Why is Apple sitting on $142bn? - <AUTHOR> http://www.bbc.com/news/business-31016446

<comment><USER2> > He even admitted Apple would be happy to pay more tax, but only if there was > a "dramatic simplification of the corporate tax code" including a > "reasonable tax on foreign earnings that allows the free flow of capital > back to the United States".

"I'd like to say I'm paying taxes without actually paying taxes"....

<comment><USER3> Oh yes, I'm sure the major issue for the largest corporation in the world is "complicated tax laws." They just can't figure out what all those darn big words mean!

</comment></comment><comment><USER4> Because they're a revenue generating machine in an age of suppressed demand.

</comment><comment><USER5> With that kind of money you could invent the future, or one small piece of it. Microsoft's HoloLens was a nice surprise, for example. Apple should take a big jump in something.

<comment><USER6> Apple is probably working on a lot of things, but their current method is to not show something unless it's shipping (or close to it).

[http://counternotions.com/2008/08/12/concept- products/](http://counternotions.com/2008/08/12/concept-products/)

<comment><USER5> Yes, I think everyone understands Apple's secrecy by now. Here's my favorite expression of that: [http://worrydream.com/Apple/](http://worrydream.com/Apple/)

Anyway, it doesn't count until it ships. You haven't actually solved a problem until you've shipped a product that someone will pay for.

</comment></comment></comment><comment><USER7> Are they hiring like mad? Isn't that what were told should happen if corporations paid less taxes?

</comment><comment><USER8> Is Apple really an outlier? Many Japanese companies do the same. Nintendo is famous for its huge cash reserves. It can help a company see through regular ups and downs of the market.

</comment><comment><USER9> Minus $35B in debt: [http://finance.yahoo.com/q/ks?s=AAPL+Key+Statistics](http://finance.yahoo.com/q/ks?s=AAPL+Key+Statistics)

<comment><USER10> From the article...

"In total, the amount of cash in the group is around $178bn. Some $35bn in debt reduces that figure to the $142bn mentioned above."

</comment></comment><comment><USER11> They could always end world hunger 4 times over (granted, so could many many entities), but they'll probably use it to make more money.

<comment><USER5> World hunger is a $30 billion a year problem? Americans spend $15 billion on bottled water. If we stopped that we'd fix half the problem:

[http://www.huffingtonpost.com/2013/08/12/bottled- water_n_374...](http://www.huffingtonpost.com/2013/08/12/bottled- water_n_3744480.html)

In fact, $30 billion is a rounding error in a $15 trillion economy.

Women's luxury market is $250 billion/year.

[http://discover.umn.edu/news/arts-humanities/university- minn...](http://discover.umn.edu/news/arts-humanities/university-minnesota- research-reveals-luxury-products-role-relationships)

Anyway, I really don't understand why you'd add noise to this conversation.</comment></comment>


Getting More From Vim - <AUTHOR> http://benmccormick.org/2014/07/21/learning-vim-in-2014-getting-more-from-vim-with-plugins/

<comment><USER2> I find it funny how you suggest your readers to install so many plugins (some of them incredibly pointless), and the plugin manager of the day, for "getting more from vim" after such a superficial series of posts in a series called "learning Vim".

<comment><AUTHOR> To be clear, I explicitly say that you shouldn't install each of those plugins. They're meant as an idea of whats out there. I'm sorry you've found the series superficial. Any thoughts on what would make it more useful?

<comment><USER2> Your articles are entitled "Learning Vim" so one could expect a little bit more depth and actual "teaching". And not promoting crap like Janus… installing that shit is the opposite of learning. It's like paying someone to do your homework for you.

[http://benmccormick.org/2014/07/07/learning-vim- in-2014-work...](http://benmccormick.org/2014/07/07/learning-vim- in-2014-working-with-files/)

was ridiculous.

In "Buffer Management", you don't talk about :find or command-line completion or the wildmenu or the possibility to use mappings or the fact that one can use buffer names to navigate or tag-based navigation. And under "Plugins", the following sentence (and the mandatory list of plugins) is not really helping you to get your point across:

        The good news is that Vim has solutions. They're just not baked into the Vim core.

Seriously, don't do that under a "learning vim" umbrella. That series should be called "Get Vim to look like all those screenshots without worrying about learning to use it".

<comment><AUTHOR> Sorry you didn't find it helpful. I'll keep that stuff in mind going forward.

<comment><USER2> I didn't really hope your articles to be helpful for me, to be honest, but people wanting to learn Vim will certainly find them lacking.

<comment><AUTHOR> Well I'm glad I met expectations at least then :)</comment></comment></comment></comment></comment></comment>


Xipology: Exploiting DNS caching as a covert channel - <AUTHOR> https://medium.com/ouspg/xipology-%E2%85%93-exploiting-dns-caching-as-a-carrier-91486c80b4f6 <comment><AUTHOR> Github repo with proof-of-concept code: [https://github.com/oherrala/xipology](https://github.com/oherrala/xipology)</comment>


Livestream nature sounds while coding - <AUTHOR> http://livenaturesongs.com/index.html

<comment><AUTHOR> I'm trying out seeing how nature sounds improve my flow while programming. This one has some pretty impressive-looking hardware and good sound quality.

I like the idea of being able to listen to live, natural sounds. I have a suspicion that the open soundscape might lend itself to thinking clearly.

(that said, as I write this, there's clearly a plane flying over the unit streaming.)</comment>


EU Parliament Committee Adopts Piracy 'Upload Filter' Proposal - <AUTHOR> https://torrentfreak.com/eu-parliament-committee-votes-in-favor-of-piracy-upload-filter-proposal-180620/ <comment><USER2> I should be concerned about this, but somehow I am not.

This will never work. If they try to make it work it won't work and the political fallout from the Internet being broken would be huge. Europeans value free speech and cat pics as much as anyone else in the world.

To me I think, this sounds like TTIP. A bunch of policies put together by Brussels lobbyists, adopted by aloof commissioners but that will never get past the more politically-grounded deliberation phases.

</comment><comment><AUTHOR> TLDR: "Today, the Legal Affairs Committee of the Parliament (JURI) voted on the issue. With a 15 to 10 majority, the Article 13 proposal of Rapporteur Voss was adopted. This means that the plans move ahead in their current form, despite massive public outcry.

...

Now that the proposal has passed the Committee the plans will move to plenary before progressing towards the final vote on copyright reform next spring.

It also means that they are now much harder to stop or change."

<comment><USER2> _> It also means that they are now much harder to stop or change_

Making it all or nothing, including the politically unpalatable bits so it'll probably fall at one of the final posts.</comment></comment>


Ask HN: Cheap / free vector image editing software? - <AUTHOR>

Hey HN, I'm looking to make some mockups of a couple pages.  I currently don't have Fireworks installed on my computer and I don't feel like paying a ridiculous amount of money for it.
Are there any decent free image editing programs that will allow me to do mockups?  I don't need the complex tooling of Photoshop, just the ability to create vector images.
I am running Win 7. <comment><USER2> Inkscape is what springs to mind. Scribus might also be worth a look.

</comment><comment><USER3> <http://gomockingbird.com/> is also quite good if you want to do wireframes

</comment><comment><USER4> <http://www.gimp.org/>

Not sure if Gimp is any good these days, but my friend used to use it in lieu of photoshop.

</comment><comment><USER5> <http://aviary.com/> You can make some nice graphics with this one and also learn from others</comment>


My favorite books on software engineering - <AUTHOR> https://bitsnbytes.blog/2018/12/03/my-favorite-books-on-software-engineering/ <comment><USER2> All links are affiliate links (tag=andrewminer-20)</comment>


What Google's Calico Anti-aging initiative will actually do - <AUTHOR>

The biggest missing piece in curing most diseases IMHO is that we do not yet have any good computational model for a cell. If we had a way to simulate an individual cell for a specific person in a computer program (which is a hard problem) we could actually cure cancers pretty easily (by testing millions of pharmaceutical compounds on the spot against each person's cancer cell model) and also make great strides into all other human diseases.
Only a very few scientists have worked in the field of whole cell simulation so far (see http://goo.gl/heurd for one effort) and this problem is a PERFECT application for Google's big data expertise.
Here's what I'm guessing Calico will do:
1. Fund scientists who work on technologies that can detect various chemical concentrations of cells in vivo.
2. Build a multi-petabyte database of chemical concentration timelines generated in this way, which are run against human cell cultures experiencing varying environmental conditions.
3. Run complex big data statistical algorithms to determine quantitative measures of causation between all these chemicals and with DNA sequences in the cell.
4. Use this information to build an accurate computational model of a human cell.
This is an area of research that (1) would improve therapies across the board for all major diseases at once (2) has few short-term financial incentives, meaning only a huge research initiative could attempt it, and (3) requires significant big data expertise.
Thoughts? <comment><USER2> Mapping, modeling, and indexing a cell's structure is a very different problem than indexing hyperlink structure on the internet.

A wholesale computational model of the cell is an incredibly ambitious task to achieve via a broad, unfocused approach to building a chem-concentration database.

The main issue they would face is in your bullet #1: What is your "Pagerank" for cell structure and chem-concentration analysis, what/who do you put your weight behind?

How do you merge these data sets? This research is distributed in labs all over the planet with different quality standards, research objectives, lab conditions, data hygiene, statistical significance, etc.

What you've written seems like a plausible approach in a pure research setting within a single lab, but if their end goal is a computational model of the cell with commercial side-effects along the way-- the best way to achieve that would be to chip away at it piecemeal. Not through an unfocused merger of cell "big data".

E.g. identify specific protein binding sites and conformations that correlate with a specific type of breast cancer, track their conformations under different conditions--- prove that your data is superior to data yielded by existing models.

Of course, you would also have to monetize somehow.

