AI-powered laundry-folding robot company has filed for bankruptcy - <AUTHOR> https://www.theverge.com/2019/4/23/18512529/laundroid-laundry-folding-robot-seven-dreamers-bankrupt-ces <comment><USER2> You have to admit the washing machine is one of wonders of the modern world, yet taken for granted. Until they were invented, a wife or servant essentially devoted most of a whole weekday to washing clothes. A washing machine and dryer cuts this to a couple hours a week. Clever people seek to cut this time even further.

<comment><USER3> But it turns out that washing machines didn't do much to save time. In the past people just didn't wash their clothes as often. Now people will wash their clothes after a single wear, and it's still mostly women who are doing the washing in families.

[https://twitter.com/TimHarford/status/1113123861602713600](https://twitter.com/TimHarford/status/1113123861602713600)

[https://twitter.com/DeconinckKoen/status/1054097445351776256](https://twitter.com/DeconinckKoen/status/1054097445351776256)

<comment><USER4> "washing" is a euphemism for pressing a button, though

<comment><USER5> This is a gross oversimplification, especially washing in a family (> 1 person).

1\. Sorting - when you buy clothing, do you take handling instructions into account? Accounting for handling is very hard! Good luck shopping online, hunting through instruction tags hidden on sides of clothes, all while keeping price reasonable. I do not like shopping, so I choose the first thing that looks ok and is comfortable - I am often left with unpleasant surprises when laundering. Some dryclean only, some handwash-only, some fine with washing but no dryer, some with dryer ok but tumble-dry only.

2\. Do you have an in-unit washer? I do not - I traverse 7 flights of stairs to communal apartment laundry room.

3\. Do you need to use quarters for the machine? If yes, this takes an extra trip to bank beforehand.

4\. 7 flights of stairs again to transfer _some_ of the clothes to a dryer, others ...

5\. ... Need to be line-dried and hung, somewhere.

6\. Finally, the clothes that could be normally washed must be folded and put away, not stuffed into a drawer (even simple t-shirts get wrinkled this way).

"washing" is _not_ just pressing a button.

<comment><USER6> Step 1 becomes progressively easier after each wash. Steps 2, 3, 4 are completely eliminated by having an in-unit washer as you said, like most families in western Europe do at least. Step 6 is also pretty quick with practice.

<comment><USER7> Step 6 is quick for a couple of adults. Add in kids, though, and takes an order of magnitude longer—especially when the kids are both young enough to be going through multiple outfits per day and are asleep (thereby restricting the ability to put clothes away) during the best times to do chores.

</comment></comment></comment></comment></comment></comment><comment><USER8> Folding arbitrary pile of laundry completely unsupervised is super hard problem. I actually have more faith in solving self-driving before that :). It seems company was Japanese, used loan model (as opposed to VC funding) and went bankrupt probably because creditors went after them. Their machine cost $16,000. The article describes scenario at CES where someone tried giving it black t-shirt but apparently machine couldn't see it and got jammed! It also occurs to me that many people hang their cloth with hangers in closet instead of folding. Business proposition seems to be bit limited.

<comment><USER9> > Folding arbitrary pile of laundry completely unsupervised is super hard > _computing and robotics_ problem

FTFY. And the business proposition isn't "limited", it's stupid. An attempt to throw technology somewhere it _cannot_ compete.

The opportunity cost for that $16k is paying somebody minimum wage to fold clothes for you for over 2000 hours. That would last a family of four about _38 years_ (just folding). Cleaners, housekeepers, nannies, etc all offer this sort of service, and more. Cleaning, ironing, folding, putting away and because of the lack of skills, and the availability of people to do it, they usually can't charge that much for it.

This robot took up a ton of space, barely worked by all accounts, did untold damage to clothes that got caught, and didn't do any other part of the cycle. I don't know how you can call that a proposition. It's neat but it's not saleable.

<comment><USER10> This version. It isn't ready yet. If they do a $2k robot that finds my dirty clothing on the floor and puts clean clothing in the correct closet/draws (my kids, wife, and mine...) and I'm interested. Laundry takes a lot of time, and paying someone isn't really cost effective.

<comment><USER9> I'll start positively, by agreeing. Yes, if you can make a robot for $2k that does all that, cooks and cleans, perhaps teaches the kids to ride their bikes, dispenses oral sex, etc, again yes, they will sell and sell _fast_. But that's really a very significant distance from what we have, which is a constellation of very expensive robots that are demonstrably worse than humans at doing tasks unskilled humans are pretty good at.

Even at the most basic level, a vacuum cleaner... It wasn't until last year that there was a self-emptying model. It still insanely slow. It's suction is still objectively awful. It still gets blocked up by anything hairier than a large cat. It still can't get into certain places. But that's going to be $1000 and you're still going to have to set it up, fix is when it breaks, etc.

A $200 stick vacuum and 10 minutes/week cumulative contact is much better. That $800 saved could pay for somebody to do that vacuuming (and more!) for you for 100 hours. Really, tell me what's more "cost effective".

But yes, if we somehow get a magical level of robot that can transcend stairs on their own, carry 20KG of washing up and down, fold it all up, put it away... That would be worth $2k. But that's just a robotic unicorn at this juncture.

<comment><USER11> 8$/h for vacuuming? No way unless you're abusing illegal immigrants.

<comment><USER9> Minimum wage for cleaners is standard _here_ , but whether or not that tallies with your experience will probably depend on the cost of living where you are.

</comment></comment></comment></comment></comment></comment><comment><USER12> Lets remember that failure is an expected part of the game. Most ambitious product r&d projects fail quitely, inside big companies. Folding laundry is a famously hard problem.

Lets also remember that _I_ really want a wardrobe that takes my dirty clothes and restocks itself with clean clothes.

<comment><USER13> I remember reading long ago that something like 70-90% of new startups are dead by the 7th year. It's not that big of a deal.

Edit: Small business rates are a bit better as startups require a bit more than just some revenue but some growth metrics. VC-backed companies fail at a pretty high rate (75% fail to return). [https://fitsmallbusiness.com/small- business-failure-rates/](https://fitsmallbusiness.com/small-business-failure- rates/)

</comment></comment><comment><USER14> While a "AI-powered laundry-folding robot" company files for bankruptcy there's a guy making money selling onions on the internet.

<comment> d--b The guy selling onions on the internet is not make a ton of money from it, though.

<comment><USER15> So?

A more useful question is whether he makes _enough_.

Growth-at-all-costs is toxic.

<comment><USER16> I really want to see his financials. He said that an unexpected $10K cost nearly ended the business and I got the sense from the article the margins are fairly slim after factoring everything in.

<comment><USER17> AFAIK that was at the very beginning of the venture, maybe financials are more stable now.

</comment></comment></comment></comment></comment><comment><USER18> I sometimes hold off washing my clothes for so long I end up wearing the same underwear two days in a row, then no underwear and very dirty socks, then no socks before I realize it's time to wind up the old washing machine. That's how much I hate washing. I wear every piece of clothing I have and at the end of a two month long washiless period I go to work looking a fool. And then after gaving washed my clothes I now have three hundred pair of socks to match! Nightmare!

SV, please try harder at creating a washing assistant. I need it yesterday!

<comment><USER19> Buy the same socks in batches. If they are all the same color/shade you won't need to spend time matching socks. Dump them into a drawer, and every time you need two socks, you grab two, done.

You could also extend the not-washing period if you buy more clothes. The more you have, the longer until you run out of clothes to wear.

<comment><USER20> I thought i was doing this by only getting black socks. Now I have a drawer full of very subtly different black socks

<comment><USER21> Just lean into this one and buy brightly colored and patterned socks instead.

