Internet Chemotherapy - <AUTHOR> https://ghostbin.com/paste/q2vq2 <comment><USER2> So, given that he might have prevented more damage than he caused, if even the part of the recent DDoS reduction can be attributed to his activity, what to make of it? It can be more of a judgement on society if this person ends up in jail, while IoT makers keep making hefty profits being rewarded for their negligence, and ISPs keep making profits being rewarded for lying to their customers when shit happens and causing more damage than he ever could overall.

It all seems to start and end with technical ignorance of the typical customer. There are popular shows that help pepople choose better food, by exposing shenanigans food makers engage in. Perhaps there could be something similar for tech in the future. Something where a hacker comes on TV and makes a total ridicule of some IoT crap device, and the show uses it to constatntly repeats the basics, like changing default credentials, etc. Same schema that works with food shows, expose someone as an example and add some generally useful advice. Perhaps this might become feasible when IoT is more popular.

<comment><USER3> _It can be more of a judgement on society if this person ends up in jail, while IoT makers keep making hefty profits being rewarded for their negligence, and ISPs keep making profits being rewarded for lying to their customers when shit happens and causing more damage than he ever could overall._

Masked comic book vigilantes aren't ever going to be a reality on the mean non-virtual streets of cities but on the Internet it seems we're confronted with something pretty much equivalent.

So here can consult all the old issue of Marvel and DC for a compendium of moral dilemmas and result.

<comment><USER4> >>Masked comic book vigilantes aren't ever going to be a reality on the mean non-virtual streets of cities

Unbelievably, this is actually the case in Seattle.

<comment><USER5> TIL: [https://en.wikipedia.org/wiki/Phoenix_Jones](https://en.wikipedia.org/wiki/Phoenix_Jones)

</comment></comment></comment></comment><comment><USER6> Mudge mentioned on his Twitter account ([https://twitter.com/dotMudge/status/941373739681189888](https://twitter.com/dotMudge/status/941373739681189888)) that a project like this had been requested in the DoD but was held back by politics.

Victor Gevers is cited by Bleeping computer ([https://www.bleepingcomputer.com/news/security/brickerbot- au...](https://www.bleepingcomputer.com/news/security/brickerbot-author- claims-he-bricked-two-million-devices/)) as saying there are better ways of solving the problem than forcibly disabling/bricking devices. I'm curious what those are, though, since IoT manufacturers (speaking broadly) don't seem motivated right now to take even basic security precautions with their devices. I know some groups use sinkholes to redirect compromised devices, but while that can be useful for research it doesn't seem like it has the same motivational impact for change.

<comment> FLUX-YOU So the DoD wanted to brick devices instead of just declaring companies making these devices a threat to national security, banning their products from sale, and setting a good precedent?

:|

Would the intel community really need a botnet like this to operate?

<comment><USER7> The thing is that the largest consumers of these devices aren't within the US.

Many of them are from Chinese companies and are being sold throughout Southeast Asia and South America.

</comment></comment></comment><comment><USER8> [https://www.deccanchronicle.com/technology/in-other- news/171...](https://www.deccanchronicle.com/technology/in-other- news/171217/how-addictive-is-minecraft-it-led-people-to-create-the-mirai- botnet-for-business.html)

"Paras Jha, Dalton Norman and Josiah were also a part of this normal Minecraft server entrepreneur game until they decided to force players from other servers on to theirs by clogging their networks. Therefore, Mirai came into existence and started performing for them very well. However, Mirai started outperforming the creator's expectations, affecting the Internet outside Minecraft badly."

"The creators of Mirai found potential in the botnet and therefore went on to fine-tune it to improve its abilities. They even started leasing Mirai to other cybercriminals, who used them around the world for their own vested interests."

[https://en.wikipedia.org/wiki/Mirai_(malware)](https://en.wikipedia.org/wiki/Mirai_\(malware\))

"Upon infection Mirai will identify "competing" malware and remove them from memory and block remote administration ports."

From an evolutionary perspective its an interesting example of 'fitness'

<comment><USER9> Malware can be reasonably described using evolutionary mechanism (similar to Memetics), AVs and best practises create a evolutionary pressure in which only the fittest and most aggressive malware can win out. A lot of things in computer science and/or on the internet behave in ways not to dissimilar to evolution

</comment></comment><comment><USER10> My main feeling about all this is that "let it burn" probably is the only way to deal with the mess. It must have been pretty obvious from quite early on that trying to fight blackhats on level field as a single individual is not sustainable, and the time that he has been buying is in no way enough to employ the major cultural shift needed to improve the landscape. Attempting to suppress the attacks seems just to make people complacent, so it might be better just to let the attacks to do their damage and hope that those spur some improvement.

<comment><USER11> This is how the forests of California dealt with fires before humans started fighting them.

As humans fought fires, there was a buildup of flammable material in the forests, making each successive fire incrementally worse.

<comment><USER12> I was using this exact same analogy to explain this to someone earlier, although I have to admit that I agree with the person above. Going out and starting forest fires in national forests without official government sanction, even if your intention is to create controlled burns and prevent a bigger fire will still land you with a verdict of arson.

<comment><USER13> If there weren't any forest rangers/firefighters organization to back-burn, then the lone person trying to do some good may be the only way forward. But for forest fires, such an organization does exist, and no-one should be burning by themselves.

There is no such organization for the internet. So we are left with lone white-hats who risk personal safety to do some good. I wish there's a better way.

</comment></comment></comment></comment><comment><USER14> If it's true then this is fantastic work. Should really be the responsibility of the government. If a device is compromised it should be disabled.

It could also set up a pretty nice incentive structure. If a device is bricked due to a vulnerability, then the manufacturer should have to either repair or refund the device. Corporations will not respond properly until it impacts their bottom line.

<comment><USER7> > If it's true then this is fantastic work. Should really be the > responsibility of the government.

Imagine the public backlash there would be if people knew that the government was scanning and hacking devices for the purpose of national security...

As backwards as it seems I think people like the story of a rogue hacker more than the government protecting them.

<comment><USER15> >Imagine the public backlash there would be if people knew that the government was scanning and hacking devices for the purpose of national security...

/s ?

If so, chortle chortle.

</comment></comment></comment><comment><USER16> This guy is a hero. He bricked vulnerable device before they could be used for DDOS, or worse. And he did it at great risk to himself. I say well done.

The one point I disagree with is _blaming the consumer_. The simple truth is that security protocols have terrible UX, and until that improves nothing will change. Personally, I think it's time IoT was regulated and, in particular, we require a secure protocol at the time of deployment: IoT devices must be provably wiped, and then put into physical contact with an "owning" device before deployment. This, in turn, requires that people start using what I call a "Home Brain", a device who's primary purpose is to coordinate and secure all other devices that you physically own. I imagine simple versions to be as sophisticated as a router, and hackers might want to put together their own, something like a little home theater box. I suppose in a pinch your smartphone could work, too.

</comment><comment> hi-im-mi-ih Do not execute the random, obfuscated python code linked to from this paste. This could be bait, and could PWN you. This must be audited first before anyone runs it.

<comment><USER17> Obfuscated python, asking everyone to run it? Hah. Good one. Perhaps if you run it in VMWare which runs in Virtualbox which runs in Qemu... and even then. Never run such stuff bare on a machine you intend to still use afterwards.

The irony, if running code from a post from the Brickerbot author would brick your laptop...

<comment><USER18> Just spin up an aws t2.nano...

</comment></comment></comment><comment><USER19> From [https://twitter.com/GossiTheDog/status/941462338233946112](https://twitter.com/GossiTheDog/status/941462338233946112) :

 _Before anybody else sends me the "Internet Chemotherapy" link or retweets it - it appears to be a wonderful piece of fan fiction. Deutsche Telekom suspect was arrested earlier this year, key details wrong, TR069 modem stuff was bad implementions crashing devices etc._

(I haven't confirmed this myself)

<comment><USER20> Wrong person, those are different incidents

<comment><USER21> Can you elaborate?

</comment></comment></comment><comment><USER22> There are technical solutions for these problems, but nobody will adopt them.

There are political solutions for these problems, but nobody will vote for them.

There are social solutions for these problems, but nobody wants to take responsibility.

Personally I'm waiting for a power plant to explode after someone runs a fuzzer on the internet. And for the inevitable law making security research illegal. And propaganda claiming foreign nations or terrorist organizations instigated the attacks (instead of bored 14 year olds, the more likely cause) used to support new pointless wars. And the intellectually flaccid xenophobic public, clamoring for more jobs and Internet-dependent TVs, fervently supporting it.

But it could be worse.

</comment><comment><USER7> I do regular scans myself and the number of these vulnerable DVR devices, printers, and routers you find exposed out there is mind-boggling!

Run just a single instance something like this [1] (which isn't even well optimized) and within minutes you'll find vulnerable devices. It shouldn't be that easy to build a botnet.

[1] [https://github.com/wybiral/dex](https://github.com/wybiral/dex)

<comment><USER17> Your readme doesn't say much. Looking at the scanner.py code, it appears you just send a GET HTTP/1.0 request and see what comes back. How do you determine vulnerable devices, response headers with versions?

<comment><USER7> The response headers are kept in a SQLite db that you can perform regex queries on. It's surprisingly easy to find particular devices based on the headers.

And, yes, it's just making basic HTTP requests on port 80 so it's overlooking tons of devices. But I run this from my own devices and doing blast scans of ports other than 80 can look a bit suspicious.

</comment></comment></comment><comment><USER23> This made a brief previous appearance: [https://news.ycombinator.com/item?id=15931325](https://news.ycombinator.com/item?id=15931325). You guys will have to figure out what to make of it.

<comment><USER24> And I'm still wondering why that got flagged while this got 100+ comments so far...

<comment><USER23> Who can fathom the mystery. That sort of wondering is an async call that will never be called back.

</comment></comment></comment><comment><USER25> If what this person says is true, this kind of stuff is really dangerous and can get you in jail, even if your intent was just to show potential exploits. I wonder if this person's real identity is one anyone's radar currently.

