Movim – Federated, open-source alternative to Tumblr - <AUTHOR> https://nl.movim.eu/?node/pubsub.movim.eu/Movim/hey-tumblr-users-here-is-why-movim-could-be-the-best-platform-to-migrate-to-BpGnsH <comment><USER2> > Movim is easy to deploy

> Movim is lightweight (only a few megabytes) and can be deployed on any > server. We are providing a Docker image, a Debian package or a simple > installation tutorial if you want to deploy it yourself.

I imagine a typical Tumblr user landing on this page and not getting a single word of the "easy to deploy" section. A lot of these distributed project suffer from this unfortunately. Developers not understanding what a typical user would look like.

Unless the user can click a button, enter a credit card and get an instance they are not going to use that service. And it has to look nice.

<comment><USER3> One of the biggest misconceptions I had about the federated/decentralized web getting into it a decade ago was this customer v. service provider model we're so used to everywhere else. These free[0], decentralized services rarely prioritize building a big user base. Their goal is to liberate the web, most often for their own use, and so the approach is generally "do-ocratic": something bugs you, you fix it, or you wait for someone else to come by and try. The beauty of this approach is it weeds out the impatient, "I want this now, do it for me" types, leading to more intelligent, polite interactions on the service.

 _[0] Both as in free beer and as in freedom:[https://en.wikipedia.org/wiki/Gratis_versus_libre#%22Free_be...](https://en.wikipedia.org/wiki/Gratis_versus_libre#%22Free_beer%22_vs_%22freedom_of_speech%22_distinction*)

<comment><USER2> Don't get me wrong, I am very much in that camp too and spend a lot of my time contributing to F/OSS projects. Having the freedom to tweak, debug and improve software is awesome.

My main objection here is that there are a lot of intelligent and polite people that are not developers and being left out in the cold. We need another option where users can rent out a server (from a multitude of providers) and install webapps as easily as installing phone apps. We are slowly getting there with Docker images but it's still very technical to do so.

EDIT: there is also [https://sandstorm.io/](https://sandstorm.io/) that tries to tackle this problem but isn't very popular yet

<comment><USER4> I'm not sure if the time for this is now but it certainly feels closer to "now" than ever before. The recent corporate censorship I believe has ignited a lot of interest in various segments of the "non-hacker" world. I think to harness this interest there needs to be a relatively user-friendly product that solves their problems.

</comment></comment></comment></comment><comment><USER5> Only a small note: we have had a free, functional, decentralized social network in the past, even supported by thing like Microsoft Outlook. It's still there, despite semi-abandoned state, today. It have a name, of course: nntp news.

All we need if we want a free alternative to ANY social network is being back on nntp. Of course we can add features to it, we can start to shake heads and think seeing the role of IT today it it's time to buy serious mail solution, perhaps a VPS and a domain name, perhaps create a small home-server that mirror public/semipublic personal stuff from the VPS to us so we can easily jump from a vendor to another without change anything from our mail address to our datas.

IT is not _only_ a game anymore, it start to be a serious thing even for casual people, better know a bit of it and be prepared.

<comment><USER6> I have been looking for an NNTP server that I can run privately, with a minimum of fuss, user accounts and encryption, so that I can host one for our family (previously we used G+, but that is being shut down).

I haven't found one that fits the bill.

<comment><USER7> Here you go - [https://github.com/CyberShadow/DFeed](https://github.com/CyberShadow/DFeed) (news aggregator, newsgroup client, web newsreader and IRC bot) -- powers [https://forum.dlang.org/](https://forum.dlang.org/), NNTP server and IRC bot.

</comment></comment></comment><comment><USER8> I followed the links to the site, [https://movim.eu/](https://movim.eu/), and the link to "Create an account" in the phrase "Create an account and connect to one of our public platforms." links to [https://movim.eu/accounts/register](https://movim.eu/accounts/register), which returns a 404.

<comment><AUTHOR> Sorry for the 404, the link has been fixed. Thanks for the report!

<comment><USER9> And when I try creating an account through [https://api.movim.eu/accounts/register](https://api.movim.eu/accounts/register) (main link), I get the following error:

        Invalid form
        Unknown error

</comment></comment></comment><comment><USER10> "You don't have Javascript enabled. Good luck with that."

You might have gotten a chance at a user. Good luck to you.

<comment><USER11> First thing I saw, too, before giving them temporary JavaScript execution privilege.

It's one thing to be JavaScript-rendered only. It's another to be impolite to users who happen to constrain JavaScript privileges of yet-untrusted sites. This seems especially relevant since you are attempting to convince an audience to adopt a federated opensource platform. The Venn diagram of people who understand the value of federated platforms has greater than average overlap with those who restrict JavaScript execution in their web browser.

I recommend revising the  tag to say something like "Please enable JavaScript to read this content. We use JavaScript for the following ... [a brief summary] and we do not use any third-party hosted script." (Incidentally bravo on not using third-party scripts!)

<comment><USER12>

You donve Javascript enabled. Good luck with that.

Wow. Going out of the way to annoy js blockers.

<comment><AUTHOR> This message was initially added more than 5 years ago and not really changed since then :) The related ticket has been fixed and master is now having a better wording for this message [https://github.com/movim/movim/issues/737](https://github.com/movim/movim/issues/737).

<comment><USER12> I am more refering to the css. All content is fetched without needing js. But its css hidden because ...

<comment><AUTHOR> I've created a ticket for it [https://github.com/movim/movim/issues/738](https://github.com/movim/movim/issues/738).

</comment></comment></comment></comment></comment></comment><comment><USER13> It is an interesting idea to built it on top of XMPP. I'm not sure how much advantage this is over just running a regular webpage. The front page is pretty breathless about getting updates to your readers instantly, but that's not really a feature I'm interested in for a blogging platform. They also talk about being able to use chat clients to use the platform, but I don't see how a big HTML rich text post is going to look very good on a chat client.

It seems like an unnecessary complication to me.

<comment><USER14> I like XMPP but this honestly just seems like a weird fit to me. ActivityPub seems like the more appropriate protocol for this. Also gives you federation with stuff like mastodon and peertube.

Or just RSS would work as well.

<comment><AUTHOR> Actually most of the social features of Movim are built on Pubsub ([https://xmpp.org/extensions/xep-0060.html](https://xmpp.org/extensions/xep-0060.html)). The articles are Atom ([https://en.wikipedia.org/wiki/Atom_(standard)](https://en.wikipedia.org/wiki/Atom_\(standard\))) items published on Pubsub where ActivityPub define it's own JSON structure to handle articles.

</comment></comment></comment><comment><USER15> Yeah this just isn't going to replace Tumblr, Movim's user base and Tumblr's user base are two totally different user bases.

I do like it though!

</comment><comment><USER16> The creating of an account is really quite convoluted.

There needs to be a way to create sub accounts.

Finding content seems to be broken. Typing a search only seems to search for usernames.

Needs a one-click reblog.

<comment><USER17> What do you mean by "sub accounts"?

<comment><USER18> Tumblr allows you to log into multiple blogs using a single account. You have a "main" blog directly connected to your account. In addition you have as many blogs as you wish that you can reblog or post to, and can be owned by multiple people.

</comment></comment></comment><comment><USER19> Is it possible to customize a Movim instance such that it behaves more like tumblr or a photo blog? As it stands it seems to be a lot of things that Tumblr was not, which is great, but perhaps this would be more attractive to Tumblr refugees if a pared down interface was available.

<comment><AUTHOR> As it is explained it is possible to provide a custom CSS stylesheet for your own blog. Just provide the link to the file (that can be hosted anywhere) in your account configuration.