That way, you're obviously always wearing mismatched socks, and it becomes an obviously deliberate (if eccentric) fashion choice instead of a repeated sartorial goof-up.

Also, you get to wear socks that are more fun.

<comment><USER18> This is a very useful hack. I'm gonna try it out.

Socks didn't use to be a fashion statement but they sort of are now. Mixed socks. Because, y'know, I don't care. I just don't care. I'm just me.

LOL, so corny. I'm not sure anymore that I'll be able to pull of mixed socks.

</comment></comment></comment></comment></comment><comment><USER22> I feel like folding clothes in an approximately rectangular shape is the wrong approach. Rolling clothes into cylinders is potentially easier to design for, and it is pretty effective for storage too.

<comment><USER23> I recently started using Marie Kondo's method and I was thinking the same thing. Some combination of rollers and a big ducted fan/tube to blow air into the shirt beforehand. Maybe we should have a go at it. What are you doing this Saturday? ;)

<comment><USER22> I'm flying to Italy (un)fortunately... But I am actually interested in exploring this if you are ever in Berlin.

</comment></comment></comment><comment><USER24> Joking aside, a truly admirable goal. My god it would help everyone alive.

<comment><USER25> I don't fold my clothes, and haven't in 20 years.

Which is to say, my clothes do not get folded by anyone. No one folde them for me, nor do I fold them myself.

You don't have to fold most clothing. You can just toss it all in a basket and let it be. Most cotton wrinkles will disappear after being worn for about 20 minutes. Movement, body heat and ambient humidity removes wrinkles automatically from a lot of clothing. So, basically wrinkles from the drier usually don't last beyond most morning commutes.

And then, of course, there's not giving a single fuck about useless minutia, like... fucking wrinkled clothes.

<comment><USER26> Wearing ironed clothes makes me feel much better compared to wearing wrinkled clothes. Sometimes the difference could be as huge as between a good day and bad day. So maybe luxury but not useless.

<comment><USER27> On the other hand, cotton clothes will make you look like a slob if they aren't ironed.

</comment></comment></comment></comment><comment><USER28> At last modern fabrics don't require ironing anymore. You can put away a dryer's worth of clothes in less time than it takes to watch a quarter of an episode of Game of Thrones. It's really not that hard (for a human)

Industrial scale though ... but can AI really be cheaper than a skilled minimum wage professional? You know someone who has folded thousands of t-shirts and really gotten it down to an impressive speed.

Like this guy for example: [https://www.youtube.com/watch?v=TzivmWS6qak](https://www.youtube.com/watch?v=TzivmWS6qak) He folds a button-down shirt in 30 seconds. That's 120 shirts an hour ...

<comment><USER29> > At last modern fabrics don't require ironing anymore.

Would those "modern fabrics" be the ones using synthetic fibres that contribute thousands of plastic microparticles to the water each time they go through the wash?

<comment><USER3> I guess GP is talking about "poly cotton blends" rather than pure polyester or acrylic. But yes, poly-cotton blends do release microplastics.

[https://www.theguardian.com/science/2016/sep/27/washing- clot...](https://www.theguardian.com/science/2016/sep/27/washing-clothes- releases-water-polluting-fibres-study-finds)

> They found that acrylic was the worst offender, releasing nearly 730,000 > tiny synthetic particles per wash, five times more than polyester-cotton > blend fabric, and nearly 1.5 times as many as polyester.

People have no idea how many fibres are released per kg of clothing. It can be a surprising amount.

[https://www.naturvardsverket.se/Documents/publ- kompl/1003-10...](https://www.naturvardsverket.se/Documents/publ- kompl/1003-10%20Report%20Microplastics%20from%20industrial%20laundries.pdf)

> From the results from the measurements, calculations were made to estimate > the number of released microplastic particles. The release varied > significantly between the different laundries. If the calculations were > based on an assumed best-case scenario, between 5 000 and 4 550 000 of > microplastic particles were released per kg of washed textile. If a worst- > case scenario was assumed, between 15 000 and 5 375 000 microplastic > particles were released per kg of washed textile.

<comment><USER30> This is very noticeable if you watch someone wash a fuzzy blanket bought from Walmart. It seems like half the blanket goes down the drain after the first wash.

</comment></comment></comment></comment><comment><USER31> Nice. There's a market for this technology in the sewing and commercial laundry industries. Fabric handling is a tough robotics problem, and progress is welcome. But for that, it will have to really work, every time.

<comment><USER32> ...and it will have to work a lot faster than these machines.

</comment></comment><comment><USER32> Even priced at $2,000, it would have been hard to justify for home use.

Folding laundry just isn't that hard or time-consuming. The one situation where I could see such a machine being justifiable is if you have a _lot_ of laundry to fold -- but the speed of the device would seem to rule it out as a solution for that use case.

</comment><comment><USER33> Would it be easier to invent wrinkle free clothes than this robot?

<comment><USER34> Definitely... And much more useful, too.

</comment></comment><comment><USER35> Someone should make a solar powered washing machine that runs off the grid and doesn't need to be fed with a water supply (recycles its own water usage, use UV beams to kill germs) Only external inputs are detergant and sunlight, output is dirt and heat.

<comment><USER36> Why? Why have its own compact set of expensive recycling infrastructure and storage when you have the grid for that?

<comment><USER37> Recycling the water would actually be beneficial for our oceans[0].

[0]: [https://www.theverge.com/2019/4/24/18513393/avengers- endgame...](https://www.theverge.com/2019/4/24/18513393/avengers-endgame-no- post-credits-scene-mcu-marvel-cinematic-universe)

</comment></comment></comment><comment><USER38> I like the ending

"It's sad news for everyone involved, but maybe we don't need an expensive Wi- Fi-connected machine to do our simple chores for us. After all, now we have Marie Kondo to teach us how to fold fitted sheets."

<comment><USER39> Marie Kondo's folding method is not the common way of doing it, the 3-way folding is not easy to master at first.

[https://www.youtube.com/watch?v=Lpc5_1896ro](https://www.youtube.com/watch?v=Lpc5_1896ro)

But yeah, 8 million views already.

<comment><USER32> I think I am congenitally unable to fold fitted sheets. I've tried every method I could find. In the end, I just decided to no longer use fitted sheets.

</comment></comment></comment><comment><USER40> Why start with consumers?

Surely there are narrower goals to go for first (eg retail), nail them and then expand into consumer (super wealthy luxury first and work down)

Retail would be much easier to make a case for this: it could be shared across a whole store, the items would be known and someone could configure it company wide. Pricing the savings would also be simpler than for consumers, who either have to want it for their own convenience or have this service offered by existing on-site competitors mentioned by others already (cleaners, housekeepers etc)

</comment><comment> d--b There's a lot more money in replacing cooks, fruit pickers or amazon workers than there is in folding clothes.

</comment><comment><USER41> I hate doing laundry. Switching to using a wash and fold service was one of the best decisions for improving the quality of my life. I pay $40 every couple weeks to get all my clothes washed and folded. I love robots, but they're not going to beat inexpensive skilled human labor anytime soon.

</comment><comment><USER42> they thought 5 minutes to fold a shirt, that wasn't black, made for a viable product?

<comment><USER24> If you could throw a big bin in the night before and let it run, it could be viable on some level.

</comment></comment><comment><USER4> btw, the ironing is by far the worst aspect of dealing with laundry. Is folding even an issue?

<comment><USER32> Personally, I rarely need to iron anything. I have some fancy clothes I wear for fancy occasions, and they require ironing, but I only need them a few times a year.

The vast majority of my clothing doesn't really need to be ironed (even if it's not specifically "wrinkle free"). That's one of the criteria I use when I select my clothes.

</comment></comment><comment><USER43> the problem with this machine was that you have to setup the clothes properly within the machine for it to work. That defeats the whole purpose.