</comment><comment><USER26> Im sure free market man is going to save us. Any second he will plunge through the clouds, his invisible fist coming to save us all..

<comment><USER27> Free market man isn't out to save people, he's out to adjust the market to be most profitable. Suffering is more profitable than not-suffering.

</comment></comment><comment><USER28> This is the situation we put ourselves in by constantly complaining that we can't move _fast enough_ and hiring "talent" straight from coding bootcamps. Brace yourselves, the time to eat your own dogfood is coming! :^)

<comment><USER29> The devices in this story - routers, cheap IoT devices, etc - aren't products of bootcamp-hiring buzzword-spouting Silicon Valley companies, though. They come from a long tail of decades-old mid-sized electronics businesses with, AIUI, low margins and cultures that don't value software highly. It's not about JavaScript hipsters (for once!); this is much more related to the situation with terrible automotive software.

</comment></comment><comment><USER30>
        I'm sorry to leave you in these circumstances, but the threat to my own
        safety is becoming too great to continue. I have made many enemies. If
        you want to help look at the list of action items further up. Good luck.

This sounds scary - like it came straight out from a movie

</comment><comment><USER31> that's a lot of text; could be be used to analyze the authors writing style and match it to public {github, twitter,...} profiles

<comment><USER32> Aren't people specially concerned to keeping anonymity already keen to this by now?

The author can be deliberately mimicking style or going through translation in order to avoid this kind of analysis.

</comment></comment><comment><USER12> What evidence is there that this really is the person responsible for brickerbot?

<comment><USER33> Someone with more knowledge may be able to corroborate events, or verify the authenticity of the payload he posted.

For what its worth, the name rang a bell and I found this: [https://gizmodo.com/this-hacker-is-my-new- hero-1794630960](https://gizmodo.com/this-hacker-is-my-new-hero-1794630960)

The writings seem similar, for what little thats worth.

<comment><USER34> It's the same person.

<comment><USER12> You're saying this editor is the hacker or that he fabricated this text? Would he really know enough to sound that credible? If not someone on here should be able to see right through it

</comment></comment></comment></comment><comment><USER35> Pretty much the only important part of this (tremendous!) message is the bit at the end:

> "The real point is that if somebody like me with no previous hacking > background was able to do what I did, then somebody better than me could've > done far worse things to the Internet in 2017."

One person.

<comment><USER36> Yeah, that gave me a pause too.

Then again, he might not have a "hacking background" but might have a strong embedded/networking background so he knows where to look, considering how he found exploits that blackhats missed.

So either he's that good or blackhats are two-bit[0] criminals.

[0] No pun intended.

</comment></comment><comment><USER12> If you aren't a doctor and you start poisoning your friend with cancer's food does it really count as chemotherapy?

<comment><USER37> This is a question of credentials only. Which I don't mean to sound like I'm dismissing it at all - It's actually the whole reason this guy's effort got stranded.

Chemotherapy is essentially controlled killing, to mitigate or prevent uncontrolled killing. Just like (as someone said elsewhere in this thread) controlled burning is done to mitigate or prevent uncontrolled burning. And here we have controlled hacking to mitigate uncontrolled hacking.

Society doesn't support anybody killing, burning, or hacking, unless there's a way to know and recognize, that the person knows what they're doing. Which (the knowing and the recognizing) is a credentialing problem. It's the only difference between (doctors, police, firefighters, cybersecurity experts) and (quacks, vigilantes, arsonists and some-unknown-hacker), respectively. A guy I don't recognize as a surgeon, is just a masked man coming at me with a knife, _even if he actually is a surgeon._

If your intentions are good, you should take the trouble to get some kind of credentials, which can take many forms. (If your intentions are not-so-good then it makes a lot more sense to bypass that, but also for the public to put you in the "untrusted" basket.) This guy bypassed credentialing, and that places him in the realm of those who are not trusted no matter what kind of good they do. Now he can't continue. Instead of that, imagine there was a public debate about the relevant issues and this or a similar effort had actual public consensus and resources behind it.

Now of course I'll grant there are numerous problems with the political process and consensus-building and all the rest of it. It takes a long time to get anything done, and learning how to hack is actually the easy part. Good news: This is actually not the emergency he claims it is. What's the worst- case scenario, the whole internet goes down tomorrow? Well, it's only the internet. There are ways of getting food, water and shelter without using a network at all. Nobody has forgotten how to use pen & paper. Even blankets will still work without an internet. (Not if these IoT clowns have their way of course.) Whatever, don't listen to me, I'm older and I lived almost half my life quite happily in a world where nobody had the internet, yet still everything got done.

Anyway, the other thing is, a "state of emergency" is how all sorts of atrocities and shitty decisions are justified by governments, so it's not something to emulate. The attendant issues deserve to be publicly recognized, debated, decided and then tackled. Maybe it's wishful thinking to demand that much from people today.

<comment><USER12> > This is a question of credentials only.

And credentials are merely a way to build consensus around what is due process and who can determine it. The net effect is the same, but the process for achieving it is without consensus. This is another example of no proper channels existing, and individuals taking matters into their own hands.

<comment><USER13> > individuals taking matters into their own hands.

aka vigilantism. Sometimes it's required, but it signals that a proper channel should exist for such purposes.

<comment><USER38> but they don't. Would it be better if this person just tried to negotiate with notoriously unhelpful bureaucrats while blackhats run amok?

<comment><USER12> I actually agree with you to some extent. Its unfortunate this person has to become an outlaw though.

</comment></comment></comment></comment></comment></comment><comment><USER18> > You can download the module which executes the http and telnet-based > payloads from this router at > [http://126.96.36.199/mod_plaintext.py](http://220.127.116.11/mod_plaintext.py).

Link's not working. Anyone got a copy?

<comment><USER39> just found this: [https://github.com/JeremyNGalloway/mod_plaintext.py](https://github.com/JeremyNGalloway/mod_plaintext.py)

edit: I would recommend extreme caution with that file. I'm still reading, but strings like this are worrying:

        'busybox cat /dev/urandom >/dev/sda &'

<comment><USER40> Fascinating.

What's up with all the stuff like "if 81 - 81: ..."? Won't that just evaluate to false and never run?

<comment> marten-de-vries Exactly. It's there to (very mildly) confuse you.

</comment></comment></comment></comment><comment><USER41> We as humans are pretty bad at responding to threats proactively. It takes some damage before we'll take action. In this case, IoT devices are going to have to take down some major infrastructure before we start regulating them.

</comment><comment><USER42> The site either went down or was removed, is there an archive anyone knows of?

<comment><USER43> [https://archive.fo/RTVpt](https://archive.fo/RTVpt)

</comment></comment><comment><USER44> This guy knows he's in trouble for what he's done and decides to rewrite history to make himself out to be a "good criminal". Re-framed bragging about his criminal exploits and hilarious (in his mind) escapes from detection ensue.

Frame it as ISP "conditioning" or as "criminal attack", fact of the matter is he committed crimes and now he's feeling the heat so he's putting out re- framed confessions to get the jump on his accusers and try to save his skin.

Then again, people can be more complicated than I give them credit for, and he might actually be a good hacker. It has happened before. I don't know. Let the investigators find out the truth. We have no reason to trust him.

</comment><comment><USER45> Any tools someone can recommend for de-obfuscating this?

<comment><USER2> There's no noteworthy obfuscation, aside from weird names of variables.

<comment><USER46> What's the point of obfuscating then?

<comment><USER39> Clean exploit code could be used maliciously (or accidentally) by people that might not understand the true nature of the program. There is a tradition when releasing exploit code to obfuscate it or introduce obvious errors that make the code safe{,er}. This prevents script kiddies from immediately using it, while anybody who _should_ be reading the code should be able to see through the obfuscation/errors.

<comment><USER45> I suppose a better question might be, then, does anyone have any resources for gaining a better understanding of how this exploit works?

<comment><USER2> Most of the value is in the data (common login credentials). The bulk of obfuscated code is probably stuff doing the network communication and perhaps some other mundane stuff, that you can do manually (over telnet, or whatever) if you like and don't care about creating a botnet.

</comment></comment></comment></comment></comment></comment><comment><USER47> I suspected something like that from the beginning

</comment><comment><USER48> > his/her/hir

Stopped reading there.

</comment><comment><USER49> So apparently I am the only one who think that device manufacturers shipping unsecure devices is not an excuse for an unrelated third party to damage it?

The same as the fact I did not lock my door do not allow anyone to rob my home, that I did not replace my fire detector batteries is no excuse for anyone to set it alight, etc.

To me good security starts by catching this guy and if he had done the damage he claims he had then make him pay for it.

Only when one had been hold accountable for what he has done should we go after companies for negligence, no?

"I discovered this security hole then proceeded to exploit it and damage some random system/workflow for the sake of demonstration" should not be acceptable.

<comment><USER50> I want to add that I am not sure yet what my position on this is. But I think your analogy is not correct - and please feel free to correct me if I am wrong!

Imagine the following scenario: Manufacturer's sell weapons cabinets to people. Only weapons cabinets are not hidden in your home, instead they are put out on the street. And now comes the dangerous part: These weapon's cabinets do not lock. Because the manufacturer decided that locks are not necessary. If someone comes along, should he just ignore this or should he make the weapons unusable? Because that is what these devices will be used as: weapons.

<comment><USER51> My analogy would be he is welding them shut.

</comment></comment></comment><comment><USER52> From the linked document:

> Deutsche Telekom Mirai disruption in late November 2016. My hastily > assembled initial TR069/64 payload only performed a 'route del default' > [...]

AFAIK this is not what happened. Deutsche Telekom had one major incident on November 27th 2016, but that incident was caused by a denial of service attack [1]. Given that the routers in question don't even run Linux, 'route del default' is not really an option anyways, making the first claim of the story likely to be fabricated.

This seems to be a good fictitious story, but nothing else.