There is no "advanced" UI like on Tumblr where you can pick a theme or customize the current theme graphically but we can imagine something like that in the future (or a website where people could create custom CSS file and link them with their account).

The HTML code of the pages is kept as simple as possible to make it easy to select the elements that you want to customize.

<comment><USER19> I understand. I guess I was thinking about how Scuttlebutt works where you have multiple client apps (with radically different UIs) that can federate over a common protocol.

</comment></comment></comment><comment><USER20> Scrolling sucks on iOS since it doesn't have momentum.

</comment><comment><USER21> Finally something that's not just piles upon piles of blockchains.

</comment><comment><USER22> The number 1 feature I'm going to miss from Tumblr is the video seeking. The ability to place your finger on a video and slide forward or backwards is to- date the best way to seek IMHO.

<comment><USER23> What if your fingers are.....sticky

<comment><USER24> Then you're likely long past needing to scroll.

</comment></comment></comment><comment><USER25> I've been using Diaspora as tumblr alternative since 2015 and it's great! I love tag driven social network idea, the only problem I have is low user base.

To me diaspora ruined every other free social network. How am I supposed to find someone to follow on a new social network? Tags (read interests) are a great idea, lets have more of that please.

</comment><comment><USER26> My wife does a lot of Tumblr stuff with her online Anime community, 95% of the people in the community are not technical. About 50% of those only have a phone.

So I'm looking at Movin, I see no iOS app. No Android App (Google PlayStore link is dead). I see DOL.

<comment><USER13> An app is unhelpful if the site works fine in a mobile browser. I would never install the Facebook app for example.

<comment><USER27> The existence of an app doesn't preclude a good mobile website. There are tons of people who don't browse sites on mobile web, myself included.

<comment><USER24> You didn't provide a reason why, let alone a good one.

<comment><USER9> He did provide a fact: a lot of people don't browse the web on their mobile and will expect this kind of service to have an app.

</comment></comment></comment></comment></comment><comment><USER28> Federated means all your data is served directly from your own computer so as soon as you switch it off it becomes unavailable and all the kinds of attacks (DDoS, pwned, lawyers etc) hit you directly and everybody can find out your home IP address, right? I feel like I would strongly prefer distributed over federated unless I really misunderstand federated (which is very probable).

<comment><USER29> Email is federated. Do you host your email on your laptop? I mean, you _could_ but most people use remote servers instead.

</comment></comment><comment><USER30> Does anybody else also get a broken webpage ? I can't scroll in Firefox 63.0.3 (64-bit)

</comment><comment><USER31> How does one write comments on a Movim post?

<comment><AUTHOR> By simply authenticating using a XMPP account and going to the post page :)

<comment><USER31> How would one do that? There are no links to authenticate that I can see.

</comment></comment></comment><comment><USER32> Off: this website breaks scrolling on iOS.

</comment><comment><USER33> thought someone forked NeoVim...

</comment><comment><USER26> Is there going to be CP blocking? If not, have fun with your Android and iOS apps.

<comment><USER34> This is such a nearsighted comment.

<comment><USER35> What does cp blocking mean?

<comment><USER36> Cp refers to child porn, the unfortunate publishing of which on Tumblr led to it being pulled from the iOS app store and then disallowing nsfw content on Tumblr.

<comment><USER15> The real reason behind the disallowing of NSFW is Tumblr positioning itself to be bought by Verizon.

<comment><USER37> Just to nitpick the causality here, Tumblr was bought by Yahoo in 2013 then Yahoo was bought by Verizon/Oath in 2017 and now the porn ban is hitting afterward.

</comment></comment></comment></comment></comment></comment><comment><USER38> Nah, we need something EASY either with IPFS or a competitor from Russia which is not in this stupid NSFW censoring scheme. I don't see how movim can be a good replacement for Tumblr.</comment>


GoDaddy out of control - Sites hacked again - <AUTHOR> http://blog.sucuri.net/2010/05/continuing-attacks-at-godaddy.html

<comment><AUTHOR> I am definitely moving away from GoDaddy. I had some small sites on their shared servers that just got hacked again..

If you are not following, this is the 3rd mass hack at godaddy in just a few weeks:

[http://smackdown.blogsblogsblogs.com/2010/05/13/hosting- with...](http://smackdown.blogsblogsblogs.com/2010/05/13/hosting-with-godaddy- might-want-to-rethink-that-decision/) [http://blog.sucuri.net/2010/05/found- code-used-to-inject-mal...](http://blog.sucuri.net/2010/05/found-code-used-to- inject-malware-at.html)

</comment><comment><USER2> These attacks are being done by the same group. In the last few weeks, they used:

http :// www.indesignstudioinfo. com http :// zettapetta. com http :// holasionweb. com http :// www. losotrana. com

All of them registered by the same person (and hosted at the same IP). I had my share of problems with GoDaddy, but let's not forget that they are victims as well.

<comment><USER3> I would suggest changing those so they aren't active hyperlinks.

<comment><USER2> Good idea, fixed.

</comment></comment></comment><comment><USER4> It common knowledge that shared servers at GoDaddy never have been anything better than average, but a lot of people think that GoDaddy still is the place to go for domains. Trust me, there are a lot of better options out there.

I really like <http://www.internet.bs>

Their domains are the among the cheapest on the internet (7.15$ with free privacy settings, Godaddy would take over 20$ for the same offer), they have great support, a great API, and a simple (although ugly) website/domain registration process. GoDaddy on the other hand, has a completely bloated UI designed into tricking you into buying a lot of junk that you don't need.

<comment><USER5> Thing is, GoDaddy domains are similarly cheap if you use the widely available coupons. My last renewals were around $7. I am pretty sure no one is disputing bloat on GoDaddy UI... even Bob Parsons.

That said, Namecheap is another good registrar, which I have had occasion to use.

<comment><USER6> It seems just about any choice is better than godaddy. I have found 1and1 to be pretty decent. Private registration, decent control panel, and around $7 as well.

</comment></comment></comment><comment><USER7> I'm not surprised. I use godaddy for hosting domain names but their interface seems really complex. This makes me think that they have an even more complex infrastructure with possibly many holes. It's also possible that they don't have yet fixed the issue because of internal bureaucracy.

<comment><USER8> <http://twitter.com/hotdogsladies/status/1553046234>

</comment></comment><comment><USER9> Headline should be edited to "GoDaddy sites hacked again."

</comment><comment><USER8> Is it possible that some group is just targeting GoDaddy-hosted blogs for attack, or is it definitely a failure in their shared server security?

</comment><comment><USER5> I had a friend who was hosting at a relatively small ISP who got attacked similarly. Luckily, those attackers were very clumsy and broke HTML in process (didnt close tags properly), making detection very easy.

I was researching a bit on how these attacks are done, but still not sure on details.

Someone gains root on host machine and then gets to the individual instances?

</comment><comment><USER10> The fact that HN users use GoDaddy for hosting is... well let's just say it challenged some of my lofty assumptions about the intelligence of HN users.</comment>


Lodash 4.0.0 is out - <AUTHOR> https://github.com/lodash/lodash/releases/tag/4.0.0 <comment><USER2> Kudos to John-David Dalton for making such an awesome lib and being such a positive force behind it for so long! I've reached out to him multiple times on Twitter and he's always been quick to help!

He should definitely write a post on how he stays productive and motivated to work day-in and day-out on one project. Really inspiring!

<comment><USER3> Indeed, John-David Dalton, together with Dan Abramov and others have been great in the JS community. Kudos!