If you could just throw in a bunch of dirty clothes and let it do everything, that's a different story.

</comment><comment><USER44> You mean it's folded?

</comment><comment><USER45> This fits into the category I saw a reporter describe as "Things 20 something engineers wish their mom still did for them."

Similar to juicero (spelling), Amazon proposal to deliver packages inside your house....etc.

<comment><USER46> > Amazon proposal to deliver packages inside your house

Wasn't this just to prevent assholes from stealing packages from your yard/door/...?

<comment><USER47> Yes. I believe they shifted to putting it in your car in driveway

<comment><USER48> > I believe they shifted to putting it in your car in driveway

Huh? How is that supposed to help?

People aren't less likely to steal a package out of your car than out of your driveway.

<comment><USER49> Yes they are. Lack of package visibility, unclear accessiblity (vehicle locks), potential of car alarms, requirement for unlawful entry, increased likelihood of occupents associated with vehicle presence, expanded threat for forensic discovery, fear of spontaneous Tesla combustion and vehicle interiors that smell of soiled diapers and spoiled milk are the biggest deterrents.

<comment><USER50> > fear of spontaneous Tesla combustion

heh.

</comment></comment></comment></comment></comment></comment><comment><USER51> You could say, someone lost their shirt on this one.

<comment><USER52> I would say ... they folded.

</comment></comment><comment><USER53> Can they make an AI robot that files for bankruptcy?

</comment><comment><USER2> I dread laundry. Its one of signs you are still alive and soiling clothes.

Some males never do laundry their entire lives. Their mothers do it until they marry. Then their wives and daughters.

<comment><USER54> As a single male with extremely few material possessions, I'm one of those people that does my own laundry but never folds their clothes. I used to watch my mom fold our clothes when we were little and seemed like a waste of time. Seeing as I wear extremely casual clothes, this isn't a problem for me. If I wore more formal clothes, I would fold/hang those. I just leave my clothes in my basket and pick out what I need every morning. It seems to work well enough.

<comment><USER55> Aren't your clothes wrinkled?

<comment><USER54> Yes, they are, but that doesn't bother me much and no one has ever commented on it. Heck, I've even worn shirts inside-out and people barely notice. They're probably too busy thinking about their own appearances...

<comment><USER56> People don't comment on it out of politeness, but they do notice. Then, consciously and unconsciously, they draw negative inferences about you. They might suspect that you are not well organized or that you are lazy. You are free to be unbothered by that fact, but their reaction to your appearance is outside your control. It is a slight headwind in your life that makes your interactions with people more difficult than they have to be.

<comment><USER57> Surround yourself with better, less shallow people.

<comment><USER58> When you find a planet filled instead with these "better, less shallow people", let us all know. Until then, we're stuck on this one, where the GP's observations are 100% correct.</comment></comment></comment></comment></comment></comment></comment>


Liquid Rescale (Content Aware Resizing) GIMP plugin - <AUTHOR> http://liquidrescale.wikidot.com/

<comment><USER2> So... good move on the co-inventor's part to get hired by Adobe, then?

<http://news.ycombinator.com/item?id=47696></comment>


Graphene - <AUTHOR> http://jondot.github.com/graphene/

<comment><USER2> Duplicate from two weeks ago: <http://news.ycombinator.com/item?id=3675565>

</comment><comment><USER3> curious to know uptake rate for Mac OS X. Sure there's a long list of nested dependencies, but it's only a few that usually cause me a lot of heartburn. E.g., as far as i know, the app advertised here depends on Graphite which in turn depends on py-cairo which in turn depends on cairo. I've never found installing that on any Mac OS X to be a pleasant experience.

<comment><USER4> Homebrew makes installing Cairo very pleasant.

</comment></comment><comment><USER5> Somebody knows similar projects with no real time data?</comment>


Ask HN: Are all project managers there to disturb you and ask stupid questions? - <AUTHOR> <comment><USER2> Of course not.

That's a loaded question. "the question attempts to limit direct replies to be those that serve the questioner's agenda." ([https://en.wikipedia.org/wiki/Loaded_question](https://en.wikipedia.org/wiki/Loaded_question))

</comment><comment><USER3> Can you provide examples of what a stupid question is?

The PM's job is to communicate the project status with stakeholders. In my experience even the developers who are really good at this only do as well as a mediocre project manager. Their job is to pick out any risks or crises and mitigate them before they derail the project. If you are working with a great project manager your life as a developer gets much easier. Granted, if your project manager isn't on the ball, your in for a not fun time.

<comment><AUTHOR> Communicate status with stakeholders is PMs responsibility. And, I guess, in 95% of cases, PM can do this without talking to dev. By just looking in jira for example... But they just can't. They continue asking if dev is still on time. They setting up usless meetings, just to see people talk to each other. Micromanagement.

Can you then provide an example of how PM makes life of a developer easier?

<comment><USER3> I am skeptical that a project management tool like JIRA can be as effective in communicating status as a conversation. One huge benefit that PMs provide is making sure you are on track with the timeline. I would have to think that every time your PM is asking you for an update they are using that information to communicate with management. Having them act as a buffer can be a huge help.

I definitely feel your pain on having too many meetings. I would rather have one too many meetings than one too few meetings though. Its definitely a tricky balance to hit.</comment></comment></comment>


LinkedIn password leak - <AUTHOR> https://usblog.kaspersky.com/linkedin-password-leak/7160/ <comment><USER2> > _If you're not sure how strong your password is, test sample passwords with > our password checker here._

That is irrelevant in the face of leaked passwords; what matters most in that situation is that your password is something other than your leaked one.

If the passwords were leaked due to being stored in plain-text, no amount of complexity would protect them, obviously.

Don't use the same password on multiple sites. If your LinkedIn password is leaked, you don't want that same password to grant access to your bank account. That just as important than how strong the password is, if not more.

If some site has suffered a password leak, and you're a user of that site, you must change the password on that site, and also on all other sites where you happened to use the same password. Do it as quickly as possible without worrying how strong the new passwords are. Then change later to stronger ones.

A password's strength is inversely proportional to how often you change it. For instance, if you happen to change a password every week (for the sake of argument---few people likely do), and it takes a month to crack on the best available hardware cluster, then you're probably okay. If you change only once a year, you're much less okay; a surreptitious password breach could happen, and two months of cracking later, the attackers have your password. Meanwhile, you're still months away from changing it, not knowing there had been a breach.

By the time users learn about a breach---if ever---they should assume that their passwords have been cracked, because some unknown amount of time has passed between the actual break and the discovery. The discovery will likely stem from the fact that some of the "lower hanging" passwords have been cracked and accounts start being misused. The site admins can then only guess from various circumstantial information (logs or whatever other breadcrumbs left bind) about when the leak might have occurred.

<comment><USER3> > If the passwords were leaked due to being stored in plain-text, no amount of > complexity would protect them, obviously.

One assumes LinkedIn does not store plain text passwords anywhere. That would be against best practice for the average PhpBB online forum from the late 90s. It would be criminal negligence from a company like LinkedIn. How strong your password is (and which kind of hashing function the site uses) does influence how long it takes to obtain a plausible plain text password assuming that the exfiltrated data is in the form of a list of salted hashes, which is the most reasonable assumption.

That said, changing passwords everywhere remains the safest course. Since: a) 4 years is a long time to run a password cracker + dictionary, b) there is always the possibility that the passwords were intercepted on server memory before hashing.

<comment><USER4> The said dump contains unsalted SHA1 encrypted passwords: [https://www.leakedsource.com/blog/linkedin](https://www.leakedsource.com/blog/linkedin)

<comment><USER5> s/encrypted/hashed/

<comment><USER2> Nitpicking. Even the Unix guys, whose line editing language you're using there, called the password hashing function "crypt"; everyone knows what it means.