[1] [https://comsecuris.com/blog/posts/were_900k_deutsche_telekom...](https://comsecuris.com/blog/posts/were_900k_deutsche_telekom_routers_compromised_by_mirai/)

<comment><USER53> Linux isn't the only is with 'route'

</comment></comment><comment><USER54> The Host Identity Protocol (HIP) is the answer to this, and many more problems. We do not need to disable the dangerous devices if we can have an _identity based network_ which allows us to whitelist the nodes we allow to interact with our devices. HIP would also allow mobility to work properly, and would render the network too opaque to efficiently spy upon. The Internet is incomplete: It is missing an Identity layer ... HIP!</comment>


Ruins of forgotten empires: APL languages (2013) - <AUTHOR> http://scottlocklin.wordpress.com/2013/07/28/ruins-of-forgotten-empires-apl-languages/ <comment><USER2> What's changed since the last time this was posted: APL is now generally free. J[1] is GPL. The newest version of k is closed-source, but still freely available for personal use from shakti[2], and there is also an independent AGPL implementation[3]. Dyalog APL[4] is closed-source but free for personal use; and, finally, GNU APL[5] has always been open-source, but it's matured quite a bit. Whatever your choice, you have a freely usable option.

1: [https://www.jsoftware.com/](https://www.jsoftware.com/)

2: [https://shakti.com/](https://shakti.com/)

3: [https://bitbucket.org/ngn/k/src/master/](https://bitbucket.org/ngn/k/src/master/)

4: [https://www.dyalog.com/](https://www.dyalog.com/)

5: [https://www.gnu.org/software/apl/](https://www.gnu.org/software/apl/)

<comment><USER3> For anyone with even the slightest curiosity or desire to learn APL:

Please check out J!

J's "labs" feature is probably the single greatest resource for learning APL there is right now, aside from being instructed in person. Some of them in the current versions of J are even from Ken Iverson, one of the most brilliant people to have influenced computer science, Turing Award winner, former Harvard professor, and of course, the person who first brought APL to the rest of the world. Most of the new ones were written by people who are _also_ brilliant.

There are even iOS and Android apps if you have bits and pieces of free time that aren't really suited to taking out your laptop or desktop, and they're fully-featured, including a web server, the stuff needed for dataviz, labs, everything, really.

</comment></comment><comment><USER4> A very nice introduction for mere mortals to J is here:

Fly Straight, Dammit!

[http://www.petecorey.com/blog/2019/08/12/fly-straight- dammit...](http://www.petecorey.com/blog/2019/08/12/fly-straight-dammit/)

and here:

A Shallow Introduction to the K Programming Language

[https://web.archive.org/web/20130801233812/http://www.kuro5h...](https://web.archive.org/web/20130801233812/http://www.kuro5hin.org/story/2002/11/14/22741/791)

</comment><comment><USER5> A thread from 2015: [https://news.ycombinator.com/item?id=9707075](https://news.ycombinator.com/item?id=9707075)

Discussed at the time: [https://news.ycombinator.com/item?id=6115727](https://news.ycombinator.com/item?id=6115727)

</comment><comment><USER6> The comments are descriptive.

</comment><comment><USER7> Added to my bookmarks, thanks. I especially respect the guy after he lashed out at the PC virtue signaller in the comments. How insufferable do people need to get to bitch about gender in an article about programming languages?

<comment><USER8> Really respectable, to claim not to want "oversensitive swine" reading his work and in the same thread to be so offended by a comment about his use of language as to reply with

> You may now go fuck yourself with a carrot scraper in whatever gender-free > orifice you have available.

Regardless of belief about the appropriateness of phrases like 'real men', I reserve my respect for people that don't resort to dehumanizing name-calling at the insinuation that they may have said something wrong.</comment></comment>


Show HN: Vim-clutch - <AUTHOR> https://github.com/alevchuk/vim-clutch <comment><USER2> This is ridiculous and totally awesome.</comment>


'Dirty hack' restores Cluster mission from near loss - <AUTHOR> http://www.esa.int/esaCP/SEMTI34TBPG_index_0.html

<comment><USER2> Intriguing story, but more detail would be nice here.

<comment><AUTHOR> I did spend 10 minutes looking for more back-story but none to be found. I'm guessing the original chatter about this would have been on ESA intranet groups rather than out in the open…</comment></comment>


US appeals court says Tinder Plus pricing is discriminatory - <AUTHOR> https://www.engadget.com/2018/01/31/us-appeals-court-says-tinder-plus-pricing-is-discriminatory/ <comment><USER2> To save everyone a click, here is the entire text behind the link:

They say all's fair in love and war, but those that have used Tinder will probably disagree. And that includes Allan Candelore, a man suing the dating app over the pricing of its premium service, Tinder Plus. Candelore and his lawyers argue that charging $9.99 a month to users under 30, and $19.99 a month to those over 30, is age discrimination, and violates two California laws: the Unruh Civil Rights Act and the Unfair Competition Law.

Tinder co-founder Sean Rad said, "Our intent is to provide a discount for our younger users", and while a lower court agreed with him, a California appeals court reversed the decision in a lengthy statement that suggested "some older consumers will be 'more budget constrained' and less willing to pay". Then, in a "how do you do, fellow kids?" move, the court concluded its opinion on the previous ruling with "Accordingly, we swipe left, and reverse". It's not yet clear how this judgement will affect pricing in the future -- we've reached out to Tinder for comment.

<comment><USER3> And here is the actual opinion PDF:

[http://www.courts.ca.gov/opinions/documents/B270172.PDF](http://www.courts.ca.gov/opinions/documents/B270172.PDF)

</comment></comment><comment><USER4> In Norway they also use price discrimination, but not necessarily on age.

I have to pay double compared to my friend, even though we're the same age.

This is likely illegal, Tinder support never respond to me when I ask why I pay a different price. I'm considering to launch a complaint with the consumer ombudsman when I get the time.

</comment><comment><USER5> Next up: student discounts and senior discounts.

<comment><USER6> Right? This seems like an impossibly sweeping judgement. If it were allowed to stand, would the AARP itself be forced to allow anyone to join? [I just checked and they no longer have an age requirement.]

<comment><USER7> AARP hasn't enforced any age requirement they have/had for many years. I know quite a few young members, they join for the discounts. Discount/frugal blogs also mention this fact pretty often.

I in my 30s, don't have an AARP membership, but have the AARP credit card (it's a good card!). It says it's "designed for AARP members" but doesn't say AARP membership is required. I just left the AARP membership number blank on the application and Chase was cool with that.

So, in practice at least, AARP is open to all, it's just not well known/advertised.

<comment><USER8> "AARP" also now stands for "AARP" and not "American Association of Retired Persons." They "changed" the name more than 15 years ago. The focus is not necessarily on retirees anymore. The current TV commercials seem to be in an office setting. The "age" to join is now 50.

If you don't own a car, the AARP discounts seem to be the same as AAA.

</comment></comment></comment></comment><comment><USER9> > Our intent was to provide a discount for younger users.

Let me get this completely straight. Netflix can deliver unlimited views of thousands of tv shows and movies for $10/mo. Spotify lets you stream 30 million songs. Amazon can get physical packages to your doorstep in two days. Google can spin up a server in a data center for you.

But Tinder requires $20/mo. It must be cripplingly expensive to store all of those photos and biographical text fields. I can't even imagine the size of the data they store, it must be _terabytes_. And the engineering behind _swiping_?

<comment><USER10> ? The COGS for most software approaches 0 pretty rapidly, so it's just as arbitrary that Spotify charges $10/month for a premium subscription.

The price of software (and any good, theoretically) is rarely priced based on expenses.

<comment><USER11> Both Spotify and Netflix have to pay a large chunk of that to the copyright holders.

</comment></comment></comment><comment><USER12> Serious question: why are senior discounts not illegal then? Does anyone know? Quick Google search was unenlightening.

<comment><USER13> Not the answer to your question but just another data source:

Courts have barred companies from negatively discriminating against older job applicants but not against younger job applicants for not being experienced enough.

The best theory/argument I could come up with is: "The elderly or infirmed have reached the end of their productive capacity and even if they wanted to earn more money to afford something, they couldn't. Young people OTOH could."

Conspiratorial theory: Judges are older and power structures always chose laws that favor the power structure.

<comment><USER7> I hate to be picky but this is not quite accurate.

Absolutely nothing to do with judges.

The Age Discrimination in Employment Act of 1967, which was passed by _Congress_ and signed by _the President_ , is what prevents age discrimination against people over 40. According to the EEOC it does not apply to people under 40, so baring any local or state laws, employers are free to discriminate based on age for younger employees/applicants, not just for being inexperienced. In my experience, its not even an uncommon practice either, I've met a few employers who have had floor ages for their employees due to (perceived) immaturity in younger employees.

As far as the reasoning, it's stated in the act itself:

(a) The Congress hereby finds and declares that-

(1) in the face of rising productivity and affluence, older workers find themselves disadvantaged in their efforts to retain employment, and especially to regain employment when displaced from jobs;

(2) the setting of arbitrary age limits regardless of potential for job performance has become a common practice, and certain otherwise desirable practices may work to the disadvantage of older persons;

(3) the incidence of unemployment, especially long-term unemployment with resultant deterioration of skill, morale, and employer acceptability is, relative to the younger ages, high among older workers; their numbers are great and growing; and their employment problems grave;

(4) the existence in industries affecting commerce, of arbitrary discrimination in employment because of age, burdens commerce and the free flow of goods in commerce.

(b) It is therefore the purpose of this chapter to promote employment of older persons based on their ability rather than age; to prohibit arbitrary age discrimination in employment; to help employers and workers find ways of meeting problems arising from the impact of age on employment.

<comment><USER13> Thanks for including that. I had forget about that the act. My point still follows, power structures will always write laws that favor them over others.

</comment></comment></comment></comment><comment><USER14> Reading the headline, I thought for a second that they were charging higher user fees to fat people...

[Disclosure: I'm not a Tinder user, but fat]

</comment><comment><USER15> This seems silly to even let this get to a court. How could this possibly be cheaper than changing the prices and settling?

<comment><USER16> If I was Tinder and I made discount price for young people I would not want to "settle" with someone who sued me because they felt "discriminated against".

