copy-great-artists-steal/

<comment><USER3> Here's a photo of Steve Jobs using Concurrence when he returned to Apple, in the late 90s: [http://www.allaboutstevejobs.com/pics/life/5-1995-1999/08-pr...](http://www.allaboutstevejobs.com/pics/life/5-1995-1999/08-preboston/lightbox.html#10)

Notice that even if he was at a keynote, selling to the world Mac OS 9 and new iMacs, he personally used a PC laptop running a version of NeXT/OpenStep and the software that was sold to Sun. They eventually hired the same developers to build Keynote.

<comment><USER4> The biography on that site is great reading : <http://www.allaboutstevejobs.com/bio/long/01.html>

I just found a quote from Steve that could be one of my favourites quotes ever: "I started to realize that maybe Thomas Edison did a lot more to improve the world than Karl Marx and Neem Kairolie Baba put together."

</comment></comment><comment><USER5> Respect for Jonathan, the guy who successfully got Steve Jobs to shut up and back up.

<comment><USER6> Sorry, but I have a helluva lot more respect for Steve Jobs than I do for Jonathan. Steve has legit bragging rights. What can Jonathan brag about? Taking $12 million in severance from Sun while his employees got two months of pay at most?

<comment><USER7> And I have a helluva lot more respect for Bill Gates than either of them. He's done something worthwhile with the riches.

<comment><USER8> He's done something worthwhile with a fairly small portion of the riches and is using that as a very successful propaganda machine to counter his negative image.

Please keep in mind that this was the CEO under which a number of very questionable actions (anti-trust, SCO) were effected.

<comment><USER7> Propaganda? Please. Outside of the open source tech bubble Bill G doesn't/didn't have a negative image to counter. He has given away ~$30 billion which is not a small portion at all (> half of his current net worth). It's his main focus and he will likely donate teh bulk of his remaining fortune. iMacs and iPods don't save lives, providing vaccinations saves millions.

[http://www.cnn.com/2010/BUSINESS/01/29/davos.bill.gates.dona...](http://www.cnn.com/2010/BUSINESS/01/29/davos.bill.gates.donates/index.html)

In the innovative products race Steve Jobs wins. In the does good things race Bill Gates wins. It's admirable.

<comment><USER9> > Outside of the open source tech bubble Bill G doesn't/didn't have a negative > image to counter.

His company is a convicted monopolist by the US government,not by OSS fans.

More anecdotally, most people acknowledge that Windows is pretty shit these days.

<comment><USER10> I own a MacBook Pro, but use Win 7 at work. I think it's great, and have considered switching back at home.

</comment></comment></comment></comment></comment></comment></comment><comment><USER11> "Having watched this movie play out many times, suing a competitor typically makes them more relevant, not less. "

I don't think that's exactly true. I think suing people has largely no effect on relevance, but you tend to sue competitors whose relevance is on the upswing. Nobody is going to sue Myspace right now for IP infringement, for instance, they're going to sue Facebook.

<comment><USER12> It is definitely not always true.

Some history is illuminating. The first important lawsuit that Apple filed was against the Franklin Ace. This was in the early 80s. Heard about the Franklin Ace recently?

No matter how many times people tell Steve Jobs otherwise, he's been here before. And the very first time he did it, he won an important victory.

</comment></comment><comment><USER13> I really enjoyed reading Jonathan's blog at Sun. I'm not sure if he was the first, but he was certainly one of the first large company CEOs to blog and blog candidly (within the constraints of his position).

There were a few posts that stuck with me. I remember this one in particular, from 2005, about reducing their customer survey to a single question: would you recommend Sun?

<http://blogs.sun.com/jonathan/entry/defining_quality>

I'm glad he's back at it with this new blog.

</comment><comment><USER14> love it. to quote steve again from his famous commencement speech:

for the past 33 years, I have looked in the mirror every morning and asked myself: "If today were the last day of my life, would I want to do what I am about to do today?" And whenever the answer has been "No" for too many days in a row, I know I need to change something.

I wonder if he's proud of suing HTC over those silly software patents like "Unlocking A Device By Performing Gestures On An Unlock Image"

I'm not sure what to be more appalled at, the fact that the patent office actually issued that, or that apple is seriously suing over it.

<comment><USER15> Is there something specific about that patent that you find silly or do you find the whole notion that the specific way that an interface element works to be silly?

It seems to me that if such things can't be copyrighted, or trademarked, aren't covered by design patents, and shouldn't covered by utility patents, then choosing to implement something in software rather than hardware would be a losing proposition for anyone trying to differentiate or innovate.

<comment><USER16> I think it's a bit silly that you can take a $0.05 component, implement it in software, and get a patent on it.

<comment><USER15> I don't understand. What component? We're talking about software here.