<comment><USER6> "crypt" = "cryptographic hash" != "encryption".

Not to mention that someone might get the wrong idea and decide that encryption (or single-round hashing) is good enough.

<comment><USER2> [https://www.freebsd.org/cgi/man.cgi?crypt%283%29](https://www.freebsd.org/cgi/man.cgi?crypt%283%29)

       NAME
           crypt -- Trapdoor encryption

Linux man page:

       NAME

           crypt, crypt_r - password and data encryption

Solaris 10 man page:

       NAME

           crypt - string encoding function

Darwin:

       DESCRIPTION
           The crypt() function performs password encryption ...

<comment><USER6> To be fair, "trapdoor encryption" == "hash".

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER7> _1: Change your password. RIGHT NOW. If you're not sure how strong your password is, test sample passwords with our password checker here._ Seriously?

Keep in mind that these estimates are based on some bogus entropy estimation. If a password hacking guy runs the correct dictionary past the hashes you password generates, it might be as small, well, as the first one tried. For example, run the passphrase _Ph 'nglui mglw'nafh Cthulhu R'lyeh wgah'nagl fhtagn1_ past the kaspersky bruteforce estimator, you get 10,000 centuries. But this is clearly false, as inicated in [http://arstechnica.com/security/2013/08/thereisnofatebutwhat...](http://arstechnica.com/security/2013/08/thereisnofatebutwhatwemake- turbo-charged-cracking-comes-to-long-passwords/). They clearly "cracked" this in far less time: "in a matter of minutes".

<comment><USER8> So, being one of the people who hovers around laymanship when it comes to these questions, how hard is it to crack a randomly generated 25 character string with 5 digits and 5 symbols? This is typically what I would use for a website.

<comment><USER9> How do you randomly generate these passwords?

<comment><USER10> you can install a tool "pwgen" on linux machines that will generate you passwords, configurable with size and types of characters included.

pwgen -y 40 1

Generates one password with 40 chars, including special chars (-y).

<comment><USER11>
        head -c 24 /dev/urandom | base64

will give you a password with 24 * 8 = 192 random bits.

</comment></comment></comment></comment></comment><comment><USER12> The best security that an individual can get from passwords is clearly achieved by using a password manager and generating a unique random password for each site, and changing high-value passwords periodically. (It's arguably already impossible for a human to generate or remember enough good passwords, and either way it gets harder as computers get better at guessing human- generated passwords.)

However, from the point of view of someone implementing an authentication system, passwords on their own are broken. There will be a significant fraction of users who re-use their password at a site with minimal-effort security. If you subscribe to the idea that computer professionals have a moral duty to safeguard people's private information entrusted to them, then password-only authentication is just broken.

The solution is to either: spend the money to implement a multiple factor authentication system (with a secure password database and fraud detection) or use a federated identity service. (Even just sending a one-time login code via email is fine). The latter is simple and takes even less effort than implementing a password system from scratch.

There should be fines (at the very least) for having an unsalted password database with more than X number of users.

<comment><USER13> Or for an unhashed password database, c.f. [http://plaintextoffenders.com/](http://plaintextoffenders.com/).

<comment><USER14> The fact that your password is mailed in plain text to you when you register does not prove the password is not hashed when it's stored.

In a "lost password" mail, of course, that's another thing.

<comment><USER15> But the mail is stored!

<comment><USER14> By you, right? Or is it common practice to store outgoing mails?

<comment><USER16> You could always not store password reset emails.

</comment></comment></comment></comment></comment></comment><comment><USER17> useful tool to check your emails [https://haveibeenpwned.com](https://haveibeenpwned.com)

[https://haveibeenpwned.com/PwnedWebsites](https://haveibeenpwned.com/PwnedWebsites) hasn't been updated yet with this yet because the list hasn't leaked entirely.

Also change your password: [https://www.linkedin.com/psettings/change- password](https://www.linkedin.com/psettings/change-password)

</comment><comment><USER18> Woo, I created my LinkedIn profile in 2015, so I should be safe since the leak is supposedly from 2012. If anyone else isn't sure when they made their LinkedIn, you can see your join date here (ctrl+f "Member since"): [https://www.linkedin.com/psettings/](https://www.linkedin.com/psettings/)

<comment><USER19> 2009... Awesome.

Linkedin should probably be the one warning me about this, but I never heard of this before.

Edit: filtered as Spam, nevertheless they should have locked my account.

<comment> semi-extrinsic I believe it's been proven impossible to write a spam filter to distinguish useful LinkedIn email from spammy LinkedIn emails, since the spam filter would then be able to solve the halting problem.

<comment><USER20> Can't you just write this?:

        isUseful :: LinkedInMessage -> Bool
        isUseful _ = False

<comment><USER21> Sure, but password leak is pretty useful.

</comment></comment></comment></comment></comment><comment><USER22> I got an email from them this morning about this, it just smells like all their other junkmail begging me to +1 their active users.

Why don't they invalidate the passwords all at once instead of letting -- someone -- use the potentially compromised passwords again...

<comment><USER23> Incredible... The email says:

"We've recently noticed a potential risk to your LinkedIn account coming from outside LinkedIn."

That's almost as bad as saying "we take security very seriously" after a hack!

<comment><USER24> What does that even mean?

How can a risk come from "outside" LinkedIn related to my password? If I haven't leaked my own password, then there should be nothing to fear, and my account should be secure.

Unless of course LINKEDIN ITSELF is compromised, and leaked my password. In that case, the wording about "coming form outside LinkedIn" just smells like BS/spin to me.

</comment></comment></comment><comment><USER25> I got an e-mail from LinkedIn today saying that I would be forced to reset my password upon my next login. They didn't say why. I guess this explains it.

<comment><USER26> The email did say why:

"We've recently noticed a potential risk to your LinkedIn account coming from outside LinkedIn. Just to be safe, you'll need to reset your password the next time you log in."

<comment><USER25> Yeah, that's vague garbage. What it should have said was: "Our password database was stolen and we fucked when we tried to roll our own password hashing. Your password is likely compromised and you should change it. If you use the password on multiple websites, you should change it everywhere."

<comment><USER27> Even better, they have you click the "Forgot your password" link, as if it was your fault.

</comment></comment></comment></comment><comment><USER28> Aaaand that's why I use 'pwgen -s 22' to generate a unique password for every single site I use. I don't care if a salted password database is stolen; heck, as soon as I change my password I don't even care if a plaintext database is stolen.

Why -s? Because it means each password is a complete word, and may easily be double-clicked in a password list (which is nice, because selection is copy in X).

Why 22 characters? Because 22 mixed-case letters and digits are just over 128 bits of entropy.

Say it with me:

        pwgen -s 22

<comment><USER29> How do you track those passwords? I presume not with a password manager otherwise it would be creating your passwords for you. Do you keep them in a text file on your computer or write them down and carry them around with you or something?

<comment><USER28> I store them in an encrypted file on my computer: the encryption password _is_ memorable, but since I have physical control of my computer (I hope!) I think the security tradeoff is a win. Rather than many memorable-but-guessable passwords scattered across numerous services, I have one memorable-but- guessable password (well, passphrase) securing a file I control.

Writing them down would probably be even better.

</comment></comment></comment><comment><USER30> Considering the amount of "growth hacking" LinkedIn use (used?) to so, sending too many emails to too many people this breach can be much more dangerous than usual.

People raises eyebrows when they get phishing emails but when it comes purposely from LinkedIn and vouched for by your social and professional circle it could get much more credible and easy to fall.

<comment><USER31> I got an email from linkedin a couple weeks ago and had the hardest time deciding if it were real or fake.