Age discrimination is real, but this is not an instance of it IMO.

<comment><USER7> This is absolutely is, literally, age discrimination. I think you're confusing "not discrimination" with "not illegal," "not uncommon," "not something I personally care about," or "not something I personally think should be illegal."

The real question/issue is is it _illegal_ discrimination? Something can be discrimination but not _illegal_ discrimination.

<comment><USER17> Well, at least one judge says "Yes".</comment></comment></comment></comment>


Bitcoin Foundation hit by resignations over new director - <AUTHOR> http://www.reuters.com/article/2014/05/16/us-bitcoin-foundation-resignations-idUSBREA4F02B20140516 <comment><USER2> I'm sure I am overlooking something obvious when I say this, but I never thought a foundation model (at least, as executed) made sense for Bitcoin in the first place.

The whole point of Bitcoin is decentralization, removing the requirement for trust, etc. The idea of a centralized foundation vested with representing, effectively, the entirety of "Bitcoin's Interests" strikes me as diametrically opposed to that concept. The members of the foundation have various interests that may or may not be in keeping with the spirit of Bitcoin, and such an organization provides perfect cover for re-making Bitcoin in their image.

This first occurred to me when the foundation became the de facto spokesbody in response to Congressional and regulatory inquiry. How did these self- appointed people suddenly have the right to decide what regulation, etc. was acceptable to the whole of the Bitcoin community?

Surely, there needs to be some advocacy. But, it seems that such advocacy would take a more radical, de-centralized, democratic form that is more akin to Bitcoin itself.

<comment><USER3> I think what's important is having some way to pay Gavin and a few others. The rest of it really doesn't matter, and can be done in a decentralized way.

In fact, I'd be a lot happier if the organization employing the core devs didn't have an active policy position at all.

</comment></comment><comment><USER4> Aaah yes, I seem to recall that Fucked Company published an amusing animated piece about the story of DEN, Marc Collins-Rector, Chad Shackley and Brock Pierce's sordid past, a decade or so ago... Now where did that SWF file go...? Oh yeah:

DEN - The Untold Story: [http://www.swfcabin.com/open/1400285657](http://www.swfcabin.com/open/1400285657)

Even today, it's still totally relevant to the BitCoin Foundation:

"The Internet is basically one big pyramid scam. Those who get in on the top get rich. Those who get in at the bottom get fucked. So, do you want to get rich, or do you want to get fucked?"

</comment><comment><USER5> Bitcoin Foundation !== Bitcoin

I have no clue what this foundation about, who are these people, but still can use bitcoin (or any altcoin really.) I guess this news article is for general public who might think Bitcoin Foundation have some kind of stake at this technology or something.

<comment><USER6> The Bitcoin Foundation is the non-profit trade organization responsible for development of the core protocol & Bitcoin client libraries and advocacy of the Bitcoin protocol itself. Think of it like the Linux Foundation, Python Software Foundation, or W3C - its job is to coordinate and advocate for the technology itself, because everybody in the ecosystem benefits from that. So yes, you can use Bitcoin without caring about the foundation, but future development of the protocol, including most of the interesting stuff surrounding smart contracts and apps. It's somewhat unfortunate that it doesn't have the buy-in of many leading players in the Bitcoin ecosystem (and your comment is evidence of that), because that indicates a possible leadership vacuum and fragmentation in the near future.

<comment><USER7> tl/dr for the js inclined:

Bitcoin == Bitcoin Foundation

</comment></comment></comment><comment><USER8> I really don't understand. Why resign, but rather fix the issues within.

<comment><USER9> Crypto currencies are all about high decentralization. As time goes on, more and more people involved in Bitcoin realize the assignment of power to a central 'authority' is perceived to be a 'very bad thing' as it relates to direction and consensus building within the market.

Simply put, the foundation shouldn't exists in its current form. A handful of Bitcoin entrepreneurs doesn't represent the interests of ALL MANKIND'S need for various levels of computed trust. In effect, a foundation's job would simply be pushing a PR agenda for the movement. You don't need to waste effort or, more importantly, time in electing a board to go hire a PR firm.

My plan is to put together a basic marketing plan, go peddle it to a few top PR firms, and then let them take it and run with it. Because it's Bitcoin, the marketing campaign can be crowdsourced, even to the point the ads themselves contain QR codes for keeping the ads running. Imagine a Bart splash campaign at all the stations, with QR codes to track the funding and length of time they run. You could check on the funds and donate if you wanted to keep it going.

Anyway, it's all about marketing in the new economy. We don't need a foundation. We need traditional marketing and, frankly, some crisis marketing thrown in for good measure.

<comment><USER10> As long as Gavin holds the key to the 'panic button' for the entire network (which I don't think is necessarily the worst choice), he will have slightly more power over the direction of bitcoin than anyone else.

<comment><USER11> What exactly is the panic button? Google didn't yield answers to that question

<comment><USER10> [http://en.wikipedia.org/wiki/Gavin_Andresen](http://en.wikipedia.org/wiki/Gavin_Andresen)

It's a key built in to the network that essentially gives him the power to broadcast a special alert signal to the network. I'm not actually sure if most clients are equipped to interpret these signals now, though.

[http://bitcoin.stackexchange.com/questions/583/what-is- the-a...](http://bitcoin.stackexchange.com/questions/583/what-is-the-alert- system-in-the-bitcoin-protocol-how-does-it-work)

edit: I should clarify it's built into the original satoshi client, not necessarily 'the network' and certainly not the blockchain. Someone on bitcointalk explained it as "part of the peer to peer overlay and not part of the blockchain. You can find this public key in the source code of the official client if you look."

</comment></comment></comment></comment></comment><comment><USER12> This is exactly why Bitcoin's future is in great doubt and uncertainty. And probably remain that way for years to come.</comment>


Engineered symbionts activate honey bee immunity and limit pathogens - <AUTHOR> https://www.technologynetworks.com/immunology/news/engineered-bacteria-could-bee-saviors-330179 <comment><USER2> As a beekeeper who loses half his hives every year, I can definitely say that Colony collapse is caused by varroa mites. You can easily see them on the bees. I have tried all kinds of treatments for varroa.I don't want to argue with those who are convinced that pesticides cause colony collapse, but I am certain, for me, it is varroa.

I am waiting for this treatment is available. I spend a thousands of dollars a year to restock my bees.

<comment> bjelkeman-again Could it be that the colony is less able to handle pressure from varroa because of other stresses, like pesticides? We use several methods in combination to deal with the varroa.

If a colony has too much after the winter we treat with ApiGuard, and the honey produced during the period is marked for winter feed. We do drone larvae cutting (not sure that is the terminology used) and treat with oxalic acid before the winter. We let them winter on at least 50% honey.

We have lost one colony in the last four winters, that was wintering on sugars alone. We overwinter three four colonies normally. So we are just hobbyists and our methods may not scale.

<comment><USER3> Some have argued that taking honey and replacing it with sugared water is bad for the bees immune system and general health. There was a very small scale study if you even can call it that, but I cannot find the article about it anymore.

Since taking honey hasn't been this deadly before, some form of infection seems plausible and the mites would fit here. As far as I know they are primarily feeding on fat reservoirs of bees. Are there any signs of varroa on the dead colonies?

<comment><USER4> > Some have argued that taking honey and replacing it with sugared water is > bad for the bees immune system and general health

It'd be pretty hard to believe that it wasn't bad for the bees health.

<comment><USER5> The real question is how different is it from true nectar. They produce honey by preserving nectar in the first place. Of course even if they were given true nectar as a replacement directly (an ironic subversion of their job) it could theoretically cause issues from not being properly "preprocessed" or lacking the lead time to make a batch for their own consumption.

Just because sugar water isn't a good basis for humans doesn't neccessarily apply to bees - giving a cat a salad is not healthy for them and they will probably not be happy.

<comment> bjelkeman-again Honey contains lactic acid bacteria [1], which has proven to work as an antibiotic agent in scientific test[2]. Suger do not have that. Honey contains many other things, like pollen, that suger doesn't.

[1] [https://www.sciencedirect.com/science/article/pii/S094450131...](https://www.sciencedirect.com/science/article/pii/S0944501310000042)

[2] (In Swedish) [https://kurera.se/mjolksyrabakterier-i-farsk-honung- kanske-m...](https://kurera.se/mjolksyrabakterier-i-farsk-honung-kanske-mer- effektivt-an-antibiotika/)

</comment></comment></comment></comment></comment></comment><comment><USER6> Neonicotinoid pesticides are the likely culprit. Companies that produce them have been sinking large sums of money into studies that search for alternative explanations, and responses that don't simply consist of eliminating neonics.

[https://theintercept.com/2020/01/18/bees-insecticides- pestic...](https://theintercept.com/2020/01/18/bees-insecticides-pesticides- neonicotinoids-bayer-monsanto-syngenta/)

<comment><USER7> France banned those pesticides more than a year ago, but their rates of colony collapse did not go down, if anything they went up.

So neonicotinoid pesticides are probably ruled out as the culprit.

<comment><USER8> The replacement is probably just as bad. I've seen industrial scale pesticide application in the U.S. Doesn't matter what you're spraying, it's going to cause Problems in the quantities that they use.

</comment></comment></comment><comment><USER9> From listening to talks by Paul Stamets, it sounds like there might be a correlation between colony collapse disorder and lack of fungi / destruction of the old growth forest in a given area, a place where sensitive fungi can grow and thrive. Bees feed on mycellium/fungi, the fungi suppresses other bacteria, at least as far as I understand it. I wonder how much that's been tested by actual beekeepers.

<comment><AUTHOR> Post a link?

<comment><USER10> [https://www.nature.com/articles/s41598-018-32194-8](https://www.nature.com/articles/s41598-018-32194-8)

From the abstract: "Extracts from amadou (Fomes) and reishi (Ganoderma) fungi reduced the levels of honey bee deformed wing virus (DWV) and Lake Sinai virus (LSV) in a dose-dependent manner. In field trials, colonies fed Ganoderma resinaceum extract exhibited a 79-fold reduction in DWV and a 45,000-fold reduction in LSV compared to control colonies."