Just because an interface object behaves in a way reminiscent of a physical object does not mean it _is_ that object. It has an entirely different mechanism. What you're saying is that one kind of mechanism should be patentable while another should not, but it's not clear _why_ there is a distinction.

</comment></comment></comment></comment><comment><USER17> Somehow the link to the (awesome!) patent troll patent got hosed up -- [http://appft1.uspto.gov/netacgi/nph- Parser?Sect1=PTO1&Se...](http://appft1.uspto.gov/netacgi/nph- Parser?Sect1=PTO1&Sect2=HITOFF&d=PG01&p=1&u=/netahtml/PTO/srchnum.html&r=1&f=G&l=50&s1=%2220080270152%22.PGNR.&OS=DN/20080270152&RS=DN/20080270152)

</comment><comment><USER18> $100M+ for infringing on Kodak (Wang's) patents with Java Remote Method Invocation. I wonder why they didn't go after CORBA? (IBM too big?)

> Lo and behold, the local jury decided Sun should pay Kodak more than a > hundred million dollars.

> Groups with no business focus other than litigating patent suits are > affectionately known as trolls – pure litigation entities.

Patent #5,206,951:

Integration of data between typed objects by mutual, direct invocation between object managers corresponding to object types

[http://www.google.com/patents?id=3KUXAAAAEBAJ&printsec=a...](http://www.google.com/patents?id=3KUXAAAAEBAJ&printsec=abstract&zoom=4&source=gbs_overview_r&cad=0#v=onepage&q=&f=false)

Patent #5,421,012:

Multitasking computer system for integrating the operation of different application programs which manipulate data objects of different types

[http://www.google.com/patents?id=M44eAAAAEBAJ&printsec=a...](http://www.google.com/patents?id=M44eAAAAEBAJ&printsec=abstract&zoom=4&source=gbs_overview_r&cad=0#v=onepage&q=&f=false)

Patent #5,226,161:

Integration of data between typed data structures by mutual direct invocation between data managers corresponding to data types

[http://www.google.com/patents?id=wbkXAAAAEBAJ&printsec=a...](http://www.google.com/patents?id=wbkXAAAAEBAJ&printsec=abstract&zoom=4&source=gbs_overview_r&cad=0#v=onepage&q=&f=false)

Patent list: <http://java.sys-con.com/node/46599>

<comment><USER16> "IBM today announced that it received 4,914 U.S. patents in 2009, marking the 17th consecutive year it has topped the list of the world's most inventive companies."

<comment><USER18> The IP arms race

</comment></comment></comment><comment><USER18> It is not ironic that Jerome H. Lemelson, arguably the most successful individual U.S. inventor ever [Sony paid him royalties for magnetic tape drive used in tens of millions of Sony Walkman], equated financial success as an inventor with protracted litigation.

"The American dream is that if the average American invents something novel and worthy of patenting, he'll find someone to license it. However, for most contemporary inventors , it hasn't worked out that way. The independent inventor today still has an extremely difficult time convincing corporations that he has a product which deserves to be on the market. Most companies have a tremendous resistance to ideas and technology developed on the outside."

"You cannot develop a reputation for somebody who gives up. You have to be known as a fighter for your rights. Otherwise, you'll never license anything...Even Thomas Edison had a tough time supporting and protecting his patents. He spent about $1.4 million [to defend his inventions], and this was around the turn of the century, when beer was a nickel."

<http://en.wikipedia.org/wiki/Jerome_H._Lemelson>

</comment><comment><USER19> "The secret to creativity is knowing how to hide your sources" - <USER2> Einstein.

Obviously Apple, MS, Google, and others need to do a better job of it.

<comment><USER20> The secret to hiding is to not be the biggest elephant in the stampede.

</comment></comment><comment><USER21> Good article but scary. If you've a start up without a wad of defensive patents what can you so if a large company gives you a "stepping all over our IP" threat?

</comment><comment><USER22> Don't miss the video of Steve saying "We have always been shameless about stealing great ideas . . . "

<http://www.youtube.com/watch?v=CW0DUg63lqU>

<comment><USER23> Playing devil's advocate. He could be saying that they're shameless in stealing ideas from _different_ fields, like the examples he gives: music, art, zoology, history. Copying the sleek lines of a panther's eyes for your icons is one thing, blatantly cloning a competitor's UI is another.

This may be why he can reconcile suing HTC while practicing the "great artists steal" mantra.

<comment><USER22> That's a good point.

On the other hand, the legend that Steve lifted the Xerox PARC UI persists -> [http://en.wikipedia.org/wiki/History_of_the_graphical_user_i...](http://en.wikipedia.org/wiki/History_of_the_graphical_user_interface) and

<comment><USER24> The movie _The Pirates of Silicon Valley_ does a pretty good job of telling this story.