</comment></comment><comment><USER32> Question for the more security-savvy among you: If the leak happened in 2012 and I've changed my password since then (it's listed in your account page [1]), do I need to change it again?

Logic tells me I've got nothing to worry about, even considering potential password reuse, if they've all changed since then.

[1] [https://www.linkedin.com/psettings/account](https://www.linkedin.com/psettings/account)

<comment><USER33> I changed it when they first announced the leak in 2012. It didn't ask me to change it when I logged today and they didn't send me the email today. I guess they know my new password is secure since I changed it since the leak.

</comment></comment><comment><USER34> And LinkedIn is now asking me to enter my phone number:

"Add an extra layer of security to your account. Add your phone number."

Leaking my email / password is bad enough; I'm not going to give them my phone number for more damages!

<comment><USER20> Also, access to your phone (or rather anything send to your phone number) is trivial to get via social engineering the telco.

(The attack is not very scalable, but easy enough to pull off against individual targets.)

</comment></comment><comment><USER35> Also, why is the 2FA option hidden under "Privacy" and not right next to the Change Password option?

You'd think they would want to advertise 2FA better...

<comment><USER36> Why do people insist on using sms as the second factor? Let me use TOTP (e.g. Google Authenticator). I don't get reception everywhere!

<comment><USER37> I get you - but how many places do you not get sms reception but you still have enough internet connection to be trying to log in to LinkedIn? (Inside a data center, maybe?)

<comment><USER38> > I get you - but how many places do you not get sms reception but you still > have enough internet connection to be trying to log in to LinkedIn?

Any time you travel internationally? My phone only has one SIM slot and it's not going to be the $10/MB roaming one from back home.

SMS 2FA is an awful trend.

<comment><USER37> I agree about SMS being a bad chice for 2FA, and so do the Telcos here:

[http://www.itnews.com.au/news/telcos-declare-sms-unsafe- for-...](http://www.itnews.com.au/news/telcos-declare-sms-unsafe-for-bank- transactions-322194)

"The lobby group for Australian telcos has declared that SMS technology should no longer be considered a safe means of verifying the identity of an individual during a banking transaction."

and

"SMS is not designed to be a secure communications channel and should not be used by banks for electronic funds transfer authentication,"

</comment></comment></comment></comment></comment><comment><USER39> You can see how long you've been a LinkedIn member by going to your Privacy & Setting page, where it displays at the top.

[https://www.linkedin.com/psettings/](https://www.linkedin.com/psettings/)

</comment><comment><USER40> Do we know how strong their hashing scheme was?

Edit: SHA-1... You'd think a site as big as linkedin would have strong hashing...

<comment><USER41> Just read about it being sha-1 (source: [http://www.pcworld.com/article/257045/security/6-5m-linkedin...](http://www.pcworld.com/article/257045/security/6-5m-linkedin- passwords-posted-online-after-apparent-hack.html)).

<comment><USER42> Sha-1 with the hashes salted.

Edit: "Motherboard conversed with someone at LeakedSource who claimed that they managed to crack 90 percent of the LinkedIn passwords within three days. Though LinkedIn says it has hashed and salted its stored passwords for several years now"

[http://venturebeat.com/2016/05/18/linkedin-resets- passwords-...](http://venturebeat.com/2016/05/18/linkedin-resets-passwords-on- millions-of-accounts-as-new-data-leak-reports-surface/)

<comment><USER43> Unsalted

</comment></comment></comment></comment><comment><USER44> My theory is that this data leaked via custhelp.com, the filename of the data dump I have (linkedin.cfg) seems to support that.

This would also explain linkedins initial "confusion" regarding the hack.

<comment><USER45> Could you elaborate? Also, when you say _' "confusion"'_, do you mean it was feigned?

<comment><USER44> Linkedins support site URLs (hosted by custhelp.com) used to look something like this [http://linkedin.custhelp.com/cgi- bin/*linkedin.cfg*/php/endu...](http://linkedin.custhelp.com/cgi- bin/*linkedin.cfg*/php/enduser/std_alp.php)

I know custhelp used to be particularly insecure right around when this hack happened, as I myself discovered several vulnerabilities back then.

>Also, when you say '"confusion"', do you mean it was feigned?

Partly. From what I recall it took them quite a while to own up to this very easily verifiable hack, which could very well have been because they couldn't figure out why it happened because it didn't actually happen on their systems.

<comment><USER45> Ah...I assumed that a leak happening via third-party would be an excuse for a company to be legit confused at first and then breathe a sigh of relief because that means they can blame someone else in the press release. Though I guess that's tricky when people start asking about why their data is being given in bulk to a third party in the first place...

<comment><USER46> Doesn't matter. If your logo is on the product, it's your fault. Full stop.

<comment><USER47> That's why I put the Google Maps logo on my surveillance van.

</comment></comment></comment></comment></comment></comment><comment><USER48> > test sample passwords with our password checker here.

Do NOT do that with your exact password though :)

<comment><USER49> Link: [https://password.kaspersky.com/](https://password.kaspersky.com/)

I'm impressed by the password cracking estimation with the Tianhe-2 Supercomputer. A 10-character password containing uppercase letters, lowercase letters, and numbers, which is estimated at a 4 year crack with a Macbook Pro, takes 31 seconds on the supercomputer.

<comment><USER43> The timing are meaningless since it depends entirely on the hashing algorithm and how much key stretching was in place.

Is even the basic ratio/multiplier correct? Supercomputer is 1,000,000x faster than a 2012 MacBook Pro? I tried a few random strings and saw ratios as high as 3,000,000 - why would the ratio change based on the password? Probably because the number is nonsense.

<comment><USER50> > why would the ratio change based on the password?

Probably because they may assume a dictionary order of cracking attempts?

<comment><USER43> I mean, why would the supercomputer sometimes be 1,000,000 times faster and then for a different password be 3,000,000 times faster?

</comment></comment></comment></comment></comment><comment><USER51> I'm going to use this to recommend a CLI for strong, memorialize passwords (if you're not using something like KeePass).

[https://github.com/ulif/diceware/](https://github.com/ulif/diceware/)

        $ pip install diceware
        $ diceware -n 8 -d ' ' --no-caps
        proton hunts blake 31 pope pivot taped plain

</comment><comment><USER52> Who cares if their LinkedIn account gets hacked? In my case they'll be able to see 500+ recruitment agents I've never heard of as my 'contacts'.

<comment><USER53> I think password reuse is the big deal. Lots of people use the same passwords on more important accounts, which they would mind losing.

<comment> ryan-c I know of a company that experienced a data breach (one that was reported in the news) due to an employee using the same password on linkedin as on their company account.

<comment><USER44> Was linkedin verified to be the source of the password or is this just speculation?

<comment> ryan-c The person at that company who I heard about if from claimed they were able to verify it.

</comment></comment></comment></comment></comment><comment><USER54> Folks, this is becoming a common occurrence. Use a password generator and password vault to protect against this type of scenario.

<comment><USER55> A password vault ties you to a particular computer or mobile device. It's terribly inconvenient. But it's the best thing that we have today.

<comment><USER56> keepass + dropbox works ok.

<comment><USER57> keepass + dropbox is also my choice. There's (unofficial) keepass ports for both android and iOS too which can connect to the dropbox app. I use both and they work fine.

</comment></comment></comment></comment><comment> open-source-ux As someone who isn't versed in security issues, can anyone explain how security breaches like this one (and Adobe etc.) occur?

I'm assuming (and I may be completely wrong) that some kind of software monitors if the database of customer details is being downloaded. If a download is detected, an alert is issued. Does software like this exist? Or there other measure that guard against these data breaches?