The specific thing you chose is less important than not attempting to paint the whole model at once.

</comment><comment><USER3> Although something akin to this should occur, I think your post understates the computational enormity of the issue. Many diseases are not caused by single genes or single environmental conditions, but interactions between dozens of genes and the environment, even epigenetic factors. Big Data (huge data) approaches will begin to chip away at the mountain, but even with Google's super powers, it's a ways off.

> (1) would improve therapies across the board for all major diseases at once

How? Unless if by "at once" you mean they would begin the era of using this approach on any disease. But surely each disease will have its own puzzle.

<comment><AUTHOR> Re: Computationally enormity:

Well, I agree the computational enormity is a big problem, but certainly some biochemical pathways will be more amenable to this type of approach than others, and so it should be possible to make incremental progress by solving one puzzle at a time.

Re: Using on any disease

I agree having this sort of technology is not an immediate solution to each arbitrary disease. However, being able to accurately predict how different cells in a specific person's body behave to different drug cocktails would give doctors "super powers" that are almost unimaginable today. A doctor with a patient that has cholesterol plaques might say "If we give him these ten drugs in this dosage his T lymphocytes will aggressively attack the plaques in the LAD artery only, and the LAD arterial cells will increase division to reduce risk of subsequent aneurysm from autoimmune side-effects".

If the accuracy of the computational model is good enough, it might be just as effective as the old "nanobots in the bloodstream" concept, but much easier to implement. In effect, the patient's own cells could function as the "nanobots" by reprogramming them</comment></comment>


A small glass of juice or soda a day linked to increased risk of cancer; study - <AUTHOR> https://lite.cnn.io/en/article/h_8e7723fcad48357de997b6cec1566975 <comment><USER2> I made a different comment in the other article about this study that was in the Guardian (I think it's the same study?); essentially I thought it was fear mongering, and the likely increase in risk, while mathematically probable, was likely so low as to be virtually the same to priors. I mentioned Bayes theorem, but I am not certain or not if it applies.

But anyhow - reading this article - that last part (my summarization):

"While this study doesn't offer a definitive causative answer about sugar and cancer...the message from the totality of evidence on excess sugar consumption and various health outcomes is clear -- reducing the amount of sugar in our diet is extremely important," Lake told the Science Media Centre in the UK. She was not involved in the current study.

So just grab some rando "reader in public health nutrition at Teesside University" (is a "reader" just someone who reads things? Is this an actual job position?) and have them give you an opinion - one that basically says "yeah...this whole study may mean almost nothing...I really don't know...but limit your sugar intake people!"

Again - this article, and the Guardian one, both seem like your standard "omgweregonnadie!" fear article to sell papers and advertising, via the use of out-of-context numbers and percentages, and the fact that people don't understand probabilities.

Sigh.

</comment><comment><USER3> Study: [https://www.bmj.com/content/bmj/366/bmj.l2408.full.pdf](https://www.bmj.com/content/bmj/366/bmj.l2408.full.pdf) (via [https://www.bmj.com/content/366/bmj.l2408](https://www.bmj.com/content/366/bmj.l2408)).

</comment><comment><USER4> Getting older each day is probably also linked to increase the risk of getting cancer

<comment><USER5> Where's your control group showing that people who don't age don't have an increased risk of cancer?</comment></comment>


Greta Thunberg Wants You – Yes, You – To Join the Climate Strike - <AUTHOR> https://www.teenvogue.com/story/greta-thunberg-climate-strike-teen-vogue-special-issue-cover <comment><USER2> Does this climate strike have a strike fund to help adult strike participants pay their bills? If not, then you aren't going to see much in the way of buy- in from adults with bills and debts to pay unless they're desperate enough or angry enough that such concerns no longer matter to them.</comment>


U.S. policymakers worry about China 'weaponizing' drug exports - <AUTHOR> https://www.politico.com/news/2019/12/20/policymakers-worry-china-drug-exports-088126 <comment><USER2> They should worry about it. Especially in light of the administration trying to weaponize paranoia and blame the Chinese people for the outbreak by labeling it "the Chinese virus."

This is profoundly short-sighted race-baiting for domestic political gain, which could come back to bite us if China decides they're tired of losing face and start putting up export controls on medicine.</comment>


Clam claims oldest animal record (405 years) - <AUTHOR> http://www.guardian.co.uk/science/2007/oct/29/clam <comment><USER2> I just can't believe that it basically amounts to "scientists find oldest animal on record, then kill it to find out how old it is"

<comment><USER3> Or find out how it tastes...</comment></comment>


The Birth Torts: Damages for Wrongful Birth and Wrongful Life (2005) - <AUTHOR> http://www.austlii.edu.au/au/journals/DeakinLawRw/2005/16.html <comment><USER2> The only only thing I agree with is doctors compensating for messing up the child's life(accidental maiming). If a sterilization goes wrong that is the risk of the patient. They are told it may not work. All who are sexually active should be held accountable to take care of the children they conceive. No birth is wrongful. All life is precious.</comment>


10 People Whose Lives Were Changed By Reddit - <AUTHOR> http://www.sfgate.com/technology/businessinsider/article/10-People-Whose-Lives-Were-Changed-By-Reddit-4500582.php

<comment><USER2> here's the actual list [http://www.businessinsider.com/best-reddit-gifts-and- donatio...](http://www.businessinsider.com/best-reddit-gifts-and- donations-2013-5#a-schoolteacher-received-16000-worth-of-textbooks-1) strange how they don't mention the guy that was wrongfully blamed for the boston bombings (and was actually found dead a month later)

</comment><comment><USER3> This is the best they could come up with?

</comment><comment><USER4> Why is this on the front page?

A teacher getting books - sure, that's "life changing" enough for a fluff piece... but a failed political campaign and pizzas for police officers?

Am I missing something?</comment>


Apple's iOS 5 coming this Fall - <AUTHOR> http://www.engadget.com/2011/06/06/apples-ios-5-all-the-details/ <comment><USER2> EDIT: who would downvote this? (I'm saying that iOS 5 is nice, but it's mostly just adding features that directly copy its competitor Android, and not even all of them. Android had been copying in 2009-2010, but now it's Apple. A lot of people, even devs, don't realize that Droid has had all these features for months. I hadn't.)

I have an iPhone 4, I've had iPhones for 4 years. I love the iPhone.

I tried a Nexus S with the newest Android recently. Using it, I learned that Android is, frankly, today, ahead of iOS on the phone side.

Android's notification system is better. It's so much better, that Apple directly copied it. Android's hardware back button works, it works well, and it frees up more screen real estate for useful content. Android's home button is more consistent. Its apps are more powerful, google talk video works great. Its wireless seamless binary-only updates are revolutionary.

Apple has fallen behind, and will only catch up with iOS 5 in the Fall. Of course, I fully expect Google to innovate further and be even farther ahead in 2012.

The coolest thing by far, and this is something that Apple won't have in the foreseeable near future, is voice recognition. Google's voice commands work suspiciously well. I find it far easier to press a button and say "text John Appleseed: Hey, let's go to the movies tomorrow at 3" than to navigate menus and type it in. Google's tech recognizes words and phrases I wouldn't expect it to.

Apple still has more apps, but that won't last for too much longer.

I have an iPad 2, and I love it, but my next phone will be a Droid.

<comment><USER3> The subtle (and not so subtle to others) difference is that iOS will have these features polished. Android just has them.

<comment><USER4> I generally prefer to have unpolished features available to me to use or not use. If they are polished enough to be useable for me, then I use them. If not, then I don't. I like being able to decide. Which is why I generally prefer android to iOS, I guess. Many others obviously prefer otherwise.

</comment></comment></comment><comment><USER5> Apple is trying to build a massive moat around their iOS/OSX ecosystem. If they can execute, it will be difficult for competitors to convert iOS users to other platforms.

      -Applications synced across multiple devices
      -music, photos, calendars, apps in iCloud (including your ripped content)
      -Integration with iTouch/iPad/iPhone docks and accessories
      -iMessage/Facetime lock in for user accounts
      -Gamecenter achievements
      -OSX integration and "feel"
      -Reduce the need for a PC with wireless updates and sync (probably 75% of iOS users are on Windows)

The average user will have to face the prospect of changing out a lot of their software as they become more integrated into Apple's ecosystem.

<comment><USER6> I see it more as adding value I want instead of a moat/lock in. If integration in Apple's ecosystem gets me _Applications synced across multiple devices_ , _music, photos, calendars, apps in iCloud (including your ripped content)_ , etc., count me in.

</comment></comment><comment><USER7> I am going to make this comment and it might be unpopular but it is definitely not meant to be a slag against iOS. I am noticing that a lot of the new iOS features are "missing features" from other mobile OSs... and since I'm really only familiar with iOS and Android so I can only compare those but a short list:

\- centralized notification tray \- OTA activation \- OTA synching \- OTA updates \- optimized updates \- reminders that sync with your calendar \- hardware camera buttons \- data sych to the cloud (though iCloud is much more complete than Google account sync) \- iMessage is being compared to BBM

This is a great for iOS and quite overdue. But at the risk of offending the Apple fans, am I the only one who feels that this update to iOS contains a lot of things that are just to maintain feature parity with other systems vs. outright innovation? Just seemed that much of the features list for iOS this year had a different feel from years past. Maybe it's just me.

<comment><USER8> You are right, but this is exactly how Apple works. Start with very few features and polish to a pristine sheen. Then add new features and proclaim the world is changing.

It certainly has been working for them, and generally, isn't that the type of product development advice anyone in HN would give you? Start simple, polish and iterate.

<comment><USER2> I would not say that this is "how apple works."