Stamets has tons of talks on YouTube, a lot of them have the same content in them and anything after 2016 might have the bee story in it.

Looks like he plans to start selling these feeders this year, which is good news!

[https://fungi.com/pages/bees](https://fungi.com/pages/bees)

</comment></comment></comment><comment><USER8> Is this gene drives? Do inoculated bees behave differently or make a different honey? Does it only affect one species of bee? How many species are they going to test? Did they examine bees over the entire life cycle, or just adults? Does this bacteria occupy an existing niche?

<comment><USER11> They did not use gene drives. Also, no one uses gene drives in applications, except to study gene drives explicitly.

</comment></comment><comment><USER8> USE LESS PESTICIDES AND THE BEES WILL COME BACK FFS

<comment><USER12> Details here: [https://theintercept.com/2020/01/18/bees-insecticides- pestic...](https://theintercept.com/2020/01/18/bees-insecticides-pesticides- neonicotinoids-bayer-monsanto-syngenta/)</comment></comment>


It doesn't fucking matter - <AUTHOR> https://medium.com/@thedannorris/it-doesnt-fucking-matter-391a399c7caa <comment><USER2> I feel like I see this a lot in general. People fret over the details, when ultimately what matters is just that it works. No, I don't care if we use a builder factory or a factory builder, I just care that it won't crash and shits legible.

<comment><USER3> Fretting over micro-optimizations is always easier than hard work. That's why people spend more time researching the optimal workout plan than actually exercising.

</comment></comment><comment><USER4> Maybe it's because we're technical people, we lose too much time on details (I'm certainly guilty of that), trying to preemptively optimize, adding unnecessary complication layers or be worried about "scaling", and especially when embracing the "unicorn or bust" SV mentality.

The _core_ objective is to make something of value to _someone_ and he probably doesn't care if you used a simple PHP file [1] or the latest buzzword framework.

[1] [https://twitter.com/levelsio/status/938707166508154880](https://twitter.com/levelsio/status/938707166508154880)</comment>


Hacking: The Art of Exploitation, 2nd Edition, Jon Erickson - <AUTHOR> http://www.amazon.com/Hacking-The-Art-Exploitation-Edition/dp/1593271441

<comment><AUTHOR> A good book that actually discusses hacking and not just a few exploits.</comment>


Why I Cancelled My Oculus Rift VR And You Should Too - <AUTHOR> http://pixotale.com/story/20953465/

<comment><USER2> To be fair, the phone in the cardboard costs more than the rift, especially if you're using something like an HTC one, etc...</comment>


French supermarkets banned from throwing away and spoiling unsold food - <AUTHOR> http://www.thinkerspost.com/2016/11/french-supermarkets-banned-from.html <comment><USER2> This is frankly worrying, as I suspect authorties are underestimating the complexity of an issue, or just chose to ignore it, mostly for populist motives.

It seems to me that food nowadays is ridiculously cheap, and I'm pretty sure everyone would agree this is a good thing. Now, I'm no expert but the only way I can explain it, is that we produce a lot of food, so much that we can't sell it all.

People who work in food distribution are pretty smart, and they must have good reasons to destroy food before throwing it away (bleach is not free after all).

As often, I fear this measure is an other attempt from a government to fiddle with an industry it does not understand.

And again, this strikes me as populist. Because frankly, in France poor people don't starve.

<comment><USER3> Agreed. Not throwing away food presumably means needing to preserve it and donate it to a food kitchen (or similar) right?

If that's the case, what are the resources required to: preserve the food before donation; deliver the food to the donation point; cleaning up food that spoiled before it can be donated?

Maybe they did a study on that and showed that the costs were really low -- a small fraction of the profit margin. In that case it might not be as bad, but I doubt such a study was done.</comment></comment>


Who owns the moon? A space lawyer answers - <AUTHOR> https://theconversation.com/who-owns-the-moon-a-space-lawyer-answers-99974 <comment><USER2> Space law school better be on the moon</comment>


VPN services blocked in Sri Lanka as information controls tighten - <AUTHOR> https://netblocks.org/reports/vpn-services-blocked-in-sri-lanka-as-information-controls-tighten-RAe2blBg <comment><USER3> Looks like it's mostly DNS-based. Meh. But still, this underscores the importance of operating your own VPN if you want to maintain comms through the silly twitches of a gov't like this. The biggest VPN providers are the first to be targeted. Even just having an SSH host outside the country will do fine.

On another note, I recently set up a Tor bridge with pluggable transports to help those in choked areas. It was a fun homelab challenge, and a good way to spread my privilege of having a free connection.

<comment><USER4> A VPS with a simple SSH server on a nonstandard port, maybe with some port knocking if you think you might be scanned or targeted by accessing from the offending country will do the trick just fine, keeping things reaaaally low profile.

<comment><USER5> >simple SSH server on a nonstandard port, maybe with some port knocking if you think you might be scanned or targeted by accessing from the offending country will do the trick just fine, keeping things reaaaally low profile.

Sounds like security theater. Using port knocking isn't going to hide the fact there's a SSH connection between you and some server. If anything, having a non standard configuration (non standard port number or port knocking) makes you more suspicious.

<comment><USER6> I think you overestimate the desire, motivation and technical capability of sri lankan ISPs to start doing netflow analysis and DPI on individual subscribers' end user connections.

Unless you were to attract the attention of somebody in government, and they forced an ISP to escalate an issue to the 3rd or 4th tier of network engineering running the core of the bigger ASes there, they're not going to be doing that. It's not the chinese GFW.

<comment><USER7> Not only this, but there's a massive difference between stopping people from accessing the web via VPNs and stopping people from SSH'ing into their servers. You block SSH access and you're probably going to take a financial toll Country wide.

</comment></comment></comment></comment></comment><comment><USER8> It's actually infuriating this ban. I'm from SL, currently on Nord VPN which hasn't been blocked by 1 of the major ISPs. Both major ISPs are aggressively blocking standard open vpn traffic however. I'm not entirely sure how since this is not my knowledge domain but a default open vpn setup on digital ocean (even on port 443) results in a timeout when contacting the server

I don't understand why one ISP is still allowing Nord and express vpn through. If anyone is open to debug this and help create a work around I'd love help. Feels like a good time to test things.

In the meantime people are using dubious vpn providers and are opening themselves up as easy targets. I dread what would happen if a malicious party created a vpn with malicious intent and then spent some bucks on targeted advertising in SL on the app stores.

This block is such a shit move really. It's become the gov's default crisis time response in the name of national security.

<comment><USER9> OpenVPN, like many other VPN protocols, does not have censorship resistance as part of its design goals. So, I'm guessing that its traffic patterns are quite easy to detect.

You should have better luck with something like Shadowsocks, or even better, Shadowsocks over a SSH tunnel. There are probably better and more potent alternatives that I'm not familiar with. If you just want to do regular web browsing, a simple thing to try is to just use "ssh -D" for a SOCKS5 proxy and configure your browser to use the proxy.

Also, a possible first step in debugging is to run the same server setup in the same country as the client and see whether it allows you to connect to a domestic server. If it doesn't, it's probably a problem with your client/server setup as the state's firewall probably doesn't need to block domestic VPN connections.

<comment><USER8> Thanks. I'll be taking a look at tunelling soon. The material around it is difficult to read and put together to be honest.

I'm right now using Nord via their ovpn files. Somehow it made its way through one ISP ruleset.

For my digital ocean box, I asked someone else to use tunnelblick with the ovpn file I provided them to see if it worked (they were in another country) and it worked. This makes me believe it's most likely a country level issue.

In general though I'd like to learn about networking more thoroughly and set up a censorship resistant option which I can help others to setup and share as well later on. Any primers/pointers are appreciated too. I'll start with all the things you mentioned though.

<comment><USER10> I suggest looking into WireGuard [1]. I found it easier to use than OpenVPN, and I think it will displace it as the de facto standard when it eventually gets merged into the Linux kernel. You'll have to use lower-level configuration tools to get started with it, which I am finding helpful to pursue the same goal of learning about networking more thoroughly.

[1]: [https://news.ycombinator.com/item?id=17659983](https://news.ycombinator.com/item?id=17659983)

<comment><USER11> While like Wireguard a lot, it won't displace Openvpn completely, for the simple reason that it only works over UDP, and cannot work over TCP, unlike Openvpn.

<comment><USER12> Transforming generic layer 3 datagrams into traffic that looks like something else is the general domain of obfuscation. Making WireGuard traffic look like TCP is one form of such obfuscation. Making it look like TLS or DNS or HTTP are other forms. (Actually putting layer 3 traffic into framing inside a legit TCP stream is inefficient and the wrong way to think about the problem domain.) No promises, but I'm expecting some nice things to come in this domain of generic obfuscation mechanisms to punch through various forms of filtering.

<comment><USER11> Inefficient as it may be, it is something I simply need for my use case - connecting home from a certain network which only allows outgoing connections on a handful of TCP ports.

<comment><USER12> No. You need your traffic to look like TCP, for your particular network filtering. But you do not need to achieve that by using the naive and inefficient approach of, "stick the packets into a TCP stream prefixed by a length field." Rather, there are more clever tricks for making your traffic look like TCP, which generally fall into the same realm as other obfuscation mechanisms.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER13> They've also banned drones.

[https://www.thehindu.com/news/international/sri-lanka- bans-d...](https://www.thehindu.com/news/international/sri-lanka-bans-drones- unmanned-aircraft-after-bombings/article26940849.ece)

</comment><comment><USER14> Nothing a personal shadowSOCKS server cant handle. It works with the great firewall and theres no way Sri Lankas filter is stronger than Chinas.

<comment> abc-xyz Speaking of shadowsocks, I really feel sorry for the author.. I believe his final words were "I hope one day I'll live in a country where I have freedom to write any code I like without fearing"

<comment><USER15> Can you share more on this?