<comment><USER58> I'm not a security expert either, but I doubt most companies have anything like that running. Many leaks happened through the site itself, which is expected to be able to access and present that data, and even if the attacker transfers an actual file, it's fairly easy to encrypt it beforehand.

There is some software that can detect an anomaly in the regular pattern of network usage, and possibly even cut the connection, but again, I'm not sure how effective they would be here.

In any case, considering they were using unsalted SHA-1 hashes of the passwords, which was well known to be a poor practice, you should probably assume they had very little protections.

</comment></comment><comment><USER21> I'm pretty sure the right move for me is going to be to just delete my account. I mainly just receive recruiter spam from it.

</comment><comment> awinter-py beyond linkedin logins, they also have a zillion email passwords from the bad old days before oauth.

</comment><comment><USER59> A useful HaveIBeenPwned feature would be a list of pwned passwords connected to my email address.

Yes, I know - don't reuse and use a password manager. But not everyone follows best practice. Knowing which password motifs to absolutely not reuse would be helpful.

</comment><comment><USER60> I've read zero reports of people breaking into houses, finding a piece of paper down the back of the cabinet with lots of passwords on and no site names, then using those passwords randomly to gain access to an unknown system... A 'software' or 'online' password manager seems like a terrible idea, all your eggs in one convenient basket, if Sony and VISA and the NSA are unable to secure their systems 100% of the time I doubt the maker of your software will fare much better over the long term.

<comment><USER60> Maybe using a password manager is better than using the password "wizard007" everywhere, including your HN account.

:P

//not-tudorw

<comment><USER60> fair point :)

<comment><USER60> while obviously fairly painful, am assuming that came from the Stratfor list ? While I concede a piece of paper is far from secure, I'm human and what I do others do too, I would have faired better had I followed my own advice. Conveniently your point does re-inforce they key aspect of my comment, that if Stratfor, a global intelligence company, can fall foul of security then there really are very few safe ports to rely on harbouring your secrets ;) Btw, thanks for not locking me out, gentlemanly of you.

</comment></comment></comment></comment><comment><USER61> Whats interesting to me is that their spams to change your password showed up on a whole bunch of group email addresses I am a member of. So at some point linkedin went and harvested email addresses that got to my inbox and made a bunch of bad assumptions to include those as secondary addresses for me. I can only assume it was their mobile app, which is now forever uninstalled on all my devices. I simply cannot have them doing that.

</comment><comment><USER62> For those that have forgotten, [https://news.ycombinator.com/item?id=4073309](https://news.ycombinator.com/item?id=4073309)

Back then there were issues. If I remember correctly, there was some nodejs even after this with no bcrypt.

</comment><comment><USER63> anyone know how I can get a copy of the list. I want to see if the email/password combination I used back then is still in my regular circulation on other sites.

</comment><comment><USER64> is it even verified that the data isn't again the warmed up stuff that surfaced from LinkedIn's 2012 breach? This is quite common these days.

</comment><comment><USER65> this might be a dumb question - but if the password was unique to that account AND you have 2 factor auth enabled, is there any reason you need to change the password ?

so if some hacker somehow manages to backward engineer a salted-bcrypted-hash of my unique password, he still cant get in without my cell phone

<comment><USER66> Perhaps they won't get into your account without your password _and_ phone. However, you've reduced your 2-Factor to 1-Factor since the password is now known. You're still relatively safe - at least safer than not having 2-Factor auth - but changing passwords is cheaper than the risk of relying on 1-Factor auth.

</comment></comment><comment><USER67> Just points out the fact that we should use password generators for all web sites that requires one.

</comment><comment><USER68> > test sample passwords with our password checker here.

And you just lost my trust Kaspersky, congratulations.

</comment><comment><USER69> 2-step authentication?

</comment><comment><USER70> I'm amazed LinkedIn is as big as it is. They have a big, new, building in Sunnyvale and lots of employees--too many it seems for a simple social network. I drive past their HQ a few times a week when I'm in Sunnyvale and see their employees, who don't look like other tech employees, waddling down the street to the McDonalds on the corner of Mathilda and Delray.

</comment><comment><USER71> So basically, if I get interviewed by a company and I get asked why I don't have a Linkedin account, am I legitimate to respond to them by saying that Linkedin sucks in many different ways including password breach?

<comment><USER72> First off I'd be skeptical about working where they take your linkedin account seriously. Secondly, no. Because everyone sucks, everyone can get hacked, why don't you have a Facebook account, a Google account, it's only a matter of time. No one is invincible.</comment></comment>


On Open-Sourcing Libraries - <AUTHOR> http://williamdurand.fr/2013/07/04/on-open-sourcing-libraries/

<comment><USER2> I would like to add that when open sourcing a library, meaning software designed to be included within or used by other applications, please don't license it under the GPL. Of course you can license it under whatever you want, it's your code, but you need to understand the consequences. If the library is GPL it can only be used by other GPL applications (if the application is distributed), which excludes major open source projects like Rails (MIT) and Django (BSD). It seriously limits amount of people that can use your library, and hopefully you are open sourcing a library because you want to help as many people as possible.

Even the LGPL doesn't make sense for interpreted languages or compiled languages that don't link like C. The wording of the LGPL is pretty ambiguous when it comes to languages that 'include' libraries into their code instead of linking against complied libraries. FSF argues it's not ambiguous [1], but that fact that they even have to make that argument proves it is. As the original author of Twisted Python wrote "It would be a halfway accurate statement that I selected the LGPL exactly because it doesn't make any sense." [2] Twisted is now MIT licensed

[1] [https://www.gnu.org/licenses/lgpl- java.html](https://www.gnu.org/licenses/lgpl-java.html)

[2] [https://twistedmatrix.com/pipermail/twisted- python/2004-May/...](https://twistedmatrix.com/pipermail/twisted- python/2004-May/007946.html)

<comment><USER3> > It seriously limits amount of people that can use your library

Yes, it does seriously limit the amount of people that can use your library-- without giving anything back.

> hopefully you are open sourcing a library because you want to help as many > people as possible.

Help as many people as possible do what? Get rich by composing together a bunch of liberally licensed software to do a task and then close sourcing it. No, thank you.

I see licensing as a Hawk-Dove-Retaliator game[1] for modeling resource competition. Each kind behaves differently: The Dove never fights and always flees. The Hawk always attacks and never flees. The Retaliator only attacks if attacked. Pay off matrices describe in detail how well each kind does against the other. Dove vs. Dove both do well; they share. Hawk vs. Dove, the Hawk wins everything. Hawk vs. Hawk, the beat each other up; both lose. Retaliator vs. Dove, just like Dove vs. Dove. Retaliator vs. Hawk, like Hawk vs. Hawk.

My analogy is this: The BSD licensor is a Dove, the proprietary licensor is a Hawk, and the GPL licensor is a Retaliator. If you want to be nice but make yourself vulnerable to exploitation, be a Dove; Doves like Doves, and Hawks love Doves--it's popular. If you want to get rich, then exploit all the Doves and be a Hawk; Doves worked hard, so you don't have to. If you want to have your work respected rather than exploited, be a Retaliator: happy to cooperate with those who cooperate, but willing to punish those who defect and refuse to cooperate. Which of these strategies is stable in the long-term? See the links below for a more detailed answer, but Doves certainly aren't.

Doves may enjoy a wonderful period of peace and cooperation, but they're so easily exploited that it makes one wonder how long it will last. In a population of Doves, it's best to be a Hawk. However, a population of pure Hawks does terribly. A population of Retaliators though is nearly immune from invasion.

Note: There are many salient differences between licensing and this animal behavior model. I don't contend that it is a perfect analogy, but I think it is worthwhile for considering long term trends.