Apple innovates very well. The iPhone won not because it had an abstract "pristine sheen", it was just a better phone that innovated in the right ways:

Maps worked great, Safari was a full browser in the phone, and other features. It's software keyboard worked _well_ and enabled a large screen for _capacitive_ touch and multimedia. iPhone 1 had a plentitude of new features.

iOS 5 isn't innovating. iOS 5 is copying. I wouldn't be surprised if iPhone 6 has a hardware back button like android.

The iPad still innovates, and hopefully Apple has a cool new product around the corner.

<comment><USER9> I really doubt we'll see a hardware back button on iOS. That is a misfeature of Android because of its inconsistent behavior -- if you came to one activity from an activity in another app, how do you go to the parent view in the current app? The back button takes you to the activity from which you came, not to the parent view. I think most iOS users are fine with how back works in iOS; personally I would be very much against Apple adding another hardware button of any kind except maybe a camera button.

I agree that a lot of Apple's advantage came from innovating. But a lot of the advantage also comes from taking features that other devices have done and doing them better. For example, Android does not show collated notifications on the home screen by default, and you can't interact with notifications without unlocking the screen and pulling down. iPhone's proposed implementation looks a lot better than what Android has. This happened with copy and paste too, and Android still has not caught up (no universal method for copy-and-paste).

I don't care if Apple copies or innovates. What I care about is that iPhone is still (and after this next release, will to an even greater extent be) the best phone money can buy. How it got that way is immaterial to most of their potential customers.

<comment><USER4> You're almost certainly right that iOS devices probably aren't going to get a hardware back button, but I disagree with you on the usefulness of hw back buttons.

Generally, if I come to an activity from another app, it's to do one specific thing and then I want to go back to the original app. There are certainly cases when I want to stay in the app I got sent to and then hit back and find myself in the original app. The path then to the app I want is the same as always: home button, app shortcut.

Conversely, on iOS, what happens when I get sent to a different app and then want to go back to the original app? Home button, app shortcut. In my experience, the android way addresses the more common scenario.

Also, there are builds of android (HTC's Sense UI, I believe) that do have notifications on the lock screen. Not only that, but the lock screen is configurable, so you can add shortcuts that, when you drag them to the unlock field, take you directly to the app. This is a neat feature that I hope eventually makes it into android proper.

EDIT: Hm, this is factual and fairly uncontroversial. I suppose getting downvoted sometimes is just an inevitable consequence of participating in any dicussion involving iOS and Android? Oh well.

<comment><USER10> > [on iOS] what happens when I get sent to a different app and then want to go > back to the original app?

The answer is that this (switching apps) happens far less frequently on iOS compared with Android. In Android, the intent system (and back button) make it very easy to switch between apps. On iOS, apps use APIs instead. Integrated Web views rather than opening a browser. Mail API rather than switching to the mail client. This keynote we just saw that Apple has done this again, adding a Twitter API to iOS 5.

It's quite an interesting and significant difference between the two mobile operating systems. Android's approach encourages openness, Apple's approach gives them complete control over the UX. Neither is inherently bad.

<comment><USER4> That's a good observation, but I would submit that the reason iOS apps use web views instead of opening the browser is exactly because of a lack of a good way to get back to the originating app. App developers naturally don't want to sent people away from their app with no easy/clear way to get back. The addition of the Tweet API is another way to address a symptom of the underlying problem of not having a way back.

It is an interesting and significant difference, and I think the flexibility of Android's system is one of its great strengths. It's always been able to do what the Tweet API does, more flexibly, because app developers can just send focus to the user's preferred twitter client instead of having to write in the twitter functions they want, and don't need new functionality built in to the OS.

Certainly it requires a bit more sophisticated user (not that iOS users are dumb, just that you have to understand what's happening, and it could very easily be confusing to a naive (non-pejorative sense) user), but it's really a joy to use.

EDIT: I know I shouldn't care, but the systematic downvoting is really starting to get to me.

<comment><USER11> Give it time. Most knee-jerk early down-voting on HN tends to get corrected over the next hour or two. It's annoying when one or two people unfairly down- vote a comment, but at least the system usually self-corrects.Once a thread is a few hours old I seldom see comments down-voted into grey oblivion that didn't obviously deserve to be there.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER12> I wonder what the fallout from folks like Instapaper and Tap Tap Tap will be.

It seems kind of shady for Apple to say Tap Tap Tap's Camera+ couldn't have volume button as a shutter (because it was a UX rule violation), then six months later implement that feature right into iOS.

<comment><USER13> So what's the solution here? To me the outcry over this seems pretty contradictory given the general antipathy around here towards software patents.

Either ideas are something that an individual can own and control and others are forbidden to use without permission, or everybody is free to implement them and innovate around them.

Is Marco going to have to do some work now to differentiate himself from Reading List? Totally. But is that a bad thing? He was no more entitled to a competition-free perpetual business model than the Record Labels or Movie Studios or Banking Industry or any other perennial target around here.

Marco is a smart and skilled guy and there's no way this is going to kill him off unless he willingly lets it.

<comment><USER14> I agree completely; you can't have it both ways.

However, the point in the OP about Camera+ seems a bit more legit. Rejecting an app for doing X and then doing X yourself in the next release seems like a huge double-standard, and where there are double standards there is foothold for allegations of anti-competitive behavior.

That said, however, the difference between me (sitting in a cubicle typing this) and the creative forces behind Instapaper and Camera+ is (hopefully) that where I see small developers being turned into digital sharecroppers by a dictatorial corporation, they see an opportunity to differentiate themselves from the stock offering by excelling in the very specific area they're focusing on.

<comment><USER15> Actually, the Camera+ developers filed a feature request and _asked_ Apple to add the volume-button-as-shutter feature. See: <http://taptaptap.com/blog/cameraplus-volumesnap-rejected/>

So I imagine they're pretty happy with this development.

</comment></comment></comment></comment><comment><USER16> You don't need to watch the keynote, their video is pretty well done to show all the new iOS 5 features:

<http://www.apple.com/ios/ios5/gallery.html#video-ios>

<comment><USER17> They said there is 200 new features. That certainly isn't all of them.

</comment></comment><comment><USER18> Are we going to finally have the ability to upload photos out of safari?

How apple gets away with this is beyond me. There is no technical reason that I can imagine why allowing photo uploads from mobile safari should be disabled.

</comment><comment><USER19> This is all pretty exciting, but I want more exterior button shortcuts. Also, why can't I search text fields on my meager 3Gs?

</comment><comment><USER20> I would say less than 3% of local business owners can understand the items that he is saying.

If your customers don't get it, getting them to signup is very costly.

</comment><comment><USER21> iOS5 was surprisingly underwhelming, given how long its been since they shipped iOS4. This certainly won't stop the train known as Android. I really don't see this changing the iOS sales trajectory upward at all.

<comment><USER3> Do you imply that current trajectory is downward? And Apple does not sell iOS, it sells iPhone, iPod touch and iPads with that OS. I am sure iPad sales are not going to go down any time soon.

<comment><USER21> No, I don't mean to imply that. I was trying to say that they have a current relative trajectory (flat on iPhone/iPod, solidly up, but slower than anticipated after Q1 launch on iPad) -- and this trajectory doesn't seem to change any more upward after this. In particular relative to Android.

To put it another way, if they didn't do this release at all and just continued to sell iPhones with iOS 4.x on it for the next 12 months, I don't think we'd see a difference in their sales numbers.

I think this is a testament to the current quality of their devices and OS. But it does feel like we've entered Mac circa 1991. It's getting long in the tooth and the improvements are really small, while a competitor with a late start is showing signs of accelerating.

<comment><USER3> I am not so sure about flat sale of iPhone and iPod but have no data on that, so won't argue. Comparison of Android vs. iOS devices bothers me a bit every time, because it is just one manufacturer with handful of products vs. dozens manufacturers with gazillion devices.

<comment><USER21> Here's one datapoint:

[http://gigaom.com/apple/iphone-flat-in-u-s-as-android- takes-...](http://gigaom.com/apple/iphone-flat-in-u-s-as-android-takes-market- share-lead/)

Apple has great margins, so they'll do fine, even if they stay at 25% marketshare forever. But it seems to be clearer that Android is going to run away with this.

The only real question is, who takes the #3 spot. RIM, MS, or HP? I think there will be 3 players in this space. Two are locked in. The last has yet to be decided.</comment></comment></comment></comment></comment>


DDoSCoin: Cryptocurrency with a Malicious Proof-Of-Work [pdf] - <AUTHOR> https://www.usenix.org/system/files/conference/woot16/woot16-paper-wustrow.pdf <comment><USER2> I'm currently working on something similar. It's a blockchain for verifiable exploits against open source software. The idea is that you can represent bug bounties as a series of smart contracts and have exploits run deterministically against a test case within a virtual machine. That way researchers are always guaranteed payment for working exploits and vendors can be forced to release patches on time.

I wrote more about the protocol and rational here if anyone is interested: [http://roberts.pm/exploit_markets](http://roberts.pm/exploit_markets) It's still very much in the brain storming phase so any feedback at all is appreciated.

<comment><USER3> Every full node would need to the full VM, which has nightmare security implications, not to mention scalability issues.

You are far better off just doing multisig + escrow here.

<comment><USER2> That's true. The problem would be if you get attackers who have exploits to break out of virtual machines. What I can say in those regards is you might be able to design that out by creating a DSL for specific kinds of exploits and then using that for the first version.

You could always have a panel of humans that approve or deny exploits on the network but that kind of thing defeats the point of using the service. What I'm trying to accomplish is to build something without the need for human intervention. Because with a human-run service you open yourself up to politics and bureaucracy and suddenly its the same as with a regular bug program.

You've given me something important to think about.