<comment> abc-xyz This is the HN thread from the time: [https://news.ycombinator.com/item?id=10101469](https://news.ycombinator.com/item?id=10101469)

His GitHub went quiet after that, but as wiremaus points out, he seems to be alive and well based on his twitter posts.

</comment></comment></comment></comment><comment><USER16> Legitimate question: what do they hope to achieve by this?

<comment><USER17> Sri Lankan here.

Historically, the people here have engaged in "knee-jerk" violence following an initial inflammatory incident; see:

[https://en.wikipedia.org/wiki/Black_July](https://en.wikipedia.org/wiki/Black_July)

[https://en.wikipedia.org/wiki/2018_anti- Muslim_riots_in_Sri_...](https://en.wikipedia.org/wiki/2018_anti- Muslim_riots_in_Sri_Lanka)

In the second incident listed above, social media was used both as a vector to spread hate speech and misinformation, and also to help mobs organize.

Regarding the current social media block: at the start, I felt this to be reasonable, as it made sense to slow the spread of misinformation/hate speech for a couple of days, until people's emotions cool down. However, the blocks still continue - and I see no clear justification for continuing them for so long.

<comment><USER17> Update: social media isn't blocked anymore. Six days in total - <USER2> enough, I think.

<comment><USER18> Any form of limiting speech is an attack on the principles of a healthy nation. State-wide censorship is never reasonable.

</comment></comment></comment></comment><comment><USER19> Privacy idealist hat on.

I believe there's a lot of potential for CDNs and major sites to offer anti- censorship pass through traffic with HTTP/2 via CONNECT. By having a multiplexed protocol with multiple streams that spans "normal" traffic and tunneled traffic, it should be harder to identify. This would allow major sites or CDN providers to provide service to those people behind such bans and possibly require governments to break a significant portion of the web in order to institute those blocks. I think it's valuable to increase the damage done by government blocking so we can ensure that mainstream persons are sufficiently upset by this conduct. I also think CloudFlare and other major CDN providers should be the ones to provide this type of VPN access either as a product or as a special case offering for people in countries who censor the web.

I realize there are many businesses who wouldn't damage their primary offerings to provide such a secondary service. But it only takes one or two companies to increase the collateral damage of the bans, and thus make them much more costly for the governments imposing them.

<comment><USER20> [https://blog.cloudflare.com/1111-warp-better- vpn/](https://blog.cloudflare.com/1111-warp-better-vpn/)

Cloudflare also built and opensourced a rust implementation of wireguard which will likely back the service [0], but unfortunately, they didn't collaborate with upstream.

[0] [https://github.com/cloudflare/boringtun](https://github.com/cloudflare/boringtun)

<comment><USER19> Yeah, I'm specifically pointing to the idea of leveraging HTTP/2's multiplexed streams to embed VPNs into the same connection as normal web traffic from CDNs. Things like 184.108.40.206 Warp don't attempt to hide the fact that they're a VPN and thus wouldn't really help with what I'm talking about.

</comment></comment></comment><comment><USER21> Blocks like this are why I always recommend friends overseas to not use a VPN for which they've ever seen an advertisement. The small guys offer performance that's just as good and the big guys having ten times the number of servers doesn't help when their whole list can be blocked in an instant.

</comment><comment><USER22> You can route around VPN blocks by using something like Ghostbear which uses _obfsroxy_ and is similar to Tor's meek pluggable transport [https://help.tunnelbear.com/hc/en- us/articles/360007243291-G...](https://help.tunnelbear.com/hc/en- us/articles/360007243291-GhostBear-Fight-censorship-on-restrictive-networks)

</comment><comment><USER23> [http://www.defence.lk/new.asp?fname=Public_Requested_to_Iden...](http://www.defence.lk/new.asp?fname=Public_Requested_to_Identify_Terrorist_Suspects_20190426_02)

</comment><comment><USER24> A VPN service that cannot be blocked: [https://www.tunnelhero.com](https://www.tunnelhero.com) been using this guys in China l, turkey and UAE works like a charm.</comment>


Reading Online - <AUTHOR> http://www.readingonline.org/articles/art_index.asp?HREF=/articles/r_walker/ <comment><USER2> Interesting. I'm definitely able to scan the example text far faster using this mention.

This tool would help me understand some of the over complicated text that's in my school books. I think it would have the opposite effect on any book with a less complicated writing style.

<comment><USER3> Seems like a format you would want to be able toggle to when you get bogged down.

</comment></comment><comment><USER4> I feel like (after looking at examples and so on) this actually makes it _harder_ to read quickly. Maybe a 9th grader can concentrate easier on this stuff but I skim text _a lot_ and this just seems annoying. And don't even get me started on the wasted space, I can't imagine a web app with any amount of copy on it using a style like this.

</comment><comment><USER5> For samples, see: <http://liveink.com/>.

I find it somewhat disingenuous that they use a more readable font in a larger text box to show off their supposedly more readable format.

</comment><comment><USER6> Some things probably don't need to be dumbed down. I've been reading the old fashioned way as long as I can remember and it seems to be working just fine :)

<comment><USER7> I bet that's what the monks said to the guy that invented the space.

</comment></comment><comment><USER8> Very nice. Now where's the free web app to cut paste and convert into this format?

<comment><USER9> It would be best as a bookmarklet _a la_ readability.

</comment></comment><comment><USER10> Looks vaguely Pythonic. :)

</comment><comment><USER11> This has vast potential in the language-learning space for people wanting to break into foreign literature.

I'm currently learning a language, and at times I get bogged down in long- winded sentences until someone (kindly) lays out the sentence structure in this type of a format. Then it all makes sense (and is a great aid in learning). No English required.

</comment><comment><USER12> I believe this web site itself should be presented in VSTF.

</comment><comment><USER13> This is a typographic nightmare. Not only does it make for a choppy comprehension of the reading, but it also turns the text block into an awkward, unappealing shape.</comment>


Never use any language feature that describes itself as "Smart" or "Magic." - <AUTHOR> http://www.expatsoftware.com/articles/2008/05/no-magic.html

<comment><USER2> The logical conclusion of this article is that we should all design our own transistors, and program our apps in terms of the circuit that will execute them. That way nothing will trip us up along the way!

My reading of the article was "I didn't know how to use Hibernate or ActiveRecord, but I tried anyway, and they didn't work right." Yeah, that's the software's fault, not yours. Riiight.

As for magic_quotes, the problem was it was too general, not that it was too magical. Have you ever written this:

       run_query("SELECT * FROM foo WHERE foo=?", "'bar'")

Congratulations, the "'bar'" is magically quoted! It works because you are specifying exactly what you want quoted and why.

All in all, this has got to be one of the worst articles I've ever read in my life. And that is saying a lot.

<comment><USER3> Really? Do ads for transistors describe them as "smart" or "magic"?

The idea here is not that abstractions are bad, it's that those that are frequently described by the people who made them as "smart" or "magic" are often not very helpful, and tend to do more harm than good. There are some exceptions, but _good_ abstractions, while they may be described as "smart", don't usually include that in their name, and are rarely if ever called "magic".

<comment><USER4> Neither ActiveRecord nor Hibernate have the words "smart," or "magic," in their names. They were bad examples.

The problem is not with these two packages, but with the developers who use them without taking the time to figure out exactly what they do. Just because something makes a task convenient or easy, does not mean you aren't required to understand how they work.

It's copy/paste, cargo-cult programming, and you can't blame the tools.

<comment><USER5> I like Rails and ActiveRecord just fine, so I don't meant to bag on it. But they do talk _a lot_ about "magic" in the Rails community. Check it: <http://www.google.com/search?q=rails+magic>

<comment><USER4> If this blog entry is just a restatement of "there is no silver bullet," then I agree. However, you can't blame the tools or their authors for what some people in the user community claim. The root of the problem is clearly a combination of lack of understanding and laziness.

</comment></comment></comment></comment></comment><comment><USER6> I would extend this law a little: if you're going to perform magic, it had better be absolutely flawless.

Otherwise, show what you're doing, or don't do it at all.

<comment><USER7> I agree. This fits with Joel's law of leaky abstractions. Imperfect magic is dangerous. Perfect magic is wonderful.

[http://www.joelonsoftware.com/articles/LeakyAbstractions.htm...](http://www.joelonsoftware.com/articles/LeakyAbstractions.html)

Rails pluralization rules are an interesting example, they leak--I have to know about exceptions, but they're consistent enough that they, in my opinion, just pass the threshold. Nearly-perfect magic is most tolerable when dealing with structure, not data and when the magic's imperfection is consistent, repeatable, and documented.

<comment><USER8> Interesting example indeed. I'd say they are a perfect illustration of a feature that, in the words of the article author, "[tries] to abstract out some behavior that is not that hard to deal with anyway".

<comment><USER9> Worse, pluralization in Rails is a feature that fixes something that isn't even a problem. For a framework based on 1 to 1 table mapping, there's absolutely no reason the tables names shouldn't directly map to the class names with no translation at all. Customer class equals Customer table. Pluralizing them is pointless, and creates minor problems that didn't exist prior.

This article however, is extremely bad and its arguments simply don't make sense. Magic isn't bad, leaky abstractions + developers who don't understand it are bad. If he think ORM's don't solve a problem then he hasn't written enough SQL to tire of the insanity of doing it manually when CRUD should clearly be automated because it's so god damn repetitive. Repetition + boredom should always be a signal to automate.

<comment><USER10> Ah, but you make the mistake of assuming that automated SQL generation == ORM. That's not the case, at least for us.

I touch a bit on the framework we use at Expat here:

[http://www.expatsoftware.com/articles/2007/03/examplecode- pr...](http://www.expatsoftware.com/articles/2007/03/examplecode- productioncode.html)

Basically, you can think of it as an early-bound Rails. We use CodeSmith to generate a bunch of classes, stored procedures and unit tests based on the existing database schema whenever we make a change to it. Those classes, along with generated wrappers for all our hand-built stored procedures get compiled into the project. This saves us from ever having to guess what SQL we'll get for a given operation, and allows us to pause at any point and be looking at readable code that does real, undestandable work and that can be debugged through.