</comment></comment></comment></comment><comment><USER25> I may be alone in thinking this, but it's odd when people I'd consider pretty rich have blogs with ads.

<comment><USER26> He's probably not even aware of it; it's the default on WordPress. To get rid of the ads, you'd first have to be aware that there are any at all (and you won't normally be served ads when you're logged-in as an author), and then pay for the no-ads upgrade. <http://en.blog.wordpress.com/2008/09/18/go-ad-free/>

</comment></comment><comment><USER27> Read all the way, it's got a good punchline.

</comment><comment><USER28> I wish someone would point out to me a software patent which he thinks justifies the patentability of software/business processes. I haven't seen any yet which makes me think that software patentability results in an economy more optimal than if it was not protectable under patent (as opposed to copyright) law.

<comment><USER29> <http://en.wikipedia.org/wiki/Microsoft_Research>

MSR regularly does amazing stuff, of which a lot gets patented: <http://www.google.com/search?q=MS+Research+patents>

I'd say hiring lots of bright guys and girls and investing heavily in R&D ($9.5B according to _1_ ) constitutes positive economic activity.

_[1][http://www.pcadvisor.co.uk/news/index.cfm?newsid=3214217&...](http://www.pcadvisor.co.uk/news/index.cfm?newsid=3214217&*)

<comment><USER28> I don't disagree that many of these inventions are novel, but would MSFT still have spent this money without the possibility of software patents?

<comment><USER30> Possibly yes, but they wouldn't have made it public.

</comment></comment></comment></comment><comment><USER31> The fact that Jonathan had the courage to say that is just amazing...

</comment><comment><USER32> I don't get this idea of sueing just for the sake of it, most of the times they just fall on there faces. Not a good tool to cut down competition. Its like pricking someone with a pin, you certainly annoy them but never actually accomplish anything.

<comment><USER33> At most I thought it was just a distraction technique or see if you can scare them. While you threaten the company with your lawyers and patents the top brass will have to dedicated some amount of time to fight it with their lawyers, figuring out which patents your infringing on, or what they can say to get rid of you.

If you're lucky you might get a settlement out of it. Otherwise you've slowed them down a little while they were distracted fighting your lawsuit.

<comment><USER34> Or it can influence your competitors toward a direction that you think is less harmful to yourself: [http://brainstormtech.blogs.fortune.cnn.com/2010/03/09/apple...](http://brainstormtech.blogs.fortune.cnn.com/2010/03/09/apple- talks-tough-to-handset-makers/)

</comment></comment></comment><comment><USER35> Yeah, Jonathan's the big stud who faced down Steve Jobs and Bill Gates. Those guys got nothing on him! Except the ability to run profitable companies.

<comment><USER36> In terms of IP, Sun had pretty big cojones ... while the number of patents they got was certainly smaller than Microsoft's, their arsenal touched practically anything you can think of in our field.

So yeah, he's the big stud who "faced down Steve Jobs and Bill Gates". If you want to critique something, disagree with what he's saying, since ad hominems add nothing of value and are insipid / rude / a waist of time for everybody reading.</comment></comment>


Facebook releases ResNeXt for image classification and object detection - <AUTHOR> https://github.com/facebookresearch/ResNeXt <comment><USER2> The main person behind Microsoft's award winning ResNet, Kaiming He, left for Facebook AI research last year. This work looks like it builds upon the previous work done on Residual Networks (ResNet).

</comment><comment><USER3> fun fact: if you inspect the properties of images hosted on facebook, you can see an html attribute for tags that Facebook has determined are in the photo (like "two people smiling," "pool", "outdoor party", "dog", etc).

As far as I know this isn't used for any user-facing features (yet), but it's there.

<comment><USER4> It doesn't seem to be really accurate. E.g., for a cartoon it says: "Image may contain: text".

<comment><USER5> Most of the image datasets are exclusively photo-based. (Definitely no anime in ImageNet, MSCOCO, SVHN, CIFAR etc.) I've noticed that many computer vision tools seem to do worse on drawings or cartoons. The other day I was putting together a dataset of anime headshots to try to generate them with WGAN, and needed to crop images down to just the faces; the usual OpenCV tools failed utterly, and I had to use an anime-specific face detection library.

</comment></comment></comment><comment><USER6> Does this do object detection as the title suggests? From the README, it seems like it only does classification.

</comment><comment><USER7> Does anyone know what is the current state of 3D object recognition using Shapenet for example? I imagine there must be progress on this in the AR industry.