[1]: [http://en.wikipedia.org/wiki/Chicken_(game)#Hawk- Dove](http://en.wikipedia.org/wiki/Chicken_\(game\)#Hawk-Dove) [1]: [http://www.oocities.org/hawkdovegame/strategies.htm](http://www.oocities.org/hawkdovegame/strategies.htm)

<comment><USER4> See also: [http://zedshaw.com/essays/why_i_gpl.html](http://zedshaw.com/essays/why_i_gpl.html)

</comment></comment></comment><comment><USER5> I've been racking my brain trying to come up with a basic, concise readme to include with my code as well as a cabin design I've been working on. At first glance, these are wildly differing things, so one license type E.G. creative commons had too many options.

Finally, I came up with one single readme file I can include in almost all my work (except where I have to combine other stuff under different licenses). It's basically a variant of the ISC license.

Feel free to use this for whatever...

      Introduction...
      Things your whatchamacallit does

      ___________________________________________________________________________
      README

      Important stuff about the project.
      Requirements, preconditions, defaults etc...

      ___________________________________________________________________________
      CONTACT

      Twitter	:	@eksith

      Website	:	http://eksith.com

      Email		:	Eksith Rodrigo <reksith at gmail dot com>
      ___________________________________________________________________________
      COPYING / LICENSE

      The contents of this package are licensed under the following unless
      otherwise noted.

      Copyright (c) $YEAR, Eksith Rodrigo

      Sources, libraries, binaries, diagrams and/or images and documentation
      included with this package are hereby referred to as "materials".

      Permission to use, copy, modify, and/or distribute these materials for
      any purpose with or without fee is hereby granted, provided that the
      above copyright notice and this permission notice be included in all copies
      in an applicable and appropriate format.

      THESE MATERIALS ARE PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL
      WARRANTIES WITH REGARD TO THESE MATERIALS INCLUDING ALL IMPLIED WARRANTIES
      OF MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
      ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
      WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
      ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR
      IN CONNECTION WITH THE USE OR PERFORMANCE OF THESE MATERIALS.

      END.

</comment><comment><USER6> I would add, please use a known and widely-used license (IMO, preferably a 2-clause BSDL variant or LGPLv2, depending on your attitude towards derived works). Don't make up your own or just state that it's public domain. Public domain is actually not a well-defined concept internationally, and means different things in different countries.

<comment><USER7> [http://creativecommons.org/choose/zero/](http://creativecommons.org/choose/zero/) is a good alternative/method to releasing into the public domain, and is (to my knowledge, IANAL) unambiguous internationally.

<comment><USER8> [http://www.wtfpl.net/](http://www.wtfpl.net/) is pretty cool too, if only because any court transcripts involving disputes would be pretty hilarious.

</comment></comment></comment><comment><USER9> The most important thing on that list is the Licence. No licence and most people can't use it.

<comment><USER10> Its becoming less of an issue as more and more as software migrates to being "as a service". A webapp is not distributed, so the license doesn't matter at all.

<comment><USER9> Errrr I present AGPL

</comment></comment></comment><comment><USER11> he didn't mention the most important - write the docs [http://www.youtube.com/watch?feature=player_embedded&v=KEakc...](http://www.youtube.com/watch?feature=player_embedded&v=KEakc8r4r7M)

</comment><comment><USER12> I will make a small off-topic question. I really like the ISC license but for a small snippet of code I think that it's still to big. I choped some parts and got it to this:

Copyright (c) 4-digit year, Company or Person's Name

Permission to use, copy, modify, and/or distribute this software for any purpose is hereby granted.

THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES WITH REGARD TO THIS SOFTWARE.

Would this be a valid open source license?

I am not using this license for anything big. Most of my code is pretty much useless and for the code I consider more useful I use the ISC license.

<comment><USER13> It is generally a bad idea to make your own, since you won't be aware of international issues. Similarly since your license is non-standard, anyone using the code now has to a do legal review to make sure things are ok, instead of looking in their list of standard approved ones.

Pick one from the top of [http://opensource.org/licenses](http://opensource.org/licenses) At the bottom of my LICENSE file I add "Alternatively you may strike the license above and use it under any OSI approved open source license such as those listed at [http://opensource.org/licenses/alphabetical"](http://opensource.org/licenses/alphabetical")

See also [http://creativecommons.org/choose/](http://creativecommons.org/choose/) although they are rarely used for code.

</comment></comment><comment><USER14> I think it's interesting that in this time of fancy collaborative tools like github, the trend no longer seems to be collaboration but to reinvent everything as a "one man show". And it becomes apparent with new technologies like Go and redis where there are like 10 different implementations of the same database libraries at any given time, but they are all gone within a month...

<comment><AUTHOR> Yes, because things are easier than ever for people that want to contribute but also for those who want to create new projects. Maybe GitHub could suggest existing projects to contribute on before creating a new repository :)

</comment></comment><comment><USER15> Platforms.</comment>


Young Men Give Up Work for Video Games? Be Skeptical - <AUTHOR> https://www.bloomberg.com/view/articles/2017-07-11/young-men-give-up-work-for-video-games-be-skeptical <comment><USER2> I think the article is missing the point of playing video games as an addiction. why go to McDonalds and have some jackass yell at you that you forgot to put ketchup on that hamburger when you can be the supreme commander of the 85th armada.</comment>


ShowHN: Learn the Model Method with the Whiteboard - <AUTHOR> http://ultimath.com/whiteboard/trial/

<comment><AUTHOR> This is a tool my friend and I created after we did a project on the available drawing tools specifically suited for the the model method used in some elementary schools. Feedback from all parents and educators welcomed!</comment>


Show HN: Compress png images right inside your browser - <AUTHOR> https://psych0der.github.io/pngquantjs/ <comment><USER2> Good Job :D

</comment><comment><USER3> Nice Work....

</comment><comment><USER3> Nice Work :)</comment>


Winklevoss Twins Bitcoin ETF Rejected by SEC - <AUTHOR> https://www.cnbc.com/2018/07/26/winklevoss-twins-bitcoin-etf-rejected-by-sec.html <comment> ur-whale Worthy of note, this is not as clear-cut as one might think.

Within the SEC, there are dissenting voices:

[https://www.sec.gov/news/public-statement/peirce- dissent-34-...](https://www.sec.gov/news/public-statement/peirce- dissent-34-83723)

<comment><USER2> The issue seems to be "prevent fraudulent and manipulative acts and practices" in the spot markets.

Is stop hunting considered a manipulative practice? Because it's happening every day in bitcoin markets. But stop hunting also happens in the currency markets (which also have ETFs), albeit they are more sophisticated and tend to happen around news. I'm not talking about bucket shops, I'm talking about the real interbank market.

<comment> ur-whale How does stop hunting work in currency markets? If you want to go stop hunting, it seems you need to be able to push the price down somehow, no?

On an unregulated BTC exchange, that's fairly easy to do (e.g. wash trading).

Short of collusion between many high-level actors, how do you do that in the interbank market?

</comment></comment></comment><comment><USER2> For those who don't follow, there is another set of ETFs still under active proposal by an ETF specialist company.

</comment><comment><USER3> Bitcoin was increasing and possibly because of this ETF news and that Coinbase was considering adding more crytpos. It went up to $8507 then I saw news SEC is now taking its time on making a decision. From that day it's been sliding back down.

<comment><USER4> exactly the manipulators are USA media an not offshore...

</comment></comment><comment> crypto-jeronimo For details, please, refer to the list of strong arguments discussed by Emin Gün Sirer, who is a Cornell University professor and blockchain researcher: [https://twitter.com/el33th4xor/status/1022695497511841792](https://twitter.com/el33th4xor/status/1022695497511841792)

</comment><comment><USER5> Has it ever been discussed as to how much BTC the Winklevoss twins own?