</comment></comment></comment><comment><USER4> Tldr on page 4:

* The miner generates a random nonce

* It initiates a TLS 1.2 connection to the victim server, and uses the nonce as `client_random`

* The server generates an ephemeral public key (eg. using ephemeral DH or ephemeral ECDH), and responds with a 32-byte `server_random`

* The server sends its certificate chain as well as its public key, and signs the DH key exchange parameters along with `client-random` and `server-random`. _This is the proof of work_

* The client computes the SHA256 hash of the DH params, the signature and the nonce, and does the usual difficulty check; if it passes, it is used to make a block

</comment><comment><USER5> I'm not sure this currency will take off but how about the following: Instead of network paying for DDoSing TLS connection let it pay for relaying TLS connections.

The principle of would the same as in DDoSCount, but miners relay connections of certain users until it results in signature of given difficulty. After obtaining such signature, miner would be able to withdraw from user's account certain amount of coins. The probability dictates miners would withdraw randomly from all users.

<comment><USER4> A bit like Torcoin, basically.

<comment><USER6> Hey, I wrote that :)

The big challenge for any kind of decentralized "proof of bandwidth" scheme is verifiability. How do you know two actors are not colluding to say they are producing bandwidth? Or how do you resolve conflicts when a client thinks he transferred 1gb but the host thinks he transferred 10gb?

Our solution was to use a verifiable shuffle, where all relays and clients submit their public keys into a matrix, which the shuffle then transforms into routing paths. The result is that the client gets a "path" (e.g. A tor circuit, but it could be any routing path) that is privately addressable but publicly verifiable. So each node on the path only knows the IP address of its neighbor node, but all nodes on the path can sign bandwidth calculations with a group signature.

That said it was two years ago for my senior thesis... hardly a work of art :P I'm still pursuing the ideas in one form or another.

</comment></comment></comment><comment><USER7> Off topic but I'm interested, what software is used to create these papers? Almost all research papers have the same, very aesthetically pleasing, layout that is hard to recreate.

<comment><USER8> LaTeX - [https://www.latex-project.org](https://www.latex-project.org)

</comment></comment><comment><USER9> Can anyone think of defences not listed in the paper?

<comment><USER4> I can't think of more defences, but they briefly mention the possibility for websites to mine DDoS coins against themselves and I think it's an interesting perspective. I don't know the algorithms involved in the key exchange well enough, but if they support bulk optimizations like RSA does (it's faster to do thousands of signatures in a single operation, rather than one operation at a time) then the server has a noticeable advantage on clients - to the point where it could drive the difficulty insanely high and make it unprofitable to mine DDoS coins.

<comment><USER9> Making it unprofitable would be the best defense against for-profit ddos attacks IMO. If using a botnet to mine regular coins yields more than ddoscoins the insentive is gone.</comment></comment></comment>


YC Backed Photo Sharing Service Picplum Loses Cofounder to Twitter - <AUTHOR> http://www.techcrunch.com/2013/01/14/yc-backed-photo-sharing-service-picplum-loses-one-co-founder-to-twitter-development-to-continue-in-others-spare-time/

<comment><USER2> You know it's the end of the road when your (other) founder leaves for Live Nation Labs.</comment>


Ask HN: what would you do if every license plate was a Twitter account? - <AUTHOR>

While stuck in traffic we were discussing internet in the car and I got an idea: what if the license plate of each car was also a Twitter account? So @NL45-FDX-2 for instance, it should be unique if you prefix the country code.
But I didn't come up with that many ideas, other then: send traffic information to car, warn driver about speeding, send driver a confirmation of a ticket (after driving through red or too fast), flirt with girl in other lane.
Any other ideas (maybe involving geolocation) or is this just silly? <comment><USER2> Sounds like a great idea, but why limit to twitter- and you will probably run into some cases where usernames are already taken. Why not just create a site to report nuts drivers by license number. Then parents, etc. could look on it for their license number to see what their kids are up to. This would be a lot easier than the solutions that involve additions to cars to track their children. Then hook it up to twitter, facebook, etc. Of course, there are probably already sites that do this, but maybe you could do it better.

<comment><AUTHOR> No need to create a site, all tweets to a license plate end up in the public timeline anyway.

</comment></comment><comment><USER3> There is already a startup that does this: [http://venturebeat.com/2010/09/15/demo-bump-social- network-c...](http://venturebeat.com/2010/09/15/demo-bump-social-network-car- license-plates/)

<comment><AUTHOR> Cool, I didn't know that!

But from what I read I understand that it's tied to a telephone (app) and not to the car. In what way would the concept be improved if you could message the car and its driver (and passengers), instead of the phone.

</comment></comment><comment><USER4> IMHO, just another distraction to boost the number of car accidents...

Think more about safety and less about texting.

<comment><AUTHOR> I understand your concern, but I'd rather focus on the positive. With text to speech technology the driver doesn't need to take his/her eyes off the road.

So what _safety_ features would be possible with this?

<comment><USER5> It's understandable that you'd rather focus on the positive, but you have to respond to the negative.

Text to speech would be a good feature for this service, but it's not at the point where it's easy to compose tweets with license plate numbers and character restrictions yet.

In any case, this service would involve people taking their attention (one or more of mind, eyes, and thumbs) off of driving to send and receive tweets. Any safety features would have to outweigh this detriment.</comment></comment></comment>


There's no need to panic over factorable keys--just mind your Ps and Qs - <AUTHOR> https://freedom-to-tinker.com/blog/nadiah/new-research-theres-no-need-panic-over-factorable-keys-just-mind-your-ps-and-qs

<comment><USER2> "We did this by computing the greatest common divisor (GCD) of all pairs of moduli from RSA public keys on the Internet." For your key to be safe from this method, all you need to do is choose the factors of the modulus uniquely, not even necessarily randomly.</comment>


Android Projected to Eclipse PC Sales in 2012, iOS in 2013 - <AUTHOR> http://thenextweb.com/google/2012/01/16/its-a-mobile-world-android-set-to-eclipse-pc-sales-in-2012-ios-in-2013/

<comment><USER2> How long before the mobile browsing market share equals the desktop? I think we're still a few years away.</comment>


The Case for VP9 - <AUTHOR> http://www.streamingmedia.com/Articles/Editorial/Featured-Articles/The-Case-for-VP9-100833.aspx

<comment><USER2> That's a terrible case.

Firstly, H.265 is still in progress and it will be built into Windows, iOS and OSX at some point. That means that Firefox, Opera and Chrome don't need to implement it. They can just defer to the OS implementation. And there is nothing to suggest that H.265 won't follow the same path as H.264 i.e. dominate: [http://caniuse.com/#feat=mpeg4](http://caniuse.com/#feat=mpeg4)

Secondly, it is completely disingenuous to say "VP9 matches H.265 in video quality" when it is only at low compression. The whole point of VP9 is to be an open solution for the web i.e. it will be used at high compression. Every comparison we have seen to date suggests that VP9 is more of a competitor for H.264 not H.265 at this level.

Thirdly, nice work completely ignoring the rest of the consumer electronics industry. MPEG LA is stacked with almost every important player in video/photo camera, console, television.</comment>


Secret contract tied NSA and security industry pioneer - <AUTHOR> http://www.reuters.com/article/2013/12/20/us-usa-security-rsa-idUSBRE9BJ1C220131220 <comment><USER2> NSA invents weak (Back Door present) crypto algo.

Pushes RSA to make it a Default in a key function (RNG) by giving them $10 Million.

NSA points to RSA as an early adopter and gets NIST to certify it.

Millions of systems are now protected by an RSA product that the NSA deliberately weakened.

Any sufficiently skilled rogue actor can attack virtually any business that uses these RSA products -

NSA (Cyber security Command) gets even more money to "Protect" us from said Rogue actors.

So all-in-all good investment on their part

Edit: Spelling fixed per commenter pointing out the difference between rouge and rogue. I did imply malicious actors not red-cheeked actors (not that they are mutually exclusive).

<comment><USER3> There's enough wrong with what the NSA has been doing, and enough reasons to encourage people to take an interest in how to curtail, or at least better police, their actions without resorting to tawdry conspiracy theories.

The NSA doesn't "protect" anyone. They are an intelligence agency. Their mandate is to collect information. The group you're thinking of, the one that's actually supposed to "protect" the network, is US Cyber Command: [http://en.wikipedia.org/wiki/United_States_Cyber_Command](http://en.wikipedia.org/wiki/United_States_Cyber_Command)

<comment><USER4> "As part of the National Security Presidential Directive 54/Homeland Security Presidential Directive 23 (NSPD 54), signed on January 8, 2008 by President Bush, the NSA became the lead agency to monitor _and protect_ all of the federal government's computer networks from cyber-terrorism." [Emphasis added]

[https://en.wikipedia.org/wiki/NSA#Mission](https://en.wikipedia.org/wiki/NSA#Mission)

<comment><USER5> Yes but their funding is not dependent on how secure RSA tokens are.

NSA did this to advance their mission, not to make a few extra bucks.

<comment><USER4> The point is that it advanced the intelligence gathering half of their mission while seriously compromising the protective half of their mission.

</comment></comment></comment></comment></comment><comment><USER6> Eagerly awaiting tptacek's retraction to his insistence that this was not a backdoor.

Edit: Nevermind, apparently he already did a mere 8 hours ago, replying to my own comment. Shortly before this broke.

[https://news.ycombinator.com/item?id=6941366](https://news.ycombinator.com/item?id=6941366)

<comment><USER7> Your reaction to this story was wondering if it can be used to demonstrate another member of HN being wrong in the past? Petty

<comment><USER8> When 'tptacek is wrong, he's obnoxiously wrong, _especially_ in his inability to believe in government misbehavior, and his willingness to denigrate "message board nerds" on that sort of matter. (See also his attacks on Greenwald when the Snowden story started.) So personally I was looking forward to seeing somebody comment about him.

<comment><USER9> Yeah, I get that a lot too. Also his attitude towards _open source_ cryptography related projects is strange and totally unjustified imho.