</comment><comment><USER8> Awesome, I've tried to reproduce this paper's results to no avail, and had similar reports from other redditors.</comment>


Ask HN: Oprah's effect and scaling - <AUTHOR>

One of my customer's website is going to be mentioned on Oprah's Winfrey show in a few month. Anyone here has had any similar experience? What kind of traffic should I expect?
The website in question is a SAAS with no free account developed in Rails. What should I do to make sure it scales?
Since users of the website don't need to interact between each other, I was thinking of having one load balancer running nginx proxying to different nodes with each node having it's own database and application server.
I would hash the email address to chose the node to proxy to and then store that information in a cookie. So nginx would either look for a cookie, or an email address in the post data and proxy to the correct node accordingly. Otherwise, it would redirect the user to the login page. Does this approach make any sense?
I'm currently using rackspace cloud for this which gives me flexibility in terms of adding and removing instances but does mean that I have less raw performance than with a dedicated server...
Has anyone got any stories of this kind of exposure to share? <comment><USER2> Are you familiar with how middle-aged women actually use the Internet?

Step #1: Make sure you dominate rankings on "the Googles" for every conceivable way someone with half an ear on the television could mangle your name or category. She isn't going to product.com, she is googling for [product], [product.com], [products], [praduct], [pro ducks], [what was that thing on Oprah this morning?], etc.

Step #2: Expect less traffic than you think, because while Oprah's audience is ginormous they are in TV watching mode rather than browsing the Internet mode, and large portions are going to fall out of the funnel in a) trying to go to your website and b) doing so successfully. Oprah's peak audience is somewhere around 9 million people. If you're expecting 500k visitors to your website, I think you're being overly optimistic (absent Oprah literally doing a call to action on your behalf). So it isn't all that much worse than a Slashdotting, and you can expect the people to come in over a wider interval than "right the second the URL appears on the screen". Any reasonable website can chew through 500,000 visits spread over a 48 hour interval if it survives the initial bump.

Step #3: Scale the obvious bottlenecks and get ready to do some firefighting, though you probably won't need to. If the home page makes 10 SQL queries right now, a) fix and b) replace with static HTML for the day (or get a process in place where you can do that quickly if the server starts to chug). I'd put a big Welcome Oprah Viewers banner at the top of it with a sales pitch leveraging that social proof for all you are worth and giving them "special" advice for using the site, by the way.

Step #4: Have a backup plan. If it seems highly unlikely that you're going to survive, switch all or most users to a static site which explains that "due to overwhelming popularity" the service isn't available at the moment but you'll email them the second it comes back up if they just drop their email address into this MailChimp signup form. Do so. Give them an option from hearing from you in a less transient fashion, too. (I would strongly consider "Check if they're cookied for your site, if so let them in, if not give them the static pseudo-site" but that doesn't scale to the moon like "hello new client, here is index.html, bye" does.)

<comment><USER3> _I'd put a big Welcome Oprah Viewers banner at the top of it with a sales pitch leveraging that social proof for all you are worth and giving them "special" advice for using the site, by the way._

^^ This. You are in a unique position of being able to PLAN for a huge spike in traffic. While planning for the technology impacts are important, do NOT forget the business aspects. You already have a damn good idea of the demographics of more than 100k visitors that might be visiting that day, so get started now.

Do you want to offer a special "discount" for Oprah visitors that day? Does the signup process need to be simplified for less tech-savvy visitors? I definitely agree with Patrick that you want to have a targeted set of instructions or otherwise customized copy for the visitors that will come that day. Above all else, PLAY UP THE OPRAH CONNECTION! A banner, special icon, her picture, etc. Visitors should be smacked in the face early with some indication that they have found the site mentioned on Oprah.

You might also want to find any Oprah-related message boards and create accounts now. Then on the day the site is mentioned in Oprah, go to those message boards and post a clickable link. Not only will this help the visitors get to the correct site, but they can use it to share the correct link with OTHERS.

</comment></comment><comment><USER4> Oddly enough, I worked on a project that had a whole show dedicated to a site that I built. There were banner ads on Oprah's website and a bumper in the show with the URL on it.

My boss and I sat watching and waiting and we saw virtually no effect from the show whatsoever. (If you were just watching top on the servers without knowing Oprah was talking about it, you would have assumed it was any other day.)

We spent time theorizing why this was. We came up with the following:

\- The site that we built has a relatively long URL, so maybe it was hard to remember.

\- The bumper that the URL appear at was towards the end of the show, at which point we figured most stay at home moms/dads/people that watch Oprah were probably starting to get dinner ready.

\- I'm not sure that people that watch Oprah are the same people that eagerly sit in front of the TV with an iPad/laptop/etc.

Of course, your mileage may vary. If you're using Rackspace, I'd say you're in good hands. It may be worth mentioning to them when it's going to happen and seeing what they can do in case of sudden load, but for us it certainly wasn't the huge gush we were expecting/hoping for.