That may seem like a minor distinction, but then I bet you've tried debugging thru ActiveRecord once or twice and I doubt it was any fun. This way, we keep the same fast development pace that a traditional ORM might give us, without sacrificing the debugability and maintainability side (or relying on Magic happening behind the scenes.)

<comment><USER9> Nope, been there, done that, doesn't change my point at all. Automation is automation whether it's at build time or run time, it's still better than doing it by hand. Having been down the path of code generation, I'll take runtime reflection every time, or better yet, switch to a language that doesn't prevent abstraction. The need for tools like CodeSmith just screams how bad .Net languages are, and I know, I'm a full time .Net programmer. I've managed to rewrite one of our main products in Smalltalk where the language just works and you never run into the need to generate masses of code.

</comment></comment></comment></comment></comment></comment><comment><USER11> I remember Yegge calling Java's "smart" for-loop the "stupid" for-loop, and for good reasons.

<http://steve.yegge.googlepages.com/next-big-thing>

</comment><comment><USER12> Using PHP's magic_quotes_runtime as an example can support pretty much any argument you want to make about software design choices. How about this: Don't rely on DWIM-style features to actually do what thought you meant. Just write what you mean.

Or, shorter: "Garbage in, garbage out."</comment>


Researchers at Johns Hopkins solve puzzle of how we learn - <AUTHOR> http://hub.jhu.edu/2015/10/26/researchers-discover-mechanics-of-learning <comment><USER2> Can't wait to see how this will be applied to general AI.

<comment><USER3> Eligibility traces? Had those in Reinforcement Learning for at least 20 years...

See chapter 7 of The Book:

[https://webdocs.cs.ualberta.ca/~sutton/book/the- book.html](https://webdocs.cs.ualberta.ca/~sutton/book/the-book.html)</comment></comment>


Use of AI to increase debt collection - <AUTHOR> https://thinkml.ai/boost-collections-and-recoveries-using-machine-learning-p2/ <comment><USER2> I don't know a lot about this use of AI, but I do know that the modeling phase is similar to some other work I've been a part of. I do know that the statement that this is a lot of data to collect is certainly true. Some of the engineered variables used here are interesting as well.</comment>


Barnes & Noble to stop making Nook tablet - <AUTHOR> http://paidcontent.org/2013/06/25/barnes-noble-says-it-will-stop-manufacturing-nook-tablets-in-house-e-readers-live-on/

<comment><USER2> I guess I would be surprised less if I hadn't already dumped the OS and switched over to Cynogenmod months ago after determining that the only benefit I was getting was access to a single magazine subscription. As a generic Android tablet it makes a great device. Sadly I only know one Nook owner who still runs stock OS on their device.</comment>


Getting to your first 100 customers - <AUTHOR> https://www.heavybit.com/library/video/getting-to-your-first-100-customers-and-beyond/ <comment><USER2> Really like how she just spreadsheets it and lays it out for everyone

<comment><USER3> Here's the spreadsheet if you want to plug in the numbers from your own company

[https://docs.google.com/spreadsheets/d/1nohO_8S1X1G_1b-iv912...](https://docs.google.com/spreadsheets/d/1nohO_8S1X1G_1b-iv912C2bmV_G5jpmd9HAeRwVqPtw/edit?ts=58952617#gid=1300415760)</comment></comment>


Guile - The Failed Universal Scripting Language - <AUTHOR> http://lists.gnu.org/archive/html/emacs-devel/2010-04/msg00538.html <comment><USER2> If you look at guile's history up to 2007 or so, it might indeed look like a failure. But since then, development has been taken up again, and progress is amazing. Andy Wingo did a lot of the work and has been blogging about it at wingolog.org, see especially his talk about the recent developments: [http://wingolog.org/archives/2010/04/02/recent- developments-...](http://wingolog.org/archives/2010/04/02/recent-developments- in-guile).

Guile now has significantly improved performance, a compiler, and it can run JavaScript and Emacs Lisp besides Scheme. The 2.0 release is around the corner. Things look good.

<comment><USER3> He's on HN, BTW: <http://news.ycombinator.com/threads?id=wingo>

At this point, though, for me anything that is not BSD licensed is a non- starter. I'm not that much of a license zealot for other things, but for programming languages I think it's pretty important. A lot of the value in a language comes from having lots of users (and thus libraries, support, etc...), so cutting off people who want to include it in a proprietary product seems like a bad idea.

<comment><USER4> Guile has a "linking exception", explicitly permitting you to include the interpreter/compiler in a proprietary product. You do still have to release any changes to _Guile itself_ you make, but that seems like a pro rather than con for popularity of a language, since operationally-different commercial forks with no source available are hardly the sorts of things that give a language value. The intended case, where you just embed the interpreter as-is and use it as the scripting language for your app, is perfectly fine to do from proprietary apps.

<comment><USER3> I'm just not convinced that the "proprietary fork" thing happens that often in languages to justify a license that scares people who only have a superficial understanding of it. For example, Tcl has had plenty of problems, but companies doing that was not really one of them, despite its popularity, and despite being included in a wide range of proprietary products.

<comment><USER5> The sad thing is that it is a bad business decision to not submit changes back to an open source project. If your company makes a change, the best outcome for the original project to adopt the code and assume the cost of maintaining the code. The worst (most costly) is your your company maintaining a fork. Never mind the loss of recruiting opportunities.

<comment><USER3> Agree completely: which is why I wouldn't worry about 'proprietary forks'. For almost any reasonably popular language, the community version's progress will quickly outstrip almost any company's version. If the company's smart, they'll try and stay as close as possible to the original, submitting patches and so on.

</comment></comment></comment></comment></comment></comment><comment><USER6> Huh. Well, that's me (Tom Lord). So, what can I add here for HN?

Some of the comments talk about Andy Wingo's good work and leadership in recent years. I agree. Of course, Guile was once my baby, long ago, complete with sleepless nights and other trappings of nervous parenthood. Consequently, I see almost all of the big technical changes made to Guile recently as The Wrong Way. But that's a purely personal, emotional reaction; objectively I see that he's doing good work.

Guile failed / stalled for a few years there. It's a bit hard to talk about why. I'll say a few words about it and also point to a link with a an alternative telling of the same tale.

Guile got started after some earlier, failed attempts to write a Scheme extension language library for Scheme. There were two earlier attempts that I know of: one called "revoc" (read it backwards) and the other had no name but happened as part of an early GNU spreadsheet project.

I went to work for a start-up that, then, had something like 30 employees. It was an unusual start-up for its day for the software part of all of their products was free software. The Linux kernel didn't exist when the company was founded and it barely existed when I first started at that firm.

The firm was Cygnus, of course. Back then it was called "Cygnus Support".

Cygnus got it into its collective head, for a short period of time, to build a general purpose user interface toolkit for writing GUI apps -- and to make this GUI toolkit Scheme-based and to write GUI apps that were architecturally similar to GNU Emacs, but with fancier graphics and interaction. Building that thing was to be my job.

To save time I started with Aubrey Jaffer's Scheme implementation called SCM. I forked SCM and began radically modifying it to make it more useful as a library and to add various desirable features. I wrote a C library for Guile to give it a generic window system interface, providing an X11 implementation of that library. Towards the end, I had much of the heavy lifting of the toolkit done and perhaps another 6-12 months before a real product. In my toolkit I even had a basic Emacs-like program except with features that Emacs lacked at the time like support for multiple-font text and proportionally spaced fonts. It was kind of neat because nearly all of the redisplay code, and all of the code for "text widgets", was written in Scheme - and yet performed reasonably well on even the slow machines of the time. It was a very "hackable", fun, toolkit.

Alas, there were political problems. The sales staff at Cygnus, especially, were displeased that the project was taking so long: they had been hoping to have GUIs to show at trade-shows mere months after I started. The famous "Tcl Wars" happened and that led to some political infighting within Cygnus. Cygnus was seeking a next round of VC funding and there was pressure to cut the Guile project from the budget. Most annoyingly, my boss at the end showed me a contract he'd negotiated to help fund Guile work and asked me to approve it. I felt that the contract had some severe problems and would need to be fixed before I could agree to it - he'd negotiated it without any input from me. The next day he signed the contract. About a week later I felt duty bound to quit (because of the contract and because of some bullshit issues about my working remotely). The demise of the Guile project at Cygnus was a profoundly unpleasant experience.

Quitting, at that time, was a somewhat crazy step to take. We parted on less than friendly terms. I had been accustomed to job searching in the Silicon Valley, back in those days, this way: you call a few recruiters; you fax or email them your resume; you have phone calls for a few days; you get some interviews; you take your next job. The Valley was, truly, the Garden of Earthly Delights for a hacker in those boom years. This time was different. I spoke to several otherwise decent recruiters who all quickly, and to my surprise, made it clear to me that each and every one had been warned away from me by people close to Cygnus.

Some people will tell you that the Silicon Valley elites back then did not secretly blacklist people from employment. Those people are variously mistaken or lying. Get on the wrong side of a couple of those elites and, in my experience - that was it. You're out. The U-Haul place is down the street. On- ramp to highway 80 is over there. Get out of town. See you in the next life.

Shortly after that I had to abandon my status as the GNU Guile maintainer (at status conveyed by the FSF, not Cygnus) for financial reasons: I was busy working out some way to keep a roof over my family's head. The project was taken over by one of the "revoc" developers about whose work on it, during that period, I have nothing nice to say.

Within those next few years the Linux kernel's foothold got quite strong. The FSF greatly diminished its efforts to build a "complete GNU system" and, rather than making sure lots of interactive applications were extensible in the style of Emacs, the GNU project became more of a follower than a leader.

In those same next few years, a faction of people close to Cygnus who had first hostilely forked GCC then forced its maintainership away from the FSF.

Overall, the FSF became far less proactive at software development and the original "vision" of a lisp-centric improved version of unix fell by the wayside. One of the last big actions from GNU was to endorse an alternative GUI app framework - GNOME - on the grounds that at least it didn't have the licensing problems that, at the time, KDE had. Any remaining hope of directly developing the lisp-style environment we'd started out to build evaporated right there.