<comment><USER8> He's had a perfectly friendly attitude towards GPG, and in the case of others you can see ample evidence that his skepticism is justified. Maybe if the open source cryptography projects you're referring to weren't _bad_ projects then the attitude would be strange.

</comment></comment></comment></comment></comment><comment><USER10> > [...] but RSA said in a statement: "RSA always acts in the best interest of > its customers [...]

True, you just have to keep in mind that their customer is the NSA.

<comment><USER11> RSA is thinking they can claim ignorance in the case of the DRBG being weak / possibly backdoored.

<comment><USER12> They were either corrupt or incompetent. This can't look OK for them.

</comment></comment></comment><comment><USER13> From the BSAFE product page:

"RSA BSAFE Crypto Kernel offers versions of popular cryptographic algorithms optimized for both small code size and high performance. _Unlike alternatives such as open source, our technology is backed by highly regarded cryptographic experts._ " [emphasis added]

<comment><USER14> Typo; they left out "door".

</comment></comment><comment><USER15> _> > [https://news.ycombinator.com/item?id=6942165](https://news.ycombinator.com/item?id=6942165) tptacek 5 hours ago | link I am not generally a believer in the theory that NSA actively subverts Internet standards† †(my best guess is that the standards NSA was actively subverting were about international telephony; subverting the IETF is a little like subverting the Linux kernel --- doable, but bad tradecraft)_

Does this count?(not trying to be sarcastic or a smart-a##), I just want to get a handle on what I should or should not trust these days. Seeing that RSA SecurID VPN dongle pic in the article scared me. I've pretty much been looking to your comments to give me a baseline.

<comment><USER16> Personally, I think one of the things you can't trust these days are comments by tptacek.

<comment><USER17> Either you're insinuating that 'tptacek is a malicious actor, or that he's incompetent. That's a pretty serious allegation to make without providing any evidence whatsoever. Do you have any? I'm sure you can dig up a few examples of things that he said which were incorrect, but very few of those will not have been followed by a correction at some point, and either way your insinuations seem to go beyond "being wrong some of the time".

HN is incredibly fortunate to count members like 'tptacek as part of its community. We should be behaving in ways which encourage _more_ comments and commenters of his ilk, not less.

<comment><USER18> Unsurprisingly you're already being down-voted. For a community that prides itself on being rational and home to spirited debate, when it comes to the NSA, any contrarian opinions (or even alternative perspectives) tend to be quickly attacked and silenced.

If you read some of the first threads when the NSA revelations broke out, there are heated discussions with various viewpoints and arguments. Now, it appears that most of these users have become tired of being instantly downvoted, and instead avoid these subjects entirely.

I hope that tptacek continues to participate in these security policy discussions, not only for his extensive domain knowledge, but also because he is not afraid to voice beliefs that disagree with prevailing opinion. And right or wrong, its very refreshing.

<comment><USER19> > If you read some of the first threads when the NSA revelations broke out, > there are heated discussions with various viewpoints and arguments.

Always mixed with a steady groan of "enough of NSA stories" and "none of this is surprising". The heated discussions were in no small part about wether this was even the problem it was made out to be and wether it should even be discussed (to this extent).

Not that I agree with downvoting instead of replying, or with bashing tptacek (Everybody loves telling experts "I told you so". Doesn't make us experts tho :P), but I don't agree with your narrative either. It's not falsifiable, anyway. People might just as well have given up on trying to downplay this, and walked away instead, which would be even worse. Why speculate. Bashing and downvoting for disagreement without argument sucks either way.

</comment></comment></comment></comment></comment><comment><USER20> ...which is why Theo Deraadt is now suddenly everyone's best friend, despite his personality. :) OpenSSH and its mother project, OpenBSD, are now all that is left of our civilization's freedom to think.

Thanks, Theo, for never selling us out; for being such an uncompromising bastard; for not being like the RSA. May Athena gird you for war against the Spartans.

<comment><USER21> Most of what Deraadt says makes sense and I almost always agree with him but he can be an asshole. It has turned a lot of people off, from what I can see.

</comment></comment><comment><USER22> I wonder if any of the executives involved with this deal will have a moment of clarity and make a public statement - "I was directly told by representatives of the U.S. Government that if we did not take this deal there would be direct and material consequences for both my company and myself. Here is the names of the people I met with, here is a log of the meetings. If I am jailed or in some other fashion publicly discredited through an otherwise seemingly unrelated matter in the future, you should always remember that I have made this public statement."

<comment><USER23> Think of it from the executives perspective:

Option A: keep mouth shut, make a shit ton of money

Option B: become a martyr, face prison time

People like Snowden are rare.

<comment><USER24> >>People like Snowden are rare.

In all honesty, Snowden is a 30 year old single dude, and as far as I know, he doesn't have kids. Do you think he would have done what he did if he had a family to look after?

In my opinion a person's first responsibility is to their family. So yeah, if you're married (like these executives probably are) and you're facing the choice between option A and option B, you should absolutely pick option A.

<comment><USER25> So the nuclear family combined with a distributed economy is basically a convenient tool for justifying atrocities of all kinds. Just feeding the kids, right?

Maybe _not_ having kids is actually the morally correct choice, then?

<comment><USER26> Don't be a fool. You would let your children go hungry and live a worse life (directly because of your actions) out of principle? It's not simple. Having a family can be a beautiful thing. Not having one and spilling the beans on something morally reprehensible can be too.

<comment><USER25> >Don't be a fool.

Classy.

>You would let your children go hungry and live a worse life

No. Read what I wrote. The words are right there.

If the choice is "have children and commit evil to feed them" and "don't have children and don't commit evil", I choose the former. As should, I think, any right-thinking person.

The question is probabilistic. What are the chances that the former happens? What are the chances that the latter happens?

Choose accordingly.

The question is also systemic. There exists the possibility that forces larger than the individual have decided to normalize the nuclear family (and also romanticize the vision of having said family) in order to serve evil ends. What is the probability that that is the case? As time goes on, it looks _far_ more probable than we once thought. People like you think families are _in themselves_ beautiful. Any means justify the ends of preserving them. Seems like an _excellent_ tool for keeping a population right where you want them.

Look up the history of the nuclear family. Notice it didn't exist pre- industrialization. Why's that?

You're taking humans -> have children for granted. I'm arguing _against_ that dogma. Because as paradoxical as it may sound, it _is_ trite dogma at this point in wealthy societies. We don't _need_ these additional people, we don't _need_ this extravagant life. It's not a matter of survival anymore. So what is it all accomplishing? What's the end?

>Having a family can be a beautiful thing.

For my morality, concerns of beauty don't trump concerns of humanity. If my having children perpetuates a cycle of exploitation, murder, pain, suffering, etc. etc. etc, then I don't have children. Regardless of how "beautiful" my experience of those children may be. It really _is_ that simple.

And if a (wo)man tells me "I just did it to feed my kids" after committing some reprehensible act, I sympathize, because (s)he made a terrible decision in having children to start with. But I still condemn him/her.

<comment><USER27> That's a good point actually. Maybe we need more ethical loners without emotional attachments in a positions of power.

<comment><USER28> Like a celibate priesthood?

<comment><USER25> I here note that one can be sexually active without reproducing. No children doesn't imply celibacy.

<comment><USER28> Certainly the case. Historically, less the case but still the case...

</comment></comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER29> The end of RSA (the company)? I find it absurd that a _security_ company no less, would hear many veteran cryptographers say this is backdoored a decade ago, and _still_ going ahead and using it - as the default! Who stakes the whole reputation of their company in the field for a meager $10 million (I assume RSA was pretty big back then, too)? It's insane.

RSA, much like NIST, can not, and should not be trusted any longer. All of their customers should be warned, and advised to quit them ASAP. Companies need to learn this is just unacceptable.

<comment><USER30> Serious question: Is there an alternative? I've never seen a secure fob that wasn't from RSA.

<comment><USER31> I like Yubikeys: [https://www.yubico.com/](https://www.yubico.com/). They show up as a USB keyboard, so you don't have to type the codes in.

There are some disadvantages. Yubikeys use a shared secret instead of public key crypto. Also, the one-time password is iteration-based, not time-based. On the bright side, you can program Yubikeys with your own secrets. They may not be as secure as properly configured RSA tokens, but they're much better than authing with just a password or client cert.

<comment><USER32> Yubikey NEO (latest revision) is like the one you already have + a java card that comes with a PGPcard app (and supposedly, you can write your own apps)

They don't have a timer like the RSA key fobs, and need a USB or NFC connection - but are generally very reliable, and given their constraints.

The questiion, of course, is what reason you have to believe that yubico (and for that matter, gemalto, g10code and the rest) are not similarly in bed with the NSA.

<comment><USER33> Trusting trust :) This is one of, but not the main reasons why we build our own (Bloomberg B-Unit, PDF is the only good pic I see: [http://www.bloomberg.com/professional/files/2013/11/b-unit_3...](http://www.bloomberg.com/professional/files/2013/11/b-unit_3_user_guide.pdf))

<comment><USER34> Quis custodiet ipsos custodes?

Speaking of "trust", Bloomberg lost quite a lot of it when their reporters spied on their customers.

Bloomberg Spying Went On For Years After Execs Knew: Report [http://www.valuewalk.com/2013/08/bloomberg-spying-went-on- fo...](http://www.valuewalk.com/2013/08/bloomberg-spying-went-on-for-years- after-execs-knew-report/)

You were probably just as horrified as most of the other employees at Bloomberg when that info became public. The bad apples cost Bloomberg a lot of reputation. My point is that "trust" is very elusive, very easy to lose, very hard to gain.