<comment><USER5> I had the same experience. We had a customer whose cookies were mentioned on Oprah and then Rachel Ray at a later date. We saw a bump in traffic, but the customer didn't warn us until a few days before air, so our recommendation was to leave the site alone rather than risk introducing changes that could produce bugs. We put a little time in to tweaking the site's error pages to be more friendly, but when the air dates came, nothing spectacular happened. We actually saw a little bit more traffic from Rachel Ray than Oprah, probably because cookies are a more relevant topic for her show.

</comment></comment><comment><USER6> In a previous life, I was half of the engineering team at a call center. On more than one occasion, one or another of our customers (always a different one) would call us and say that their product/service/organization/whatever was going to be "mentioned" on Oprah "next week", and could we please set up some extra phone-answering capacity for them in order to handle the inevitable spike in demand.

At first, we would try and accommodate their requests- bring in an extra operator or two, do a special answering script, etc. Besides being good customer service, we figured that increased usage on the part of our customer translated into more money for us, so it was worth spending some time on our end helping them get ready for a spike.

After a little while, however, we eventually stopped taking "Oprah-induced capacity panics" so seriously. Why was this? Because we never- not once- saw any serious spike in calls from any of our customers' Oprah "mentions".

I'd suggest planning for some extra capacity, just in case, but don't go doing too much special-purpose engineering work for this one customer. Unless, of course, their "mention" on Oprah is really more of a "entire episode dedicated to their product" kind of a deal- that might be a different kettle of fish entirely.

<comment><AUTHOR> It's more toward the side of the entire episode dedicated to the product than to the casual mention...

<comment><USER6> Hey, well, in that case, your mileage might definitely vary from what we usually saw. I suppose it's always a good idea to have plans for this sort of spike, Oprah or no...

</comment></comment></comment><comment><USER7> First off, congrats! I was in charge of the website when Oprah featured The Secret a few times on her show. Here's a few pointers from my experience.

1\. Remember the show airs in Chicago in the morning, then more than once across time zones, so this will be an all day treat. We had a lot of buzz (Oprah's own forums went down under load for our show), and our URL was displayed on the screen. Regardless, you can expect a lot of traffic, mostly during the show and a few days afterward.

2\. Your db will likely be your bottleneck. Make sure you don't have any unoptimized queries, or better yet, cache as much as you can so you're only hitting the db on writes for all the orders you'll be getting.

3\. If possible, offload static content to a cdn. Akamai saved us here, because the site was not optimized size-wise.

4\. What ultimately caused us issues was slow clients. I would definitely try to have a caching proxy up front. The snowball effect would cause us to tap out our 100Mb connection at times. Since you're using cloud hosting hopefully that's not a hard limitation for you.

5\. It's _really_ fun watching your bandwidth. I used a console tool called bmon. You'll be able to tell when commercials happen during the show.

6\. +1 for a backup plan. Have a static page ready that you can switch over to. I'd highly suggest having an alternate payment processor, even if you have to go with Paypal. Since you're SAAS, you can't rely on retail or Amazon, so you may not get visitors to come back if your site fails. Make sure you can capture those customers the first time.

7\. If you don't plan on having a free account, offer something so you can build your customer list and capture contact info. A whitepaper, newsletter, etc.

Have fun!

<comment><AUTHOR> Thanks a lot for the answers!

1\. Can you tell me approximately how many unique visitors you had during the shows? I'm kind of curious...

3\. We're using cloudfront... So you'd advise on using Akamai instead? or would cloudfront be ok?

6\. For payments, we're using Authorize.net (with the CIM feature to capture credit card information)... Hadn't thought that they could be a bottle neck but I'll definitely at least check up with them...

7\. Makes sense, I'll suggest that...

It'll be a fun few months preparing... I've been meaning to play around with Varnish, now's my chance :-)

<comment><USER7> 1\. Can't give you any real numbers, but dude, it's Oprah.

3\. Any cdn should be ok. You just want to offload those files to somebody else. Remember that browsers will only download a few resources from a single domain concurrently, so even if you have a subdomain for statics you'll get a faster page load. Hint: use yslow for more frontend optimization tips.

6\. Authorize.net can handle it--we used them. But if your shopping cart can't, it's always nice to have a Paypal 'buy it now' button ready to go. Not real elegant, but it's a backup plan.

<comment><AUTHOR> Thanks!

3\. I'm a big fan of yslow too... It's really great for that :-)

</comment></comment></comment></comment><comment><USER8> I have the lucky position of having to do scaling for not only Oprah, but american idol, the superbowl, x factor, inaugurations and more.

we have had artists on Oprah many times, probably a dozen in the last five years. It has nearly no effect. The largest bump we see is during the central timezone broadcast. The east and west code feeds have negligible effect unless you ask for it by doing an "expensive" call to action on the site. I define that to mean asking every user to do a db or server intensive task, like signing up for a site, logging in, commenting, etc. We generally avoid db writes during load events.