<comment><USER4> You'll be interested to know that Dan Abramov is on the JavaScript Air panel. This is relevant because of this: [https://news.ycombinator.com/item?id=10909199](https://news.ycombinator.com/item?id=10909199) :-)

</comment></comment></comment><comment><USER5> Feels good to see a JS lib last that long and still be actively maintained, deprecating obsolete features and adapting to the new ways we use our browsers without breaking BC (or else explaining how to migrate).

Coming from Symfony (PHP), this just feels right: keep moving but make it easy to follow along.

<comment><USER6> Is this a Symphony thing or are external dependencies significantly more reliable in the PHP ecosystem in general? Last time I wrote PHP was 9 years ago and those times everyone I knew just copy-pasted all the external code they found. I know that package managers are the thing now and I'm using nuget for my .NET projects (and npm, which is a must if you do any front-end dev), however, I feel like I'm having more dependency management issues than the good ol'days in spite of using a language with static type checking.

I'm not saying "vendor everything" but maybe _some_ vendoring helps, especially when every package author seems like they've taken the philosophy of "doing one thing, doing it well and breaking everything on every update".

<comment><USER7> I find external dependencies much more reliable in the PHP world than JS. Most packages try to follow semver. Composer is one of the best dependency manager tools I've used and you can easily lock down dependency versions so you can install from a state which you know works.

People hate on PHP but there are a lot of quality packages out there and Composer is definitely considered best practice by most developers now.

</comment></comment></comment><comment><USER8> I remember reading sometime ago that the creators of LoDash strived to maintain drop-in compatibility with Underscore, and that if breaking changes between the two libraries were to occur, an announcement would be made. I can't find the initial statement, so I wonder if the developers are still attempting to maintain this?

<comment><USER9> There are some small incompatibilities: [https://github.com/lodash/lodash/wiki/Migrating](https://github.com/lodash/lodash/wiki/Migrating)

They're still mostly drop in though, most lodash differences are extras rather than modifications.

</comment></comment><comment><USER10> I think it's time to check out a jquery alternative. My recent projects are basically only using deep copies and some semi-complex selectors. lodash + querySelector should cover pretty much everything at this point.

<comment><USER2> Have you checked out Lea Verou's Bliss.js? [http://blissfuljs.com/](http://blissfuljs.com/) It's super minimal and basically relies on querySelector. Give it a whirl and see if it fits your needs.

<comment><USER10> Cool! I'll check it out thanks. Deep Clone is required though, I'll poke around.

<comment><USER11> lodash.cloneDeep is available as a standalone npm module (as are all lodash functions).

It clocks at 2.5KB mingzipped, after browserification.

There are probably lighter implementations.

</comment></comment></comment></comment><comment><USER12> The FP stuff is huge. I've been using Ramda which is great, but often feel like I'm out on a limb with it.

<comment><USER13> upvote for Ramda, which I happily use everyday ( be it on server or front end)

</comment></comment><comment><USER14> Not sure if this is a dumb question but I haven't been able to find an answer anywhere.

I currently use underscore 1.8.3. Can I just swap lodash in, or is refactoring involved? I know it's a fork, and I want to move over, but was curious if anyone know off the top of their heads if a lot of work as involved.

<comment><USER15> I'll put this here just in case no one comments.

[https://lodash.com/docs#forEach](https://lodash.com/docs#forEach)

[http://underscorejs.org/#each](http://underscorejs.org/#each)

<comment><USER8> If I'm correct, you're showing this as a counter example to prove that the two have incompatible APIs and are thus LoDash can't be used ad a drop in replacement. However, Lodash does alias it's 'forEach' function with 'each', so this wouldn't be an issue?

<comment><USER16> underscore.each has an optional 3rd parameter (context). lodash.each does not. If you depend on that 3rd parameter, you will be in a world of pain if you drop-in lodash. In fact you'd be better off if there was no alias because you would catch the problem sooner and have to think about the API differences when fixing it.

<comment><USER17> To be fair, that context parameter has only just been removed as part of 4.0.0. Instead they recommend you change your code to be of the form:

        _.each(collection, _.bind(function, context))

Which actually seems a lot more correct than some arbitrary context parameter

<comment><USER18> How is it arbitrary? It's part of the ES spec.

[https://developer.mozilla.org/en- US/docs/Web/JavaScript/Refe...](https://developer.mozilla.org/en- US/docs/Web/JavaScript/Reference/Global_Objects/Array/forEach)

I'm honestly curious why this is being removed?

<comment><USER17> Ah, I actually didn't realise this was the case, I've always used `.bind(this)` for this kind of thing.

</comment></comment></comment></comment></comment></comment></comment><comment><USER18> I'm curious why the `thisArg` parameters were removed? I dug through some of the PRs and commmits but was unable to find any specific conversation.

It seems odd since the `Array.prototype` methods include it.

[https://github.com/lodash/lodash/commit/454aca7003e14994e7b9...](https://github.com/lodash/lodash/commit/454aca7003e14994e7b9f6ebc5ab436142690eda)

<comment><USER19> It was removed because it added extra complexity for method implementations and was used very little. Folks now can use `_.bind`, or `Function#bind`, or arrow functions.

</comment></comment><comment><USER20> Whatever happened to underdash ([https://github.com/underdash/underdash](https://github.com/underdash/underdash))?

<comment><USER21> The second paragraph mentions/links to underdash: "The year was also one of collaboration as discussions began on merging Lodash & Underscore."

<comment><USER20> Exactly, "began" \- I expected next major version to actually be a merge. Hopefully they can now focus on that...

</comment></comment></comment><comment><USER22> As I see, lodash is a big fan of renaming functions.

(In any case, this library saves me a lot of manual labour, headache + can write in a functional way without poor performance.)

</comment><comment><USER23> why drop bower support damn it!

<comment><USER24> Lodash dropped bower support in favor of npm because "16% use bower vs. 76% npm for AMD packages": [https://twitter.com/jdalton/status/677323442488672257](https://twitter.com/jdalton/status/677323442488672257)

<comment><USER25> Given that there were 14825158 downloads of lodash from npm last month, that implies that there were over 3M downloads from bower. That's a lot of people to throw under the bus.

<comment><USER19> According to bower stats over the last 7 days lodash was installed 23 times compared to 4 million npm downloads & 181 new npm packages depending on it.

[http://bower.io/stats/](http://bower.io/stats/)

[http://npm-stat.com/charts.html?package=lodash](http://npm- stat.com/charts.html?package=lodash)

[https://gist.github.com/anvaka/8e8fa57c7ee1350e3491/revision...](https://gist.github.com/anvaka/8e8fa57c7ee1350e3491/revisions)

<comment><USER26> Sounds broken. My team alone would have installed it more times that that.

<comment><USER19> ¯\\_(ツ)_/¯

<comment><USER26> After thinking about it a bit more, the only reasonable conclusion I can come to is the following:

It's the number of times users actually typed

        bower install lodash

i.e. adding it to a project that didn't already have it, as opposed to just running bower install on a package which uses lodash.

Would also explain why despite bower itself being installed 37000 times in the last 7 days, the most installed package is only listed as 100 or so times.

</comment></comment></comment></comment></comment></comment></comment><comment><USER27> How does this compare to lazy.js?

</comment><comment><USER28> oh nice, they dropped ie9 support!

oh no, so many breaking changes that I cant use it!

<comment><USER29> > so many breaking changes that I cant use it!

Isn't that the point of a major version bump? It's not like being mad at 3.11.0 wrecking everything.

<comment><USER30> Majors, especially majors that are coming often with no lts for older versions, should make minimal breaking changes.