Here is a different version of some part of the same story (also as told by me, and why should you believe me? :-)

<http://basiscraft.com/0800-0100-the-tcl-war.html>

(Where did I go after Cygnus? After several agonizing months I landed a job working remotely for an R&D group at UUNET. That was a gig that went very well for a couple of years. You know, until it was suddenly revealed that the firm was bankrupt and that it's CEO was being arrested. I tell ya', I can't catch a break. ;-)

<comment><USER7> > "vision" of a lisp-centric improved version of unix fell by the wayside

Dogbert would say: I like stories in which visions meet reality.

P.S. What was it about the new contract that made you quit, and why didn't you look for a job before quitting?

<comment><USER6> As I recall, the contract was vague and bullshitty and I didn't see any upside for the potential customer and suspected it had been offered as a "favor" in relation to some larger deal. I don't roll that way. That it was also then signed in spite of my specifically _not_ agreeing to it was also the penultimate confirmation that I really no longer had any place at that firm.

I didn't look for a job before quitting because I'd never before had any problem finding a job. It was like I say: you call a few people, chat a bit, you get job offers. It didn't take courage to quit that time, just anger.

<comment><USER7> So they didn't value you there, but got angry when you quit?

<comment><USER6> I have no idea what emotions inspired their actions after I quit.

</comment></comment></comment></comment></comment><comment><USER8> Can anyone summarize how Guile is supposed to interpret/interact-with other languages? I thought Guile was just the GNU Scheme interpreter (now bytecode vm, I guess), but it seems lately that it's turning into something like Parrot. Is that the case?

<comment><USER9> It was always intended to be a backend for whatever language you want; it just didn't get any real use other than the Scheme frontend until recently.

</comment></comment><comment><USER10> Scheme is certainly a nicer language than emacs lisp, but is it really worth all the effort of replacing it? So much code is going to have to be fixed or rewritten. Why not spend that time adding new features or building something new entirely?

<comment><USER2> The Guile VM can run Emacs Lisp. So the only thing that has to be changed is Emacs itself, all the elisp code out there will run unmodified.

<comment><USER11> Except that, apparently, it turned out not to be so simple in practice:

 _In each and every case we discovered devils in the details and realized "Well, we can't." We could make a TCL-like language that could run many simple TCL programs but that would not be upward compatible - and have that TCL-like language nicely integrated with the larger environment. We could make an Emacs Lisp style of environment that could run some Emacs Lisp code directly but that would not be upwards compatible - and have that alternative Emacs Lisp nicely integrated with the larger environment. But we absolutely could not, for fundamental reasons, directly support Tcl and Emacs Lisp with fidelity and wind up with a sane programming environment._

Can anyone point to what kind of fundamental problems he's talking about here?

</comment></comment></comment><comment><USER12> Guile also runs on the NanoNote <http://zedstar.org/blog/2010/02/25/guile-on- a-ben-nanonote/></comment>


Configure telemetry and other settings in your organization (Windows) - <AUTHOR> https://technet.microsoft.com/en-us/library/mt577208(v=vs.85).aspx <comment><USER2> Thanks. Useful stuff, especially the telemetry section.</comment>


Trash - <AUTHOR> https://en.wikipedia.org/wiki/Trash_(computing) <comment><AUTHOR> > In early versions of the Macintosh Finder, Trash contents were listed in > volatile memory. Files moved to the Trash would appear there only until the > Finder session ended, then they would be automatically erased. When System 7 > was released, the Trash became a folder that retained its contents until the > user chose to empty the trash.</comment>


Web providers must limit internet's carbon footprint, say experts - <AUTHOR> http://www.guardian.co.uk/technology/2009/may/03/internet-carbon-footprint <comment><USER2> AGW is a myth.

<http://www.climateaudit.org/>

</comment><comment><USER3> I'm sorry, but no. Why should I have to?

It's hardly my fault if governments, regulators and companies cannot build enough power plants.

<comment><USER4> Because saving the planet relies on all of us.

The power is YOURS.

<comment><USER5> If AGW is actually an issue, saving the planet relies on getting the no-nukes folks out of the way.

And don't get me started about flying Air Force One to photo ops, even to a wind turbine factory.

<comment><USER4> Large-scale nuclear power is not an option until the waste-disposal problem is solved safely and cost-effectively. Good luck with that.</comment></comment></comment></comment>


JavaScript Template Attacks - <AUTHOR> https://www.ndss-symposium.org/ndss-paper/javascript-template-attacks-automatically-inferring-host-information-for-targeted-exploits/ <comment><USER2> Quick summary: an automated approach to browser fingerprinting, with two new side-channel attacks on browser engines, that reveals "the underlying operating system, CPU architecture, used privacy-enhancing plugins, as well as exact browser version".

Why it's called a JavaScript _Template_ Attack: "A template is a matrix of properties (rows) for various environments (columns). All properties, e.g., browser properties, are retrieved through JavaScript."

<comment><USER3> > Why it's called...

I still don't get it, very weird name.

In JavaScript, "templates" are special strings that support interpolation: [https://developer.mozilla.org/en- US/docs/Web/JavaScript/Refe...](https://developer.mozilla.org/en- US/docs/Web/JavaScript/Reference/Template_literals)

<comment><USER2> I agree the name is a bit confusing, I also immediately thought of template literals, wondering what kind of vulnerability it could have.

</comment></comment></comment><comment><USER4> I don't see whats new here - comparing global object values has always been used to identify browsers and versions. Same with looking for bugs/quirks in JS engines.

New extension idea: adds random properties to window on each new page.

<comment><USER5> I believe the new stuff is the exhaustive approach ("5796 different properties between Firefox and Chrome"), which is a bit scary actually.

<comment><USER4> Recursively walking a tree is new?

</comment></comment></comment><comment><USER6> Link to Github-repo in slides [https://github.com/IAIK/jstemplate](https://github.com/IAIK/jstemplate)

</comment><comment><USER7> I watched the video presentation, what's the take-away from it? Yes, different environments have different properties, but we knew this since the first browsers appeared. Is there anything new? This does not lead to an unique fingerprint. Is it more about the automated system that detects the properties that change or just bringing awarness of the issue?</comment>


Ask HN: How to succeed as an IC at a larger company - <AUTHOR> Hiya, I've been doing software development for about 5 years now, but always at smaller companies. My last company had about 25 developers on a single product and that was largest team I'd ever worked on at that time. I'm now working on team with closer to 250 developers across 3 locations/timezones and it's extremely overwhelming.
I've been here for about a month now and still feel like I'm mostly just in free falling trying to figure out 95% of what anyone talks about or how to do things. It seems like everything works fundamentally differently than it does for a smaller scale company.
Do you have any advice for short/long term success as a developer that is very new to operating in an environment at this scale? <comment><USER2> >> I've been here for about a month now and still feel like I'm mostly just in free falling trying to figure out 95% of what anyone talks about or how to do things.

It is fairly normal, every company has its on acronyms, processes, so I would say it is fairly normal to be overwhelmed in the beginning. There is no way you could know in advance their process.

That being said, you should have colleagues available to help you.

Take always a notebook and a pen with you. Whenever there is a word, or process, you have never heard of or are not sure what it consists of, write it down.

Now every few days schedule a meeting with a member of you team, reviews the list, and request explanation/clarification.

Take additional notes for future reference. That's it, in a few weeks you'll feel at ease with what is happening around you.

This is a gradual process, you'll keep learning in the months, years to come.

Then once you feel more at ease, you can push for initiatives, new ways to do things. A newcomer has usually always lots of fresh ideas because is not yet used to how things are done here...

<comment><USER3> I agree with this, and would add: ask the questions now about what does this mean, what do you mean, how does that work here etc... If you wait 6 months and still don't understand because you didn't ask questions, then you will run into problems and people will start pressuring you or isolating you. When you are new, everyone expects those questions and are generally fairly happy to help, and in really large companies it can take a year to become truly competent in the solution. But if you aren't asking questions or aren't understanding, raising your hand about it etc, they will assume you get it and move on. Then you will be judged like you know all the material when you really don't and that is hard to recover from.

Big teams have their own challenges, but in general, you should likely have a small immediate team that is your focus. So while you need to figure things out, don't freak out about things 3 teams over that you don't understand right now. It is really common in large teams that your area of expertise will be focused around what your immediate team works on, and no one expects you to understand all the other team's work. What makes people "invaluable" is that they push to learn the "entire" system (or as much as possible) from each of the teams, which means they become a wealth of knowledge even if they've been there less time than others. This used to be my trick as a freelancer that led to me transitioning to a true consultant when I built my first consultancy. I'd go into large teams, do the job I was hired for but learn the entire system because I wouldn't stop asking questions, exploring etc. Then within 6-9 months many times I knew more than people that had been in the company for years, only because they stayed in their cube and did what tasks they were assigned but didn't ask questions and explore.

</comment></comment><comment><USER4> As you are noticing, there is a lot of communications overhead for large teams.

Large code bases themselves don't have to be confusing though. I worked as a contractor at Google and their system was very dev friendly with almost everything is available/viewable in a large repo with good editing and build tools.

I hope those 250 developers are split up on small teams, with small manageable projects.

<comment><AUTHOR> One of the things I am finding is the amount of project freedom and the amount of process and documentation are the inverse of anywhere else I've ever worked.

Most of my jobs have had very straight forward goals of what needs done next, with an endless backlog of already prioritized work. There has very rarely been much documentation around anything though.

This company is more vague high level goals that teams have the ability to figure out any work they want to do that furthers that goal, but there is a very high bar for documentation before, during, and after features are done. Even git commits have a very rigid structure to them!</comment></comment>


Happy SysAdminDay - <AUTHOR> https://en.wikipedia.org/wiki/System_Administrator_Appreciation_Day <comment><USER2> Anyone on here a sysadmin? I have considered leaving development to do either sysadmin or data center work. How is it?</comment>