OTOH, are the "bad apples" at Bloomberg who condoned that behavior still in positions of power? Did they even get a slap on the wrist? If _I_ were at Goldman, JPM, Citi, etc. I wouldn't "trust" Bloomberg until I saw some higher up people fall on their sword for that fiasco.

<comment><USER35> If I were at Goldman et al. I would expect Bloomberg to treat employees that successfully use underhanded tactics, as business as usual, the same way I would probably have seen such employees (and maybe myself) treated by my own organization: "Job well done boys, but you better cool it for awhile. BWA ha ha ha! Have a cigar and a hooker."

</comment></comment></comment></comment></comment></comment></comment><comment><USER22> Perhaps I am not reading the article correctly, but it sounds to me like RSA products can no longer be trusted.

<comment><USER36> No, it sounds like no product from any American company can be trusted as long as the current regime is in place.

At least that's the message that comes through loud and clear in the rest of the world.

<comment><USER37> What makes you think the NSA isn't willing to work with countries outside of the US, either directly or through another spy agency?

<comment><USER38> Willing, sure, but probably less able, at least outside of the close allies like the UK.

<comment><USER39> Why less able?

<comment><USER38> Are you seriously asking why a branch of the the USA's government has less power outside of the USA?

<comment><USER40> if you consider the fact that the nsa and cia often collaborate closely, and then look at the amount of influence the cia has often displayed in the past, towards foreign countries/regimes etc., gejjaxxita's question seems quite reasonable.

<comment><USER41> Plus the blackmail opportunities spying affords.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER42> The NSA's story about how they need to secretly do these things to fight the war on terror makes less sense with each new revelation.

Terrorists don't use VPN dongles.

What is really going on here?

<comment><USER3> Heh...I certainly had a good chuckle at this comment. I don't honestly think that the NSA ever paid more than lip-service to the "war on terror". They've been doing the same job since long before Sept. 11, 2001. Before the "war on terror" it was the "cold war", there just happens to have been an awkward gap in between...

The NSA is in the business of Signals Intelligence. Their job, plainly stated, is to have access to _as much_ communication between _non-US_ entities as humanly possible. What makes their job difficult is that, over the course of the last few decades, it's become increasingly the case that much of the communication between non-US entities travels via US-based channels using technology originated in the US. Somewhere along the line, when forced to balance "as much communication" and "non-US entities", the NSA clearly chose in favor of accessing those communications at any cost.

<comment><USER43> This is a very well-put comment.

The core cause there would seem to be sharing comm channels with foriegn actors--the same thing that makes our position with regards to the 'net so awesome also means that the NSA is kind of forced to get involved closer to home. It's a tricky tradeoff.

<comment><USER3> It's the same reason you never see James Bond negotiating with foreign heads of state. You don't send an assassin to do a diplomat's job. Everything that is being revealed about the NSA's actions, this buying of influence especially, is positively reprehensible... _BUT_ it is important to keep an eye on where the blame really lies: with the people that let their assassins dictate their foreign policy and domestic priorities.

</comment></comment></comment></comment><comment><USER44> Not surprised.

One of the security guys who worked for General Magic (GM made an early mobile OS with some security features) told me that he had a visit from the NSA. The NSA tried to get him to leak bits of the keys in the GM protocols. "Just here and there. I've got dozens of these," said one of the NSA reps.

This would have been early 90s.

The NSA has been doing domestic stuff like this for a long time.

</comment><comment><USER45> $10Mi? That's a very cheap price for trashing your companies reputation.

More importantly, it confirms that DRBD is backdoored or at least weak enough to be subverted.

<comment><USER46> "it represented more than a third of the revenue that the relevant division at RSA had taken in during the entire previous year"

</comment></comment><comment><USER47> Lucky Green was the first to mention this: [http://lists.randombit.net/pipermail/cryptography/2013-Septe...](http://lists.randombit.net/pipermail/cryptography/2013-September/005341.html)

</comment><comment><USER48> "RSA, now a subsidiary of computer storage giant EMC Corp, urged customers to stop using the NSA formula after the Snowden disclosures revealed its weakness." \- Just shake my head at this. As news is revealed that all these companies were complicit, they cry foul and "warn" users? RSA deserves to lose all international customers who refuse to buy their products because of hidden backdoors.

<comment><USER49> Quote possible that one arm of the company was an aware of the other arms actions. Probable, in fact. If most of the company knew of the backdoor, it would have leaked.

</comment></comment><comment><USER50> When the news about DUAL_EC_DRBG first came out, RSA defended their actions of inclusion and _making it a default option_ by stating that it was at the time a popular choice. Back then I was aghast that a noted security company would make choices based on pure hipsterism. (My apologies to all hipsters, but in this case the word is in place.)

This news on the other hand makes it clear that RSA was not only being incompetent. They were being _actively malicious_. We've already seen anecdotes in this thread about NSA making house calls to security product vendors as far back as the 90's, so we must assume they haven't given up that venue and are still pushing their ideas, as well as pushing the vendors.

With that proof comes something a lot bigger: every single security product from a US company is now suspect. By logical extension, I will say that similar paranoia should be applied to all security products from Five Eyes countries.

The long-term financial fallout should be interesting material for future chroniclers.

</comment><comment><USER51> Shouldn't this destroy RSA as a company? If your in security, and your security can't be trusted...

<comment><USER52> It should, but AT&T's still in business and their collaboration with the state to spy on customers has been known for a long time.

<comment><USER51> AT&T is explicitly selling "we connect you", not "we secure you."

</comment></comment></comment><comment><USER53> RSA is commercially dead. There's no excuse.

Also, closed-source hardware HSMs are blackboxes that are fundamentally paranoia-inducing. There's no reason to trust that the vendor, supply chain and/or manufacturers didn't backdoor them or introduce other attack surfaces. The only way to trust an implementation is decap a sample of ASICs and match features against masks you generated... from sources you trust (whether open source or yours).

If it's a black box, there's no way to trust it (all modern CPUs, N/S-bridge, memory, flash (ssd), hd controllers, on and on.)

Conclusion: We need more open-source hardware that is production-quality (BSD licensed)! This would be very expensive in terms of people time, but it's necessary move since corporations can't be trusted.

<comment><USER11> Not necessarily. Organisations which wish to cooperate with the government (and they are legion) may still consider RSA. Though one wonders if NSA advised government organisations to avoid RSA. Hmmm.

</comment></comment><comment><USER54> I use one of these tokens for work. Spying is one thing but destroying encryption is another evil thing to do. If the NSA has introduced bugs in crypto then who's to say someone else can exploit the same crypto.

<comment><USER55> i wonder if Snowden has any detailed info on the NSA indroduced/forced backdoors (he obviously was aware about their existence in general like pretty much everybody in the world who isn't a tptacek's religious follower) and this or something like this is what keeps him alive - ie. NSA is afraid of dead man switch while other side(s) hopes that Snowden will reveal more and specifically useful for actual hacking info with time.

<comment><USER56> so that's the thing that scares me

a nsa official just did an obvious trial-balloon of pardoning snowden in exchange for return of all the docs [1]

but now that snowden is in russia, you have to assume that many nation-states have seen all these docs. so really, the nsa is worried that _you and I_ will see them

fucking amazing

[1] [http://www.theguardian.com/world/2013/dec/15/nsa-edward- snow...](http://www.theguardian.com/world/2013/dec/15/nsa-edward-snowden- amnesty-documents)

<comment><USER35> The conditions for the pardon have never made sense, because as I understand it Snowden has already shared most if not all of his information with at least Greenwald and Poitras. He no longer has control over what will be shared with the public.

</comment></comment></comment></comment><comment><USER57> Who in their right mind would use an American technology product at this point? You would be an idiot to think that it wasn't backdoored by the NSA.

<comment><USER25> Unfortunately, I think there's still a pretty large market of people who just don't give a crap about being NSA'd. Nothing to hide, and all of that.

That said it's likely individual consumers who are likely to have this attitude rather than businesses.

</comment></comment><comment><USER58> Seems like their customers now have an excellent case for commercial fraud against RSA.

</comment><comment><USER59> the r in rsa is ron rivest who was responsible for some very elegant ideas. his papers, that i've read, are generally very simple and clear. but he also wrote md2 [an old hash, n longer used] which contains some "magic numbers" that no-one can explain. they are supposed to be derived from pi, but no-one knows how... [http://crypto.stackexchange.com/questions/11935/how-is- the-m...](http://crypto.stackexchange.com/questions/11935/how-is-the-md2-hash- function-s-table-constructed-from-pi) (i even emailed him, but was shrugged off; i know it's silly and paranoid, but...)

anyway, i wonder what happens now to all the customers that use rsa dongles? big, international, political organisations...

</comment><comment><USER60> TLDR: "RSA's contract made Dual Elliptic Curve the default option for producing random numbers in the RSA toolkit."

Dual_EC_DRBG was a NIST standard.

<comment><USER61> From the article:

 _" RSA adopted the algorithm even before NIST approved it. The NSA then cited the early use of Dual Elliptic Curve inside the government to argue successfully for NIST approval, according to an official familiar with the proceedings."_

</comment></comment><comment><USER62> If it only cost $10m to bribe one of the biggest security companies around, how much does it cost to bribe a single open source developer who volunteers on tools like OpenSSL? What if you add blackmail to the mix?

Makes me realize that we need bitcoin-style "hack or bruteforce our encryption schemes and you can legitimately get paid lots of money" bug bounties.

<comment><USER63> This is why you want some people who are _not_ primarily motivated by money. (Neither necessarily ascetics.)

In turn, why you want a society where a decent quality of life is not just obtainable but reliable without an all-consuming level of competition with others. (E.g. an independent researcher can actually gain access to and participate in a large and reasonably priced health insurance risk pool. And where money is not the overriding, if not sole, determination of judicial proceedings.)