<comment><USER17> The whole point of major version bumps (in semver) is to allow of these kinds of breaking changes. When should these changes be made if not during a major version bump?

<comment><USER28> i wasnt trying to complain about breaking changes, i was saying that i am sad that i have a cod base which cannot use this. I am sure many people are in the same boat

<comment><USER19> Adoption is doing pretty well. In just over 2 weeks since its release lodash@^4.0.0 is in the top 50 most depended on npm packages.</comment></comment></comment></comment></comment></comment>


Vector Animation with Python - <AUTHOR> http://zulko.github.io/blog/2014/09/20/vector-animations-with-python/

<comment><USER2> To do that fractal ying-yang in 36 lines is _obscene_.

<comment><USER3> Too much, or too little? :)

<comment><USER4> Definitely too little

</comment></comment></comment><comment><USER5> I was actually looking for similar thing. I was disappointed while I was searching good presentation toolkit to produce presentation videos programmatically. I ended up with using HTML5 and phantomjs. It was totally hack and no control over timings. I would like to see how Gizeh handles text, fonts and text effects.

</comment><comment><USER6> The animations aren't as nice-n-smooth as the David Whyte ones which inspire this. Is it just framerate (easy to fix) or is there something deeper causing this?

<comment><USER7> I took the liberty of rehosting the linked .pde as a Gist (reformatted too).

[https://gist.github.com/akx/b487d43b0acc815ce0a1#file- spiral...](https://gist.github.com/akx/b487d43b0acc815ce0a1#file-spiral- pde-L20-L41)

It's not just the frame rate; David Whyte is doing 4x temporal supersampling too, so for each output frame, 4 frames are rendered, accumulated into an integer buffer (lines 20..29) and the output is their average (lines 31..35).

In addition, interestingly the color mapping is done afterwards (lines 38..41), based only on the red value of the original image. (One could do HDR and other tone mapping here, too.)

EDIT: Wrote a little Javascript animation test that has options for temporal supersampling. [http://akx.github.io/supersample/](http://akx.github.io/supersample/)</comment></comment>


Google search for "binary" (easter egg) - <AUTHOR> https://www.google.com/search?q=binary

<comment><USER2> Nice. Had to try these too: hex: [https://www.google.com/search?q=hexadecimal](https://www.google.com/search?q=hexadecimal) octal: [https://www.google.com/search?q=octal](https://www.google.com/search?q=octal)

</comment><comment><AUTHOR> For those who didn't catch it, the search returns "About 0b111001101100101000001000000 results (0.18 seconds)".

</comment><comment><USER3> Also [https://www.google.com/search?q=tilt](https://www.google.com/search?q=tilt)

</comment><comment><USER4> I implemented these. :-) Glad folks enjoy them.

<comment><AUTHOR> Since when have these been around? Also, can you share some details on how the Google search easter egg infrastructure works? I've always found these very interesting. They kind of give a human touch to what sometimes feel like "cold" search result pages.

<comment><USER4> Early 2012. I forget the exact date - I started them as a demo in I think Dec 2011 and then they sat around on my workstation unchanged for a couple months, so I think they went out around Feb 2012.

I can't share technical details, sorry.</comment></comment></comment>


Shopping habits impacted by coronavirus - <AUTHOR> https://www.goxip.com/gb/en <comment><AUTHOR> [https://www.goxip.com/gb/en/shopping-habits-impacted-by- coro...](https://www.goxip.com/gb/en/shopping-habits-impacted-by-coronavirus)

I'd say now people are wanting to dress up more now that we have been in isolation for a long time. It's nice to dress up, makes me feel a little more normal!

</comment><comment><USER2> This is not an article about how shopping habits have been impacted by the coronavirus. It is an attempt to drive business to a website that sells clothing.

</comment><comment><AUTHOR> Global fashion & beauty search platform</comment>


Blank vhs covers were kinda beautiful - <AUTHOR> https://www.youtube.com/watch?v=e9DfSCk-6Ko <comment><USER2> I'd pay good money for someone to turn this in to a macOS screensaver.

<comment><USER3> Download the video with youtube-dl, and convert it to a screensaver using SaveHollywood (freeware).

[http://s.sudre.free.fr/Software/SaveHollywood/about.html](http://s.sudre.free.fr/Software/SaveHollywood/about.html)</comment></comment>


Ask HN: GitHub gist about web architecture - <AUTHOR> Hey I remember seeing this great write up fully in text about scaling web architecture but I can't seem to find it anywhere. Anyone know what I'm talking about? <comment><USER2> Was it "How I write backends" [1] (previously posted to HN [2])?

[1]: [https://github.com/fpereiro/backendlore](https://github.com/fpereiro/backendlore)

[2]: [https://news.ycombinator.com/item?id=22106482](https://news.ycombinator.com/item?id=22106482)</comment>


Jupytext: Jupyter notebooks as Python scripts - <AUTHOR> https://github.com/mwouts/jupytext <comment><USER2> This is neat. If you are looking for something a bit simpler: put your code in a python package, install it, and then use %autoreload

You can now develop in your favorite editor, and changes are automatically reloaded.

More detail here: [https://blog.godatadriven.com/write-less-terrible- notebook-c...](https://blog.godatadriven.com/write-less-terrible-notebook- code)

<comment><USER3> Well, thank you! No more annoying kernel restarts, that really bugged me a long a time.

</comment></comment><comment><USER4> This seems neat, but also a bit strange. Are Jupyter notebooks so prevalent that it makes sense to ghave an exporter that makes them into markdown and back again? I mean, I always thought this workflow was neat, but isn't one of the selling points of jupyter the WYSIWYG Interface? And if you like working in code, would it not be easier to create a markdown extension for embedded code (Or does something like this already exist?) and create editor plugins or command line tools to render said document or provide a live preview?

Personally, I totally want that functionality but don't want to mess with running jupyter kernels or using my browser to work in my notebook. So where is my markdown with embedded code WYSIWYG editor that saves into plain text files? ;-)

<comment><USER5> As an academic, ipython notebooks are becoming the lingua franca of reproducible research. I don't like it or them, but they're excellent for didactic purposes. Extracting the code from the markdown is very helpful for me, as I prefer working directly with it most of the time.

<comment><USER6> I'm sure notebooks are used a lot for interactive exploration, but I would not use them for _reproducible_ research, so long as they lack things like dependency tracking:

[https://twitter.com/joelgrus/status/1033035196428378113](https://twitter.com/joelgrus/status/1033035196428378113)

<comment><USER7> The bar in academia (over-generalizing here) was so low for so long that anything around including your code with your publication still gets placed under the historical title of "reproducibility" \- that's probably where the confusion here is arising. I agree with your sentiment, but grandparent probably just meant "a lot of people release their code as notebooks".

<comment><USER5> It's a step, but you're both right. Things that containerize notebooks would count as reproducible, but they're unwieldy and disgusting. I agree that while better than nothing they're still not there.

</comment></comment></comment></comment></comment><comment><USER8> _The Python script can be opened with PyCharm_

This is going to be a bit pedantic, but for anyone that doesn't realize. Pycharm can already open ipynb files, and it will connect to a running notebook. I don't do it very often, usually just to quickly find my way around some library code.

This project looks great though. I will likely use it, as I tend to use Jupyter to work out code before copying it over to my main project.

<comment><USER9> In my personal experience, PyCharm really mangles Jupyter Notebooks. Has it gotten to better recently?

<comment><USER10> I have not experienced much mangeling, but the newest CE edition still doesn't do notebooks very well IMO. to the point where I use jupyter-lab for my notebooks/prototypes and pycahrm for packages.