I would recommend a good cdn though and offloading as much as possible to them.

Incidentally the biggest impacts for us have been xfactor, american idol, glee, and the biggest was Tom petty on the superbowl. The only time I have ever watched it willingly.

</comment><comment><USER9> I think part of the tricky part in this is that, most likely, it has to scale up, but not at all gradually, and then scale back down too, in terms of costs, as the traffic dries up again. Good luck:-)

<comment><USER10> Amazon EC2 might be a good option.

</comment></comment><comment><USER11> A good approach could be to put all the static stuff (the sales pages, pricing info, everything that doesn't require backend) on 1 domain, and put that on S3 and Cloudfront. That definitely won't go down, and it will be fast and take the brunt of the load.

Then put the interaction stuff (the forms etc.) on a subdomain, and put that on heroku or whatever with plenty of servers.

</comment><comment><USER12> While I've never been on Oprah, I have had my startup featured (~8 min. segment) on a show on the CBC (Canada's national broadcaster.)

Hardly a blip in load.

We had a few more emails than usual offering "advice," though.

That said, it sounds like a good excuse to take a good look at your caching, landing pages, and conversion funnel. And, if you are worried about needing to scale fast, consider something like chef for automating infrastructure setup, so that even if you don't need it for Oprah, it's work that you'll use when you do need to scale.

</comment><comment><USER13> heroku?

<comment><USER14> Heroku is great. However, if you use some other system besides rails iself (like custom processes, things other than DJ for job scheduling or calling process that require root access from you app) you may find it will be hard to migrate. Otherwise it is a piece of cake.

<comment><AUTHOR> I hadn't thought about using them, I've had bad experiences before with engineyard's appcloud (mostly during their beta and because I needed to do something a bit more complicated than what they normally support out of the box, forcing me to play with custom chef recipes that started failing when they changed their base system)

But, yeah I think I should definitely check them out

</comment></comment></comment><comment><USER15> Inadequate phone support is possible failure point.

</comment><comment><USER16> maybe jhh will chime in here as he went through this exact situation @ the secret</comment>


Ask HN: How do you choose your weekend projects? - <AUTHOR>

Hi all,
I've been trying to come up with some kind of personal project for myself to do but quite honestly I'm hitting a wall - kind of like writer's block. I'm a 3rd year CS student so I have some programming experience, but nothing of the "make something from start to finish" kind. I've made small games in 24/48-hour competitions, and small things like a Boggle-solver or Tic-Tac-Toe to get comfortable in a new language, but I'm trying to think of something that's not a game nor a tiny project and that's harder. I know it's a big gap in my education and I want to cover it (I'm excited at the thought of developing something bigger, just having trouble thinking of what).
So, how do you choose what you code on your free time? Do you come up with your own projects? Do you contribute to open-source? Do you just make lots of small things? Or do you not have time for that sort of thing because you're working 24/7? (=P) <comment><USER2> Not really answering the question, but for quick fixes;

A friend of mine recently implemented an Enigma machine (i.e. for coding WWII messages - <http://en.wikipedia.org/wiki/Enigma_machine>) which he enjoyed and said was a great challenge.

Alternatively I've recently done Spotify's coding puzzles (<http://www.spotify.com/us/jobs/tech/>) - who knows, you could even get a job out of it!

<comment><USER3> I did one of Spotify's or Facebook's coding puzzles a while back, using 4 languages in the same source file and obfuscated my contact info in the response.

If their recruitment team isn't up to the task, I don't want to work there. :)

However, it was a fun exercise.

</comment></comment><comment><USER4> Here is how I do it:

1\. Find a pen. 2\. Find a paper or notebook. 3\. Sit down for 5 minutes. 4\. Write whatever idea comes to my mind in those 5 minutes. 5\. Review ideas. 6\. Pick the one I like best. 7\. Design it. 8\. Code it. 9\. Test it. 10\. Ship it.

Rinse and Repeat.

</comment><comment><USER5> All software couldn't possibly work perfectly for you....? So fix a problem you have or one you think you will have soon. Alternatively, go have a chat with a prof or business person or whoever and ask them what problems they would like solved.</comment>


Ask HN: How to Catch Bad Bots? - <AUTHOR>

I do part-time server admin & wonder how others monitor their webserver(s) for badly behaving bots like scrapers, DDoS, etc.  What tools & procedures do you use & follow? <comment><USER2> I appreciate your raising the question here, as maybe we can hear from people on front lines. There are, meanwhile, some interesting starting points at <http://en.wikipedia.org/wiki/DDoS#Prevention_and_response></comment>


Why David Byrne and Thom Yorke are wrong about the Internet - <AUTHOR> http://www.theguardian.com/commentisfree/2013/oct/16/why-david-byrne-wrong-spotify-thom-yorke

<comment><AUTHOR> Written by Dave Allen, the bassist in Gang of Four, and now a digital stategist.</comment>


Riak JS Lib, with implementations for Node.js & jQuery - <AUTHOR> http://riakjs.org/ <comment><USER2> Is Riak actually gathering steam in terms of real world production use, or is it just on gathering steam on HN!?