Going _very_ general in my comment, security is both a community effort and a personal responsibility. The more we "outsource" our own security ("Just trust us." \-- Three Letter Agencies and private contractors), the more the price goes up while the quality of the results goes down.

You get the government you pay for, or... if you are more concerned about a quality, effective government, the government _you participate in_.

Hopefully, the pendulum is beginning to swing back from "pay for" to "participate in".

<comment><USER64> > In turn, why you want a society where a decent quality of life is not just > obtainable but reliable without an all-consuming level of competition with > others.

Is financial instability really a problem for most people qualified for this type of work? I imagine most of these people are approaching or well within the 6 figure range and that accepting some sort of bribe would just be icing on top.

</comment></comment></comment><comment><USER65> Reminds me of [http://xkcd.com/538/](http://xkcd.com/538/) except instead of a $5 wrench, it was $10 Million and a few handshakes.

</comment><comment><USER66> I remember looking over EMC's acquisitions when all of this starting breaking. EMC acquisitions just read like someone building a surveillance system: RSA, multiple deep packet inspection companies, enterprise clustered postgres, elitigation, forensics and threat analysis, Government-risk-analysis... and if you google around you'll see they kept their investments as secret as they could.

[https://angel.co/emc](https://angel.co/emc)

EMC bought every single major corporate partner technology in 2009/2010\. EMC is the private honeypot for the entire program. The corporate store is EMC and only EMC. EMC and EMC ventures can go to hell for building this, knowing about it, and continually profiting from it. Profit from investment in a partner of an illegal government program specifically designed to make illegal money from human rights violations should be considered illegal. All of the major money behind EMC knew what was going on. If you did a private benefit analysis, it would be all EMC. Thank you. =)

</comment><comment><USER67> In case you didn't know, EMC bought RSA in 2006. Shutting down RSA just means re-branding all the products as something else.

</comment><comment><USER68> Reuters just broke this link. So here's the new one:

[http://www.reuters.com/article/2013/12/21/us-usa-security- rs...](http://www.reuters.com/article/2013/12/21/us-usa-security-rsa- idUSBRE9BJ1C220131221)

</comment><comment><USER69> I believe we heard that some months before already. The biggest problem is IMHO their libcrypto still being used in Java and MS Windows.

</comment><comment><USER70> From Mikko Hypponnen:

[https://twitter.com/mikko/status/414147944984485889](https://twitter.com/mikko/status/414147944984485889)

"I'm ashamed on behalf of the whole industry."

</comment><comment><USER71> It's going to be interesting what this does to the RSA Conference in SF 24-28 FEB; I wonder if people will pull out, or what?

I'm looking at how to incorporate this as an example in my talk.

</comment><comment><USER72> > "RSA always acts in the best interest of its customers and under no > circumstances does RSA design or enable any back doors in our products. > Decisions about the features and functionality of RSA products are our own."

This means one of two things: Either this is a blatant lie by RSA, or RSA is not competent enough to evaluate cryptograpic algorithms. Neither possibility paints them in a favorable light.

<comment><USER35> "under no circumstances _does_ RSA bla bla ..."

"Does." Present tense. Doesn't say anything about what happened in the past. Maybe their contract even included NSA services to launder language to be plausibly deniable, since that has also emerged as one of the NSA's core competencies.

</comment></comment><comment><USER73> This is going to end RSA

<comment><USER53> The reaction from the average IT architect is to just select another vendor that provides yet another closed-source, blackbox hardware security solution, backdoored by who know which government(s) &| other entities. Open source hardware is (un)fortunately a necessary requirement (verilog/vhdl, firmware sources and no blackbox SoCs), samples of which are periodically verified by destructive and nondestructive means. Very, very costly, but doable and raises confidence.

</comment></comment><comment><USER74> We already knew back in September that this was happening. All this story adds is details about the actual contract between RSA and NSA.

</comment><comment><USER75> Its a sad commentary on a lack of ethics in parts of the tech industry. This industry isn't leading us where we want to go.

<comment><USER76> It is taking us towards a libertarian utopia where those with money decide where we go.

</comment></comment><comment><USER77> Privacy: Pre-internet term(from Latin: privatus "separated from the rest, deprived of something, esp. office, participation in the government", from privo "to deprive") used to describe the ability for human beings to seclude themselves or information about themselves and thereby reveal themselves selectively.

</comment><comment><USER78> Please forgive my ignorance of these kinds of security issues....

I remember at one point, way back when, it was recommended to use RSA keys over DSA, when creating an SSH public key. Is this this the same algorithm, by the same company?

Does this mean that SSH can't be trusted if you're using an RSA key, versus some other type?

<comment><USER8> No, it doesn't mean that at all. RSA is the same algorithm based on [https://en.wikipedia.org/wiki/RSA_%28cryptosystem%29](https://en.wikipedia.org/wiki/RSA_%28cryptosystem%29) as it always was, and it and its use in openssh have received lots of scrutiny. That the company has the same name is immaterial.

</comment></comment><comment><USER47> This reminds me of the MS-Novell deal, which was done in a similar way and has similar problems.

<comment><USER49> But "everyone" agreed it wasn't actually a backdoor. I wonder if that will get walked back finally.

</comment></comment><comment><USER79> Was this money tax free? How does that sort of thing work?

I hope bsafe licensees sue. Any one know of any serious efforts to replace some of the standard cipher suites in common code? AES -> Serpent, SHA -> Whirlpool etc...

</comment><comment><USER80> Wikipedia is updated: [http://en.wikipedia.org/wiki/RSA_(security_firm)](http://en.wikipedia.org/wiki/RSA_\(security_firm\))

</comment><comment><USER39> I'm getting a "Page Not Found" message.Here's another version of the article: [http://www.reuters.com/article/2013/12/20/us-usa-security- rs...](http://www.reuters.com/article/2013/12/20/us-usa-security-rsa- idUSBRE9BJ1C220131220)

<comment><USER81> That did not work for me either.

</comment></comment><comment><USER82> What implications does this have for RSA?

<comment><USER83> Hopefully the end of them. It's the only thing that matters to these mercenaries...

<comment><USER34> I strongly agree.

Crypto is something where reputation is sine qua non. After the 2011 data breech they lost a lot of it. Now how can anyone trust them ever again?

</comment></comment></comment><comment><USER75> [http://www.techweekeurope.co.uk/news/rsas-art-coviello- anony...](http://www.techweekeurope.co.uk/news/rsas-art-coviello-anonymity- enemy-privacy-130539)

Paid shill

Want to see money flow from federal government to RSA and EMC over time.

</comment><comment><USER84> What is the likelihood that anyone will face investigation or prosecution over this?

</comment><comment><USER85> Any European citizen know what is needed for the European Commission for Competition to put a tariff to American imports so they stop destroying the European industry making undeclared and illegal subsidies?

</comment><comment><USER86> Louis Althusser's coinage of RSA as "Repressive State Apparatus" in _Lenin and Philosophy_ seems deliciously ironic now.

</comment><comment><USER87> Goodbye RSA and thanks for all monopolistic practices and shitty products. ALL CRYPTO SHOULD BE OPEN SOURCE AND PATENT FREE!

</comment><comment><USER88> NIST, NIST, NIST.... wait, aren't those the same guys we were supposed to trust on the 9/11 commission report....

</comment><comment><USER89> 10M sounds like a downpayment, I dont believe RSA would lay their cred on the line for such a paltry amount.

</comment><comment><USER90> So RSA sells its customers for $10 million, and NSA wastes $10 million.

</comment><comment><USER91> EMC own RSA. We just purchased a bunch of EMC kit. Can we trust it?

</comment><comment><USER92> Are my RSA PGP keypairs now compromised? How do I tell?

</comment><comment><USER23> I'd love to see a class-action lawsuit.

This shit must be punished.

</comment><comment><USER93> I don't know anything about RSA as a company. What does this say about RSA as an algorithm and the company's founders?

</comment><comment><USER94> How does this affect the average consumer?</comment>


Centrifuge - Redis for presence/history data, Bootstrap 3.0 for web ui and more - <AUTHOR>

Hello, friends!
Several months ago I released first version of Centrifuge on Github (https://github.com/FZambia/centrifuge).
This is a platform for real-time message broadcasting in web applications. Like Faye (http://faye.jcoglan.com/) or Pusher.com/Pubnub.com services.
It isn't so powerful and mature like projects above. But it works. And we all know that making software to work is the first important step.
It's built on Python using Tornado, ZeroMQ and Redis. Clients from browsers can communicate with Centrifuge using pure Websockets or SockJS library.
During last months I was working on presence and history support for channels. Today I've merged that branch in master. There are lots of other changes which made Centrifuge better.
Here I encourage you to take a look at this project. Some criticism and advices are very welcome. <comment><USER2> It might help if you explain what this project is or does.

<comment><AUTHOR> yep, when you want real-time page updates on your site (chat, comments, counters, games) you should generally use some kind of asynchronous backend to achieve this. Centrifuge is a message broker to which clients from browsers connect, after connecting clients subscribe on channels. And every message which was published into channel will be broadcasted to connected clients. There is documentation - [https://centrifuge.readthedocs.org/en/latest/](https://centrifuge.readthedocs.org/en/latest/), also screencast - [http://www.youtube.com/watch?v=RCLnCexzfOk](http://www.youtube.com/watch?v=RCLnCexzfOk)</comment></comment>


Releasing code should be no less harder than making a push to the repository - <AUTHOR> https://twitter.com/BuddyGit/status/785820043363938304 <comment><USER2> Does it work with Gitlab?