</comment></comment></comment><comment><USER11> This is really cool stuff. Editing notebooks in the browser is pretty good, but it can't (yet) match the experience of a well configured (and extended) text editor.

<comment><USER12> I've been using vscode with the jupyter extension ([https://github.com/DonJayamanne/vscodeJupyter](https://github.com/DonJayamanne/vscodeJupyter)) and it's exactly what you describe, experience of a good text editor and the visual notebook workflow.

<comment><USER11> Neat, I'll give that a shot. Does it handle all kernels?

<comment><USER13> It doesn't appear to. Helpfully, Hydrogen [0] for Atom was designed to be entirely language agnostic.

[0]: [https://github.com/nteract/hydrogen](https://github.com/nteract/hydrogen)

</comment></comment></comment></comment><comment><USER14> If you're worried about diffs, check out [https://github.com/jupyter/nbdime](https://github.com/jupyter/nbdime)

<comment><USER15> That's true but ideally you would like the native format to be easily diffable (e.g., plain text) and not require special tools.

</comment></comment><comment><USER16> Could this be the answer to "I don't like notebooks" [0]? Or does calling scripts from within a notebook still do horrible things to the managed state?

[0] [https://news.ycombinator.com/item?id=17856700](https://news.ycombinator.com/item?id=17856700)

<comment><USER17> I've never thought this criticism was that relevant. Notebooks have been incredibly successful, and if it's possible to call your code in the wrong order and create a mess, it's probably a problem with your code not your coding environment. The more functional your code, the less of a problem jupyter notebooks are. They encourage better code not worse imo.

<comment><USER18> The "managed state" is important, though. For example I deal with cases where I'm doing some big expensive operations upfront (eg, processing a bunch of data coming in over a network share— ROS bag files, which are also bzipped, adding more upfront processing cost), and I'm interesting in tweaking the plots and analysis coming out the other end without having to re-run the processing each time.

Even as a relatively experienced developer, I've found it hard to reason about what exactly it is that Jupyter is doing under the hood; basically things will break in weird ways, and rerunning everything will mysteriously fix it, or I have to use hacks to force it to re-import certain modules in order to get things the way I expect.

Basically, it ends up being easier to just manage this myself, like doing the processing and pickling the result, then using other, standalone notebooks to load and render the pickle. But this shouldn't be necessary.

<comment><USER19> That sounds really weird. The only time I noticed such weirdness was when a colleague and me were simultaneously editing a notebook on Google Colab. The code was shared but not the state, super weird...

</comment></comment></comment></comment><comment><USER20> This is fantastic!

Now, they just need to adapt jupyter itself so that it reads the python files directly, dispensing with the need of the silly ipynb!

<comment><USER21> I think that's called IPython. But I agree with your sentiment.

<comment><USER20> I was not being ironic. Notebooks are lovely as an output format for showing your research and allowing others to fiddle with your code. However, for people who do not want to edit inside a web browser window, jupytext is a godsend!

<comment><USER8> At that point you should put most of your work in a separate file, and just import the stuff you need for your demo.

<comment><USER20> I do not want to hide anything, my only reason to use notebooks is to put _all_ the computations inside them.

</comment></comment></comment></comment></comment><comment><USER22> Nice! similar to [https://github.com/minodes/pynb](https://github.com/minodes/pynb) , that converts Jupyter Notebooks to Python scripts you can run and back, preserving Markdown cells.

</comment><comment><USER23> Can someone provide me a usecase for this when compared to executing jupyter straight into VSCode/Atom with vscodeJupyter/Hydrogen?

<comment><USER20> The idea is that you can edit your notebooks with your favorite text editor, use git for version tracking them, and no need to mess with a web browser _at all_.

</comment></comment><comment><USER24> I have written [https://github.com/azag0/knitj](https://github.com/azag0/knitj) to solve a similar use case, but with an alternative interactive browser interface

</comment><comment><USER3> I really like the markdown conversion! This should make it easy to import ipynb notebooks into markdown based documentations.</comment>


GM: 1M Mile Electric Car Battery Is 'Almost There' - <AUTHOR> https://insideevs.com/news/424378/gm-million-mile-ev-battery-almost-there/ <comment><USER2> I wonder if this is an attempt at damage control.

Sort of like the superbowl commercial announcing an electric hummer without any details except maybe 0-60 time comparably to a cybertruck.

<comment><USER3> > _I wonder if this is an attempt at damage control_

No, everyone advertises their own magic breakthrough batteries. Look at press releases from battery manufacturers for the last decade.

> _like the superbowl commercial announcing an electric hummer without any > details_

Just like all car companies do all the time always.</comment></comment>


My kid stole a Kinder Egg. I tried to make it a teachable moment. It didn't go - <AUTHOR> https://www.cbc.ca/radio/docproject/kinder-surprise-1.5320982/my-kid-stole-a-kinder-egg-i-tried-to-make-it-a-teachable-moment-it-didn-t-go-well-1.5320986 <comment><USER2> well .. that was anticlimactic. With a click-bait title like that, I would assume a swat team was called or the dad thrown in jail or something insane. Nope .. just pretty normal. Hey that dad taught his kid something important: retail workers and managers don't really care.</comment>


Predicting the Present with Google Trends (2011) [pdf] - <AUTHOR> http://people.ischool.berkeley.edu/~hal/Papers/2011/ptp.pdf

<comment><USER2> TL;DR: We have found that simple seasonal AR models that include relevant Google Trends variables tend to outperform models that exclude these predictors by 5% to 20%. We hope that these examples will encourage other researchers to experiment this data source in their own research.</comment>


Kids who question the media or government could be extremists - <AUTHOR> http://qz.com/563964/kids-who-question-the-media-or-government-could-be-extremists-london-parents-are-warned/ <comment><USER2> I'm reading this article and it reminds me of "attack of the killer tomatoes" \- it's equally absurd. So children cannot question what's on TV, they must obey huh? I do not like this idea. And I'm glad TV is on its path to its extinction.</comment>


PostCSS plugin for people who prefer to write English properly - <AUTHOR> https://github.com/jevakallio/css-properly <comment><USER2> It's funny</comment>


In Russia, hypersonic rivalry feeds suspicions and arrests - <AUTHOR> https://science.sciencemag.org/content/367/6474/136 <comment><USER2> TSNIIMASH is one of Russia's primary space research bureaus. If someone "transmitted their research findings" about hypersonic rockets out of e.g. Lockheed or Boeing, their ass would be in prison in the US, too, under ITAR.

Although, of course, there's a complication to this picture. At least in the US scientists are paid pretty well. In Russia that's not the case, scientists are paid peanuts, and working outside their "main" job is a matter of survival.

Case in point, their job board: [http://www.tsniimash.ru/career/careers/competitive_vacancies...](http://www.tsniimash.ru/career/careers/competitive_vacancies/). The salaries are listed in rubles. 60000RUR ($977.40) per month is pretty laughable in Moscow.

<comment><USER3> Please, read the article before posting your usual whataboutism:

"As _project coordinator for TsNIIMash_ , Kudryavtsev transmitted research findings to the foreign partners. _The reports were approved by the military 's Federal Service for Technical and Export Control_, says Kudryavtsev's attorney, Ivan Pavlov, a prominent human rights lawyer.

Herman Deconinck, who handles the von Karman Institute's foreign relations, notes that _all references in the Russian reports had been published in the open literature_."

<comment><USER4> > Please, read the article before posting your usual whataboutism

That sort of swipe breaks the HN guidelines and is not allowed here. Would you please review [https://news.ycombinator.com/newsguidelines.html](https://news.ycombinator.com/newsguidelines.html) and stick to the rules when posting, regardless of how wrong someone is or you feel they are?