<comment><USER2> > Cameron and Tyler Winklevoss won $65 million from the Facebook lawsuit, and > invested $11 million of their payout into Bitcoin in 2013, amassing one of > the largest portfolios of Bitcoin in the world — 1 percent of the entire > currency's dollar value equivalent, said the twins at the time. Their slice > of the Bitcoin pie is now worth over $1 billion after Bitcoin surged past > $10,000 last week to now trade at $11,100

[https://www.theverge.com/2017/12/4/16732952/winklevoss- twins...](https://www.theverge.com/2017/12/4/16732952/winklevoss-twins- bitcoin-billionaires-surge)

A comment from 2013 on HN saying it's hilarious that savvy investors like the Winklevosses would put money in such an obvious ponzi:

> This is clearly illuminating the Ponzi-like elements of Bitcoin. As in a > Ponzi scheme, early arrivals to the system earn easy money, funded by later > arrivals. Tales of bitcoin fortunes draw more and more entry to the system, > leading to large payoffs for second stage arrivals, attracting more > speculators due to the media attention and very real money that has been > made by early players. This continues until, oh, wait, bitcoins aren't so > easy to mine anymore and there's no new wave of incoming money to pay of the > next generation of miners.

> The hilarious thing is that Bitcoin is quite transparent about exactly how > it works, while a real Ponzi scheme goes to great lengths to hide this > dynamic. Anyone can see this dynamic in the rising price and the increasing > CPU time needed to mine a new coin. And yet, brilliant, savvy investors like > the Winklevosses are somehow still getting involved...

[https://news.ycombinator.com/item?id=5570422](https://news.ycombinator.com/item?id=5570422)

<comment><USER6> I'd be so tempted to take my $32.5M and retire for life. Pretty gutsy to invest 17% of your wealth in a single early stage technology when they did. I guess retiring on $27M instead wouldn't be so bad either though if it bombs.

<comment><USER2> Investing 17% when you are worth 65 mil is different than when you are worth 65 k.

If you fail, you'll have just one vacation house in Miami instead of two. I could live with that.

<comment><USER7> How different, I wonder?

First assume that the 65 mil and 65 k are the amounts that each person has _above_ what they truly need to survive. Like, above a living wage.

Economists often say the value of money is roughly logarithmic as it goes up, which would mean that both of those two people would lose exactly the same utility.

But this would imply otherwise. Does 17% of 65 million truly have less utility than 17% of 65k? (Some people would argue it has more.)

<comment><USER2> > Economists often say the value of money is roughly logarithmic as it goes > up, which would mean that both of those two people would lose exactly the > same utility.

Your conclusion contradicts the first part of your statement.

[https://www.economicshelp.org/wp- content/uploads/2017/03/utl...](https://www.economicshelp.org/wp- content/uploads/2017/03/utlity-function-risk-aversion-600x411.jpg)

[https://www.economicshelp.org/blog/12309/concepts/diminishin...](https://www.economicshelp.org/blog/12309/concepts/diminishing- marginal-utility-of-income-and-wealth/)

<comment><USER6> Here's a counter argument: It probably depends on your aspirations. If you want to be a billionaire and you make $65k/year that $11k probably has low utility because you're so far from your goal and there are social and government safety nets to help you if you fall into poverty. But at $65M, that $11M might be one of only 3 or 4 shots you have at investing in a moonshot and making your $1B.

But, if your goal is to just feed yourself and vacation every once in a while than I could see how the value of money increases logarithmically.

If you view yourself as a company or an investor though, it might increase in value as you accumulate more because it puts you in an elite group that can invest in billion+ dollar ideas that could change the world.

</comment></comment></comment></comment></comment></comment></comment><comment><USER4> there are many things that the CBOE application addresses differently</comment>


World fails to meet a single target to stop destruction of nature – UN report - <AUTHOR> https://www.theguardian.com/environment/2020/sep/15/every-global-target-to-stem-destruction-of-nature-by-2020-missed-un-report-aoe <comment><USER2> FTA:

> From tackling pollution to protecting coral reefs, the international > community did not fully achieve any of the 20 Aichi biodiversity targets > agreed in Japan in 2010 to slow the loss of the natural world. It is the > second consecutive decade that governments have failed to meet targets.

Though this is a bit better:

> The 20 Aichi biodiversity targets are broken down into 60 separate elements > to monitor overall progress. Of those, seven have been achieved, 38 have > shown progress and 13 elements have shown no progress. Progress remains > unknown for two elements.

It seems like conservation of "vital biodiversity areas" is improving, but the situation for marine ecosystems is not improving (with regard to overfishing, coastal development, pollution, or climate change/ocean acidification). Marine ecosystem preservation seems like a tragedy of the commons issue, and this is the result. The lands in your nation are directly yours and there can be national movements to improve them. But the oceans are everyone's, in the sense that they can be harmed by any nation's inability to curb pollution, overfishing, etc. Eg 10 rivers as the source of 88 - 95% of all plastic in the ocean[0].

[0] [http://oceanrep.geomar.de/43169/4/es7b02368_si_001.pdf](http://oceanrep.geomar.de/43169/4/es7b02368_si_001.pdf)

</comment><comment><USER3> Is that really suprising ? All the world powers are preocuppied with wars ( both hot and economic) , neocolonialism , and keeping the inssanely broken and injust finnacial system from collapisng.

Enviromment and the ecosystems are like ecomosists like to says externlaities.</comment>


Joel on Software: The inches add up to feet, the feet add up to yards, and the yards add up to miles. And you ship a truly great product. - <AUTHOR> http://www.joelonsoftware.com/items/2007/06/07.html <comment><USER2> This article reads like he really, really wanted to tell everyone the story about finding the rogue alarm clock at his neighbor's apartment, but didn't have a good reason to publish it, so he added a couple paragraphs at the end about how being anal makes a person good at finding bugs. It did not flow together well.

<comment><USER3> Actually, he wanted to tell everyone they have released fogbugz 6 beta, wasn't that obvious? It is good story anyway.

</comment></comment><comment><USER4> Too bad Joel stopped blogging about software... Looking at this last XX posts I don't see anything about software.

Joel is getting old... :-)

<comment><USER5> _'... Too bad Joel stopped blogging about software... ...'_

I've noticed this as well. A while ago he lamented the fact there was nothing more to write about ( _i forget the exact post, article it was in_ ) having got everything off his chest about software & software development (old skool desktop mainly). But don't despair. I think a lot of the stuff he's pump( _ed_ & _ing_ ) out is ahead of the curve. The articles are what you need to know a bit further up the line. Not as useful in the immediate as when you expand beyond survival mode.

What do you do when you need to know about

\- design an office ~ <http://www.joelonsoftware.com/articles/BionicOffice.html>

\- learn about management skills ~ <http://www.joelonsoftware.com/items/2006/08/07.html>

\- why writing is essential ~ <http://www.joelonsoftware.com/articles/SortingResumes.html>

\- larger picture ~ <http://www.joelonsoftware.com/articles/DevelopmentAbstraction.html>

\- how to ship physical things ~ <http://www.joelonsoftware.com/articles/HowToShipAnything.html>

_"... Useful software written above the level of the single device ...."_ Jeff Stutz wrote this on leaving Microsoft ( <http://www.synthesist.net/writing/onleavingms.html> ). I view JOS, _"useful advice written above the level of a startup"_.

</comment></comment><comment><USER6> Hmm... that reminds me too much of this: <http://www.youtube.com/watch?v=9rFx6OFooCs> One of the most inspirational movie scenes ever.

<comment><USER7> THIS is more inspirational (at 4:35 in) <http://www.youtube.com/watch?v=5XDrv_M1znc></comment></comment>