Serious question actually.

What's the real world use-case for this? How is security handled? If my browser was able to talk directly to my Riak cluster, all my data would be open?

<comment><USER3> We use Riak and are launching a limited beta soon. Not only is the product good, but the company is fantastic. They'll call you up to chat about anything you want even if you're not a paying customer. They recently opened an office in San Francisco and in the announcement on their blog said that you can literally stop by any time to chat about Riak, or anything else interesting. Too bad we're not in SF.

Riak doesn't have authentication or authorization built-in. It is on their radar. We have a light-weight backend for that stuff which doesn't know about most of our data. It obviously has to know about users, but other than that it just serves and stores JSON.

<comment><USER4> <http://news.ycombinator.com/item?id=1533664>

</comment></comment></comment><comment><USER5> Riak.. sounds good! Is this just an implementation of Chord (<http://pdos.csail.mit.edu/chord/>) with a REST API?

<comment><USER6> similar ideas but afaik riak draws it's lineage directly from amazon's dynamo paper, <http://en.wikipedia.org/wiki/Dynamo_(storage_system)>.

</comment></comment><comment><USER7> db.get('flights', 'KLM-5034')(function(flight, meta) { ... });

Is this a typo? Shouldn't it be:

db.get('flights', 'KLM-5034', function(flight, meta) { ... });

<comment><USER8> No, db.get() returns an anonymous function that takes a callback. The advantage to this type of api vs the one you mentioned, is db.get() can get more or fewer arguments, and callback is always last.

db.get() is a bad example, I'm not sure why you'd want to pass anything other than bucket/key to get an object. In this exact case, I imagine it's just for consistency with the rest of the API.</comment></comment>


What lengths did Microsoft go to keep the Surface a secret? - <AUTHOR> http://www.extremetech.com/computing/131418-what-lengths-did-microsoft-go-to-keep-the-surface-a-secret <comment><USER2> Maybe people's expectations of Microsoft are just so low that no one actually thought they'd try to compete.

<comment><USER3> This is the first time they've really done anything squarely in the personal computing hardware space. They've had peripheral devices, and the Xbox, but this is quite a bold new step for them. The thing is, they've not done it before. I'd expect them to make at least a few mistakes.

<comment> excuse-me It's not clear if they are actually intending to make this - or if like Google's Nexus phone it's really only meant as a development standard.

Back in the 386/486 days Intel used to make PCs which you bought to test your code on - but it didn't mean intel were getting into the Walmart space.

</comment></comment></comment><comment><USER4> > Give Microsoft credit here: the Surface is something different. If the > tablet itself doesn't convince you, then the innovative Touch Cover surely > does

Ahh, What about the Surface is "something different", _other than_ the Touch Cover?

<comment><USER5> So it's a tablet with an integrated stand and digitizer and new kind of case and a new operating system and you think there's nothing remotely different about it?

<comment><USER4> >integrated stand

Come on, it's a piece of plastic on the back. Overall, this is of low importance for a tablet.

>kind of case

I said _other than_ the case

> new operating system

Windows 8 isn't "new".. it just doesn't exist anywhere yet. All the OEMs will use it too.

I don't see anything to "give them credit for something different"

<comment> excuse-me This is a game changer for MSFT.

For the last 25years they have let the OEMs take the risk, whether Dell/HP/IBM win or lose in the market - MSFT gets it's revenue.

But this led to them losing control of the experience - as we saw with them watering down the "Vista capable" requirements to give OEMs a break on their cheap machines.

In the consumer market this really hurt them: Windows + crap $300 Walmart laptop = Windows is crap. At least in the mind of the consumer looking at Apple's shiny toys. So even if Windows 7 is a better or more capable OS than iPad the overall experience of a Windows7 Starter edition on a netbook certainly isn't.

Whether MSFT build this, or make OEMs step up their quality - the new game is that users experience has to be a lot better. unless MSFT want to try and live on declining revenues from Office licenses and MS-Server CALS

<comment><USER4> OK, so MS are changing the way Windows integrates with hardware. Cool.

I ask my original question:

Ahh, What about the __Surface __is "something different", other than the Touch Cover?

(as in, the device itself)

</comment></comment></comment></comment></comment><comment><USER6> Pretty sad considering it's going to stay a secret :-D

</comment><comment> excuse-me >Windows is the de facto computing platform, and there's nowhere else to go.