Also, please keep canned arguments like "whataboutism" off HN. They're a form of labeling, which the site guidelines refers to as "calling names", rather than actually making an argument. That one in particular ([https://hn.algolia.com/?dateRange=all&page=0&prefix=false&qu...](https://hn.algolia.com/?dateRange=all&page=0&prefix=false&query=by%3Adang%20whataboutism&sort=byDate&type=comment)).

</comment></comment></comment><comment><USER5> "FSB's decision to classify the work came _5 years after the EU project ended_. The "absolutely illicit retroactive approach … increases the vulnerability" of Russian scientists working in areas that might have military or other sensitive applications, says Boris Altshuler, a theoretical physicist and human rights activist at the Russian Academy of Sciences's P.N. Lebedev Physical Institute."

Yikes.</comment>


Interactive guide to Buffer Overflow exploitation - <AUTHOR> https://nagarrosecurity.com/blog/interactive-buffer-overflow-exploitation <comment><USER2> I hope somebody else remembers "Smashing the stack for fun and profit" by Aleph1.

<comment><USER3> I was there when he wrote it, on an Indy I'd given him for work purposes. Crazy to think, all these years later, we're still discussing it .. in between setting things up for the Huntington Beach US Open Women's Volleyball competition, he'd be crashing things running eggshell.

Crazy times. I'll never forget going to a Surfrider Foundation party with Aleph1, only to be bored out of our minds and go find a barely open video arcade to throw quarters at ..

<comment><USER4> [https://twitter.com/aleph_one/status/1247639362147254272](https://twitter.com/aleph_one/status/1247639362147254272)

:)

<comment><USER3> Figures you'd pull that string, of all people. Well, I remember him hacking on it - and he had an Indy. Still, long time ago .. neither of us have the braincells we used to. ;)

<comment><USER4> Well, you have the window from 12/95 to 11/96 to work with. Before that, and you're predating splitvt, which was the work that mostly set us up to write the 1990s-form stack overflow exploit.

<comment><USER3> I distinctly remember him hacking on stack-smashing techniques while at Cyberworks, during our down-times... he crashed mine and his Indy a couple times, lol .. but maybe it was more of the exploratory work. I didn't pay as much attention as I should have, there were many other things going on at that company at the time, and I didn't really have patience for the people that were being brought in by the money-guy to shore things up, so I lost interest .. But for the brief period Aleph1 and I shared an office, it was definitely an interesting time watching him work. Probably I remember it more fondly than him, though. ;)

<comment><USER4> Part of the issue here is that we're running into a topic I am extremely, unreasonably nerdy about, since the first post-RTM working overflows are the K-T boundary of computer security. Having a working stack overflow on SGI MIPS, a delay-slot architecture with a split I&D cache, would have been a very big deal, and would force me to revise a mental history I've been grooming for a very long time. I believe Aleph One. :)

(We go back too, him and I; I met my wife at a party at his apartment).

<comment><USER3> Oh, his version of the history of his seminal paper is definitely canonical, no doubt about that - but I definitely remember seeing him hacking on stack exploits in the period leading up to when he released the paper, whether he had things working or was otherwise probing, and maybe there was a draft/discussion or two that we're both not remembering quite right. I remember him snarfing my DEC Alpha for a few quick checks, too .. Halcyon days indeed.

<comment><USER4> No byte stores, required alignment, also annoying to write shellcode for!

<comment><USER5> Doesn't MIPS have sb? Was that not part of MIPS I? (Or are you talking about DEC Alpha?)

<comment><USER4> Alpha, sorry!

<comment><USER5> It's hard to tell some of the RISCs apart ;)

</comment></comment></comment></comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER6> I love the latest commit messages at the emulator repo :)

"Fuck you JavaScript, an array with 1 int in it is not a fucking number. Why are you like this you piece of rotten garbage"

I share your hatred :)

A very nice guide and introduction both to x86 asm and buffer overflow. Thanks for this.

</comment><comment><USER5> The cute little emulator, which was linked in the article: [https://github.com/bordplate/js86](https://github.com/bordplate/js86). I am curious how they came up with the ABI for variadics, though…

<comment><AUTHOR> I've been aiming for x86-64 calling conventions, but must admit I've had a tendency to mix them up. It doesn't matter much in this case though. There are no variadic functions used in this post. I'm cheating a lot with the printf- function. You can see the implementation here: [https://github.com/bordplate/js86/blob/master/Emulator/Proce...](https://github.com/bordplate/js86/blob/master/Emulator/Processor/CPU.js#L639)

</comment></comment><comment><USER7> Someone should contact [https://explorabl.es/](https://explorabl.es/) because this seems like an explorable exploration!

</comment><comment><USER8> There is one thing here that I don't really understand:

In the first 2 examples, it says:

"If you pop (fetch) a value from the stack, RSP decreases by 8"

But when I step through it, it seems to add 8 on a pop, not subtract (and vice versa for push), or am I missing something?

<comment><AUTHOR> Woops, you're right. Thanks for pointing it out, I'll fix it, they should be the other way around.

You're decreasing the stack, but increasing RSP. Because the stack "grows down".</comment></comment>


Google's plan to phase technology out of our lives - <AUTHOR> http://blog.jasonmow.com/googles-plan-to-phase-out-technology

<comment><USER2> Welcome to enforced exhibitionism. The world is becoming less and less kind to people who just want to keep to themselves.

<comment><AUTHOR> Not sure what you mean exactly, each and every one of these features or products is opt-in (or you have to elect to buy it)</comment></comment>


Mapping the dense neural networks in the cerebral cortex - <AUTHOR> https://medicalxpress.com/news/2019-10-deep-brain-dense-neural-networks.html <comment><AUTHOR> Link to the research paper: [https://science.sciencemag.org/content/early/2019/10/23/scie...](https://science.sciencemag.org/content/early/2019/10/23/science.aay3134)

A point made which stood out for me:

> The reported methods may have substantial implications for the transfer of > insights about biological intelligence to artificial intelligence. "The goal > of mapping neuronal networks in the cerebral cortex is a major scientific > adventure, also because we hope to be able to extract information about how > the brain is such an efficient computer, unlike today's AI," says > Helmstaedter.</comment>


Most ed-tech startups suck  - <AUTHOR> http://venturebeat.com/2012/10/28/most-ed-tech-startups-suck-heres-where-theyre-going-wrong/

<comment><AUTHOR> I posted this article because I thought it showed a remarkable lack of understanding of startups. It was frustrating and I'm surprised VentureBeat published it.

First of all, the authors issues with edTech startups might apply to any startup vertical: not doing enough customer research (ie. not "knowing your user"); solving a niche problem; working with slow-moving large institutions... etc. I'm convinced that every entrepreneur makes these mistakes at least once (no matter how many sage advisors counsel them otherwise).

Second of all, the author presumes that winners can be picked through pre- product research. Learning is intensely complex. The notion that building a product around existing assessment data is intriguing insofar as it informs a v1 product. ...but beyond that, shooting in the dark, learning from users/learners, and evolving the product is the generally accepted path in organic startups (and empirical research for that matter) -- and education is no different.

Third, the author is highly critical towards startups, using the word "suck." He doesn't seem to realize that this critical tone with which he now brushes of edTech startups out of hand is the embodiment of the intransigence that plagues academia.