<comment><USER3> Sure, It works with Github, Bitbucket and Gitlab</comment></comment>


Why It Was Easier to Be Skinny in the 1980s - <AUTHOR> https://www.theatlantic.com/health/archive/2015/09/why-it-was-easier-to-be-skinny-in-the-1980s/407974/?single_page=true <comment><USER2> The article does not answer the "why" at all. Just some theories that might or (maybe more likely) might not be the explanation

</comment><comment><USER3> see also:

[https://aeon.co/essays/blaming-individuals-for-obesity- may-b...](https://aeon.co/essays/blaming-individuals-for-obesity-may-be- altogether-wrong)

tldr even lab animals are getting heavier.

my favorite explanation is greater control over our temperature uses less metabolism.

</comment><comment><USER4> When I was growing up, I was always very skinny. Now I take Remeron (Mirtazapine) and have gained about 20% (19 kg / 40 lbs) over baseline (90 kg / 200 lbs), although I also stopped working out as much due to lifestyle changes. Now take Metformin for both weight loss and possible life-extension. I also cut out carbonated diet beverages after their links to increased hunger.

I'm on a mission now to increase activity to help with ghrelin and leptin levels.

<comment><USER5> What does skinny mean? Are you American? If so I have a feeling our definition is going to differ. For me skinny means 100 lbs.

<comment><USER6> 100 lbs is useless without height. So you wouldn't consider a 6' 3" person weighing 130 lbs skinny? I think the usual definition would be underweight (or near the low side of underweight) in a BMI sense.

<comment><USER7> 5' 7"</comment></comment></comment></comment>


Can't I please just visit one friend? - <AUTHOR> http://statnet.org/COVID-JustOneFriend/ <comment><USER2> I'm not sure about a detail in this model. If you can visit one friend, that friend can only visit you?

<comment><USER3> I think it has to be tighter even than that. If you visit that friend, that friend can only visit you, and nobody in either your or your friend's households can visit anybody at all.</comment></comment>


The Tinkerings of Robert Noyce (1983) - <AUTHOR> https://www.esquire.com/news-politics/a12149389/robert-noyce-tom-wolfe/ <comment><USER2> It's a great piece but the unqualified attribution of credit for the 'invention' of the microprocessor to Ted Hoff without mention of the team that made it happen - (especially) Federico Faggin, Masatoshi Shima and Stan Mazor - is unfortunate, but seems consistent with Intel's handling of the issue at the time the article was written.

<comment><USER3> It's a magnificent piece of writing that chronicles a fantastic voyage. How did it come to be?

> In 1983, Esquire commissioned journalist Tom Wolfe to write a piece on > Robert Noyce for its anniversary issue, which would profile 50 Americans who > had a profound and positive impact on American life during Esquire's 50 > years of existence. The magazine featured other famous writer-subject > pairings, a piece by Kurt Vonnegut on Jackson Pollock and another by Norman > Mailer on Jacqueline Kennedy Onassis. But Wolfe's "The Tinkerings of Robert > Noyce" would have a unique legacy. One historian called it "perhaps the most > celebrated piece of journalism about Silicon Valley" and maintained more > than 30 years after its publication that "it still stands as the most famous > description of Intel and its singular corporate culture."

[https://newsroom.intel.com/articles/intel-50-tom-wolfes- tink...](https://newsroom.intel.com/articles/intel-50-tom-wolfes-tinkerings- robert-noyce/#gs.d5dmy3)

</comment></comment><comment><USER4> Posted many times but not much commenting - I thought there had been a larger thread?

2018 [https://news.ycombinator.com/item?id=17212210](https://news.ycombinator.com/item?id=17212210)

2017 (1 comment) [https://news.ycombinator.com/item?id=14650795](https://news.ycombinator.com/item?id=14650795)

2015 (1 comment) [https://news.ycombinator.com/item?id=10092652](https://news.ycombinator.com/item?id=10092652)

2014 [https://news.ycombinator.com/item?id=8133479](https://news.ycombinator.com/item?id=8133479)

The revised version "Robert Noyce and His Congregation" was also discussed, also not very much:

2014 [https://news.ycombinator.com/item?id=8135553](https://news.ycombinator.com/item?id=8135553)

<comment><USER5> How do you follow Tom Wolfe?

<comment><USER4> I'm tempted to say "In a van?" but actually I don't understand your question.

<comment><USER5> Hah, I was thinking that the article was such an excellent piece of writing by someone so prominent, commenting on it is like performing on stage after Elvis.

That article really does capture the origin of a lot of tech company culture well. Grove's books were required reading for managers at a couple of companies I was at. The article should be part of any CS syllabus to understand the culture that produced the tech we have today.

<comment><USER4> I get it now! Indeed.

</comment></comment></comment></comment></comment><comment><USER6> Great BBC documentary about chip manufacturing from 1977:

[https://www.youtube.com/watch?v=HW5Fvk8FNOQ](https://www.youtube.com/watch?v=HW5Fvk8FNOQ)

Robert Noyce and Intel are featured (although IIRC Intel is never named). Noyce appears starting around 9 mins in, followed by a detailed look around the fab.

Was this the first and last time that Intel allowed cameras around their fabs? I'm pretty sure it would never be permitted today.

Also the first time Noyce appears he's flipping through chip masks for the 8080!</comment>


Ask HN: To launch or not to launch - <AUTHOR>

I've been working on a B2B SaaS billing site for almost a year now, we never officially "launched" it - but signup has always been open to South Africans only. With just local users the business model has already proved profitable.
The question I'm stuck with now, is do we launch it internationally as soon as possible (after a couple days work with timezones and currencies) or do I wait till we're better equipped to deal with the traffic and growth.
1. We're a very small team at the moment, we're trying to hire urgently but unfortunately the task of finding top notch developers locally is more than a little challenging. A big concern is if its popular it is unlikely we'll be able to scale quickly enough (support wise, and service wise) -- our plates are pretty much full as it is.
2. I've been following the "move fast and break things" philosophy. I've achieved very rapid development (I'm the only developer), but it has come at the cost of occasionally broken parts of the site (generally for less than an hour). With < 500 users this hasn't been a problem, but I'm assuming it will be once we've launched internationally. Also 'service standards' in South Africa are far worse than the rest of the world - which means our current users are generally far more forgiving than we expect international users to be.
3. I'd like to wait for the API to be ready (another post on that later). I've been working on an experimental API that I believe is pretty "cool" (you can browse it and test it out with a standard web browser)
Has anyone here ever launched too early and regretted it? Vice versa has anyone wished they launched earlier? <comment><USER2> Well as it has been proved to be profitable and you already have clients, it's up to you do decide it(well... it has always been up to you) as you are probably the only who know how big your public will be. If you are afraid of stuff breaking up/it not scaling so well and so on, work on it until you feel satisfied. As you already said, it's B2B and service standards may vary from country to country. A good experience would be try to get some clients from another country with "high service standards" and try to give them some benefits to try it out the services(for free maybe?) and if the feedback is good enough you launch it.

If you would like to wait for the API to be ready, just do it. I know that there's a lot of people that would say that "launch it with 50% done" or something, but the person that know your product best is YOU.

I hope you have much success with it!</comment>


Ask HN: Statically typed, high level language for machine learning? - <AUTHOR> Hi, I've been self-teaching machine learning the last few months. Python seems the only option, but I don't like dynamically typed languages. Python doesn't even have constructs for making a variable immutable.
Also, I think type hints aren't a in the right direction, comparing it with type inference and generics in Haskell, for instance.
Is there any alternative? <comment><USER2> > Python doesn't even have constructs for making a variable immutable.

recent addition into `typing_extensions` allows that:

from typing_extensions import Final immutable_str: Final[str] = "cant change me"

mypy will then notice you in case the variable has been changed somewhere.

> Also, I think type hints aren't a in the right direction, comparing it with > type inference...

that's quite vague statement, but mypy supports type inference to some extent - if you'll initalize a list with some strings in it, it will infere the type as list of strings etc

</comment><comment><USER3> Other languages won't have as many high-quality libraries. Maybe something like MyPy?

[http://mypy-lang.org](http://mypy-lang.org)

<comment><AUTHOR> That's right, but imho type hints are no the way to go, specially when many types could actually be statically inferred by the compiler/interpreter.

Perhaps the solution would be a full blown programming language which transpiled to Python the same way Typescript does. So, MyPi, but much more developed: interfaces, type inference, generics... Having access to all the Python libraries.</comment></comment>


Building a Docs Site with Jekyll + GitHub Pages - <AUTHOR> http://blog.jetstrap.com/2013/03/building-a-docs-site-with-jekyll-github-pages/

<comment><USER2> After going through the pain of keeping separate repos, branches or even apps for content pages, my team migrated to simply using a CMS.

Wordpress is a bit of a pain, but we found Harmony (<http://harmonyapp.com>) to be great at serving pages with programmable themes (think haml, sass, etc) that marketing people can still edit without bothering a developer.

<comment><USER3> Well, the CMS is the classical way to do it. Using Jekyll and Github is a more recent and innovative way to do stuff, much simpler to use for developers and cheaper because it's free hosting that can scale pretty well.

Of course if you want marketing people to edit stuff asking them is use Git is going to be painful.

<comment><USER4> Install the GitHub app, then tell them to follow these steps: 1) Make your changes. 2) Write a word or two about the changes here (commit subject). 3) Press this button (commit) to record the changes. (repeat 1-3 if desired) 4) Press this button (sync) to sync your changes with your colleagues.

</comment></comment></comment><comment><USER5> Nice writeup. The whole "your docs site is just on a different branch" has always been weird to me though. I'm not sure what a better way to do it would be but I don't like these two options: switch branches inline or have a separate clone of the repo.

<comment><AUTHOR> Yea, but theoretically you could set up a new remote repo just for the site, and use a specific branch for it. I think the convenience is well worth the change in process you have to deal with.

</comment></comment><comment><USER6> What alternatives to people recommend?

<comment><USER5> Not the same thing (since this isn't an API), but I like what balanced does: <https://github.com/balanced/balanced-api></comment></comment>