On the desktop but not on tablets. HP, Dell, Lenovo can just decide that they are going to continue shipping Windows7 on laptops and to corporates and ignore this.

MSFT can hardly tell them all it won't supply them with OEM licenses.

I suspect there will have to be a lot of pre-sales payments made to a lot of OEMs to persuade them to invest in Windows8 products.</comment>


How the 'Sunset Route' Railroad Helped Diversify California - <AUTHOR> https://www.atlasobscura.com/articles/sunset-route-railroad-los-angeles <comment><USER2> The impact of the transcontinental railroads far exceeded the dreams of even its most ardent supporters.

<comment><USER3> One of my ancestors worked for Southern Pacific (not a software, but a choo- choo, engineer). His family was able to live in affordable nowhere[1] because taking the train _was_ going to work.

Before becoming a telecom provider, SPRINT was "Southern Pacific Railroad INTernal" and allowed railroaders to chat long distance with cow-orkers without dealing with Ma Bell.

        And the sons of Pullman porters
        And the sons of engineers
        Ride their father's magic carpets made of steam

[1] Fun fact: Coalinga was originally "Coaling [station] A", retconned to sound more spanish. The spaniards themselves usually just named places after whichever saint's day it was when they first passed through. (Thomas Guides used to show rancho property lines in southern california; many of their borders go back to the original 18th century land grants)

<comment><USER2> I'd give up writing software to drive a steam locomotive.

<comment><USER4> If I didn't need the money. Software pays better. Other than that... _oh, yeah_.

</comment></comment></comment></comment><comment><USER5> Amtrak has a route guide for the present-day Sunset Limited, which also touches a bit on its history: [http://testsite.itworksdc.com/amtrakconnect_6_30/static/rout...](http://testsite.itworksdc.com/amtrakconnect_6_30/static/route- guides/Amtrak-Sunset-Train-Route-Guide.pdf) (not on Amtrak's official website because Amtrak inexplicably removed all their route guides)

<comment><USER3> "inexplicably removed" — if I have this correct, a big difference between here and the US is that here, freight traffic pays the passenger company to use their network. In the US, I believe Amtrak has to pay the freight companies to use their networks.

(a bigger difference is that one of the things we use our supercomputers for is to calculate a nationwide multimodal schedule that not only integrates trains, buses, boats, etc., but also differs minimally from the previous year's combined schedule. That'd probably run afoul of antitrust in the US)

</comment></comment><comment><USER6> True story: Sunset Magazine (which is still being published today) was originally published by Southern Pacific Railroad to attract newcomers to California - and to take the Sunset Route to get there.

<comment><USER7> If in bay area, the magazine has a long association with a ranch in Ben Lomond (Santa Cruz County) which is now a really nice state park, the ranch house itself open to public. The original publisher lived here while making the magazine etc.

[https://hilltromper.com/article/quail-hollow- ranch](https://hilltromper.com/article/quail-hollow-ranch)</comment></comment>


Yahoo Officially Rejects Offer - <AUTHOR> http://www.nytimes.com/2008/02/11/technology/11cnd-yahoo.html?_r=1&hp&oref=slogin

<comment><USER2> I love the sprinkling of items from Mr. Liddel's resume throughout the article:

a former banker from New Zealand

who calls himself Microsoft's "gatekeeper of funding,"

who joined Microsoft after serving as chief financial officer at International Paper, the giant forest products company

who plays rugby regularly and has completed several triathlons.

who sends e-mail messages to colleagues at all hours and is a PowerPoint whiz,

who has a master's degree in philosophy from Oxford

He has a background as an investment banker at Credit Suisse First Boston in Auckland.

</comment><comment><USER3> I thank Yahoo for this. The open source community should be thankful as well. Remember, Yahoo put a lot of effort into open source projects.</comment>


Google Search Change Tomorrow Could Cause 'Mobilegeddon' - <AUTHOR> http://news.sky.com/story/1468513/google-search-change-could-cause-mobilegeddon

<comment><USER2> Does this applies to PPC ads too? what if my website is not mobile friendly and google doesn't show me in organic results. Will they be following same for PPC too?</comment>


How to Get Bill Gates to Talk About You or Your Business - <AUTHOR> http://www.1netnews.com/bill-gates-talk-business/

<comment><USER2> The article doesn't actually tell you how to get Bill Gates to talk about you or your business and promises more parts to the article.

It uses a picture that Bill Gates took for a Reddit AMA and Photoshopped it so the Reddit Alien Snoo is out of the cardboard picture and Worldjunction.com is added in there instead. I sort of smell some sort of scam there.

It is almost like they are trying to tell you how to use social engineering to get Bill Gates and people like him to mention your name and your company. You'd be better off spending your own time promoting your own name and business by doing good things that get attention than hope to get Bill gates to mention you.</comment>