It's almost as if the article was written unwittingly as a parody...</comment>


My Equifax account was hacked, and Equifax doesn't care - <AUTHOR>

Below is the text of my email to Equifax today.  Note: Separately from below, but for additional context, one of my Chase credit cards kicked off a fraud alert 1 day before the original Equifax email notice.  Apparently, someone was running around Brazil with a physical credit card with my name and number on it.  Chase said that sometimes scammers generate #s on physical cards, try to charge low-value amounts, and when they succeed, ratchet up the amount.
I'm sharing this because this past week has underscored how fragile our credit system is.  Now I'm navigating through credit alerts, reports, and monitoring services, and the process is byzantine and painful.  It feels like an arms race and one group is clearly losing: the customer.  The industry needs to come up with a better way to manage this and threats to the system and its users - without making its customers bear the burden, as is happening today.
# part 1/3 #
* My account - and possibly Equifax - was hacked.  The account has been marked for investigation.  However, Equifax possesses information that would help me investigate this breach.  I would like to request that the investigation be expedited and that that information be released to me as soon as possible so I can investigate this. *
On May 28, I received an email notification from email@example.com that someone had changed the email address on my account.  A notice had been sent to the old and new email addresses.  The old account was <email address>.  It did not indicate what the new email address is.
The same day, I marked the email urgent in the subject line and wrote back that I did not request a change to my email address, and inquired whether this was a security intrusion.  Since I had not used Equifax or AnnualCreditReport.com recently, I was confident this was an unauthorized third party. <comment><USER2> I feel your pain. The credit bureaus are antiquated in their processes and make resolving issues a burden on the consumer. That is why I believe identity theft is so prevalent because the thieves know that (a) by the time you catch it they will be long gone, and (b) that the burden really falls on you to prove something is going on buying them extra time to commit the crime.

I had my identity stolen several years ago and am still recovering from it. While most of it has been resolved, from time to time I find issues that have significant impacts. I even tried to get a new social security number but was denied because the amount of damages was not significant enough to trigger a reissue, although I have no idea and was never told what the trigger amount was.

The best advice I can give you, is to do everything by snail mail. Send certified letters (you can even do overnight if you have a few extra bucks for quicker delivery) and keep track of everything. File a complaint with your state attorney office (most have departments dedicated to working with you on this). Send copies of everything to the state attorney as well as the credit bureau. Snail mail takes longer (depending on how you send from a day or two to receive all the way up to a week), but for some reason it actually escalates your issue and does result in quicker resolutions than fighting with people on the phone. It sounds like you caught it fairly quickly. Call the other bureaus as well (Transunion and Experian) and put fraud alerts on your file. It is simple to do with a quick phone call. They will also send you a free copy of your report from them so you can double check. Finally, if you have a good credit card company some will help you with resolving the issue and dealing with the bureaus on your behalf. It is in their benefit to help you if they can.

Good luck.

<comment><AUTHOR> Thanks. This was very helpful. I had no idea it was even possible to get a new SSN. Mind if I ask:

\- Did you find any 3P services like AllClear ID compelling/useful? Sounds like Consumer Reports isn't a fan of these types of services vs. self- monitoring. \- You mention snail mail > phone. What about email?

<comment><USER2> Yeah, new SSN is possible but they don't tell you what qualifies you specifically (although they give guidelines) and what doesn't. I have heard it is very random and you really have to present a compelling case to get one, but just depends on how you present it to them.

As for the services, I keep fraud monitoring on from the three credit bureaus now and I have never tried them but I think their product is essentially the same, maybe a few added features here and there but nothing you can't do yourself if just take the time and setup alerts. The only thing that is frustrating to me (but a price you pay for security and piece of mind) is that every time, and I mean every time, someone tries to run my credit I get an alert and if it is me trying to do something (i.e. last year I made changes to my car insurance) I have to authorize the transaction with the credit bureau before it will go through. The more frustrating part is that some companies will just outright deny you and not to you the reason right away so you can't tell them to hold on a second let me fix that and call the bureau to approve the transaction so it goes through.

As for snail mail vs. email. Never tried email. I spoke with a lady at the FTC (they handle FCRA enforcement) and she told me that anytime I needed to get something done or changed to use certified snail mail so I always had a record of exactly when it was sent and when it was received. The credit bureaus have 30 days from the time they receive a letter to correct the issue and/or respond with why they can't. My understanding was that certified snail mail shows them you are serious about enforcing the timelines and makes their antiquated processes actually turn a little faster. :) I honestly never tried email and just went off what that lady told me. After my initial communication with the state attorney's office I had a contact and any mail I would send to the credit bureau I would also send a copy to them as well. I always put at the bottom of my letters that I was copying the state attorney. Mainly I was trying to use it as a scare tactic to get the credit bureaus to act positively and quickly.

I still don't understand why the credit reporting agencies make it so difficult to communicate with them regardless of method. They have so much control over your personal information and how it is used yet they want nothing to do with helping you get things fixed.

Good luck.

</comment></comment></comment><comment><USER3> I have my own subdomain, and every time I'm asked I usually put <websitename>@mydomain.com.

When Equifax asked for my email address I gave equinox@<my domain>.com

Guess where I started receiving spam shortly thereafter? Yep, their mailing database was hacked. Proof: [http://postimg.org/image/j3qwslemb/full](http://postimg.org/image/j3qwslemb/full)

<comment><USER2> Most likely they weren't hacked. All of the credit bureaus sell your personal contact information and it is easily bought. As part of that "data package" they also include a rating (not credit score) of your credit so that purchasers may pre-qualify you for offers.

</comment></comment><comment><USER4> [http://www.consumerfinance.gov/](http://www.consumerfinance.gov/) is your best hope. They've got strong power over the banking/finance/credit industry. The bureaus are scared to death of them. Find a phone number/complaint address there and you'll get some action.

</comment><comment><AUTHOR> I ran into a login error on Transunion, and the password recovery wizard wouldn't accept my info. When I called, TU reported that my account had also been taken over by a Yahoo! email address that wasn't my own. Unlike Equifax, however, this time I was able to get the email address.

When I asked Transunion if they could investigate this and/or coordinate with Equifax, they said they don't have any ability to investigate fraud like this. I found this ironic given that they are supposedly in the business of protecting consumers from fraud. Instead, they recommended I try to contact the police but acknowledged it would be difficult to catch the person.

Any recommendations for how to catch this person?

</comment><comment><AUTHOR> # part 2/3 #

3 days later, on May 31, I received a reply that Equifax was unable to locate the account, and requesting further information. I replied providing this information. I received another reply from Equifax saying they could not find the account, closing the ticket, and asking that I call in for support.

That same day (today), I called in and was connected to the Personal Solutions department. I briefed the representative, Mike, on the background of the situation and asked if there was a fraud or security department that could investigate this. I was told no, and the closest department was Disputes, which was closed on weekends. I indicated that if there was a hacking involved, this might be time-sensitive, and could affect other Equifax accounts. I was told there was no other way to get assistance.

I verified my identity with <rep_name>, who created a new account for me, and was able to view the email change history, but said he could not release the email address that the account had been changed to.

I requested 6 times to speak with a supervisor and was deflected each time. After 1 hour and 15 minutes, I was put on hold for 15 minutes, then connected with <supervisor_name>, the supervisor.

<supervisor_name> was helpful. She marked the account for investigation and indicated that it would take 7 to 10 business days. I asked if this could be expedited and she said sometimes it could occur more quickly but there was no guarantee.

<comment><USER5> > I indicated that if there was a hacking involved, this might be time- > sensitive, and could affect other Equifax accounts. I was told there was no > other way to get assistance.

That's typical. A long time ago, I received an offer to sell me 100k stolen credit cards, complete with phone numbers and zip codes of the card owners. This was before the era of mega breaches and so 100k was a pretty impressive list size. The offer included a sample of 10k cards. I did some investigation and was able to determine that the sample, at least, seemed to be legit.

I then contacted the credit card companies, figuring they would be interested in this. I figured they would take the samples, analyze them to find out the common factors to identify where the cards were stolen from, and then flag those cards, and the people they were stolen from and the merchants they were going to be fraudulently used at would be protected by the next day.

Boy, was I wrong.

This was a Friday and it was after 5 PM. The best I got was one card company gave me an email address that I could mail the 10k sample cards and the information about the offer for 100k cards to, and someone would look at it Monday.

I also tried law enforcement. The FBI suggested that I call the Secret Service. The Secret Service was not interested.

I mailed the information to the email that the one credit company provided, and gave up trying to get someone interested.

</comment></comment><comment><AUTHOR> # part 3/3 #

I am deeply concerned that my account - and possibly Equifax itself - has been hacked, and would like to request the following:

\- Please expedite the investigation into this intrusion. \- Please release the email address that the account was changed to, so I can investigate this. Otherwise, please work with the email provider and authorities to locate the person who breached my account.

In addition, I would like to request that Equifax please fix it's protocol for handling this type of situation. For instance:

\- In the original email notice, Equifax asked me to email back if the change was not initiated by me. I did, but no one responded for 3 days, and when they did, they did not act on the information and instead closed the ticket. When I called, I was told I should call back during a weekday. Equifax should treat this as a security issue and act quickly, and have a way for issues like this to be addressed immediately instead of waiting days.

\- <rep_name> didn't have anyone to transfer me to. Equifax should have a phone number or email to report fraud - not outside of Equifax, but affecting Equifax's systems.

\- <rep_name> didn't have access to my full account info and was unable to release any information that would help me investigate this fraud. Equifax should have an escalation process for situations like this. Ideally, Equifax should investigate potential breaches; and if they are unable to, should release information to the user to help the user investigate breaches on their account.

Sincerely,

<my name>

</comment><comment><USER6> Its primarily because most people that contact the bureaus ARE full of shit.

</comment><comment><USER7> I found out around the same time as you that I was a victim of identity theft. I live in S.F. and this punk lives in Las Vegas Nevada.

The person(s) in question opened several accounts using my Social # and my name. They applied for loans and linked all these accounts back to the same address in Las Vegas.

I am in the process of fighting it. You need to go here and do what they say [https://www.identitytheft.gov/](https://www.identitytheft.gov/) (FTC sponsored site.).

I suggest you go to [https://www.identitytheft.gov/](https://www.identitytheft.gov/) and complete the FTC affidavit. Once you have done that take it with you to the Police Department in your area and have a police report filed.

I live in S.F. and the police department seemed perturbed to have to make a police report for me - the amount of information I provided created too much paperwork for them I think. They stated many times they aren't the ones who would be investigating it and asked if I still want to file a police report - to which my answer was YES ITS REQUIRED BY THE FTC.

I have found resistance throughout the entire process, from the crediting agencies to the businesses that had the accounts in collections all the way to the collection agencies and the Police. They all assume you are FOS.

The burden is completely on you and likely nothing positive will happen for a while.

After paying $1 to get my TransUnion credit report they gave me identity theft insurance (through TransUnion) which covers certain expenses... so save all your receipts and file a claim against that insurance to get your money back. I'm using this to get reimbursed for all the trips and time spent away from work as well as the expenses of using FedEx's services/computers to get the fax work done.

You need to check your Social Security account to make sure it has not been compromised. [http://www.ssa.gov/](http://www.ssa.gov/) DO THIS BEFORE you place a credit alert on your accounts or you will not be able to accss your SSA account online and you will need to go to a brick/mortar location to gain access to this information. Once a credit alert is placed on your account you are one step closer to being safe... so do this right away.

A few key pieces of information you are going to need is \- Dates of all fraudulent transactions, \- Phone numbers tied to the account, \- Addresses tied to the account

You are going to need to provide proof it was not you - so you need some sort of transactional proof that you were NOT in Brazil using a credit card. Anything can help here - bills paid, rent, etc... I only hope that the period in question was long enough to show that you could not have possibly been out of the country for that long.</comment>


Please review my idea - www.MySlices.com - <AUTHOR>

http://www.MySlices.com
It is a one man product, still in pre beta phase.
The idea is to help you discover content and people as per your interests or any place that you select and enable you to further share that content. Please use chrome for best experience.
I welcome all feedback in form of appreciation\criticism. Please do not be too brutal :-) <comment><USER2> Hi, a small handful of first impressions:

\- On the landing page, your signup form is far too long. You also seem to have a FB login option on the top nav bar, but it's not there for the main CTA on the page. It's also easy to bypass the signup by simply clicking on the links in the list to the left of the signup form.

\- "Local Events" looks like it's just stuff taken off of public Facebook events. Stuff like "Johns Wedding" and "I have a phone now" aren't particularly interesting to me.

\- The "Deals" section could use some work: Most of the deals which show up above the fold are nationwide product-based deals which don't really get me excited (a Dyson-knockoff fan, collapsible water bottles, a subscription to OK! magazine) - try to focus on local deals if you can.

\- "Local News": It's just a list of text links. Try and spice it up a bit with some styling, images, or at least stating the subject matter (sports, fashion, business, etc)

It's a neat idea, but a lot of people are working on the content- recommendation idea now. Good luck!

<comment><AUTHOR> Thanks for your great feedback. We will try to bring in changes that you suggested. You make sense.

The links to the left are meant for public pages.

Every product category is now crowded, you name it :-)

</comment></comment><comment><USER3> <http://www.MySlices.com></comment>


Scam Key Requests on Steam: Who Hides Behind Fake Emails - <AUTHOR> http://vladimirslav.com/2018/08/scam-key-requests-on-steam-who-hides-behind-fake-emails/ <comment><AUTHOR> After about a year of sending emails to steam key scammers, I was able to get some interesting replies and summarize them. Not sure if this is going to be useful to someone, but it was curious investigation with fascinating insights on how people think when they try to scam you out of your game.</comment>


How to hand-write DNS messages - <AUTHOR> https://routley.io/tech/2017/12/28/hand-writing-dns-messages.html <comment><USER2> Oh how many fun things have been skipped! For example, errors in message header are a nibble. There is compression of sorts, and labels referenced by an offset. There is an unique notation of emails in the SOA records; and some domains and nameservers are just plain magic. If you set out to implement a complete DNS resolver, you are IN for a fun, fun, fun time with printouts of quite a few RFCs dating back to 1987 IIRC. But the most fun part is reading these documents and seeing a story - of networks that never came to be, of dawn of the internet, of very much constrained computers and networking equipment and the genius of the thing that still is the root of the internet as we know it even some 30 years later.

<comment><USER3> I recently wrote a simple nonrecursive one in Python to see how many domains I could resolve per second. You quickly hit a limit when you try to use something like Google's 220.127.116.11 server too fast. If you do it recursively starting from root servers, can you go as fast as your bandwidth allows?

<comment><USER4> I don't think you can give a recursive query to a root server.

<comment><USER3> Sorry, what I meant with "recursive" was doing the recursion myself, instead of handing it off to a server like Google's DNS server. If I follow the replies starting from root server one by one, am I likely to hit some limit?

<comment><USER5> It seems unlikely that you were able to overload the Google public dns server, and it also seems unlikely that you were saturating your connection. Thus you probably hit a rate limit. If you go recursive, and cache at least the TLD servers, distributing requests evenly across the 13 logical servers that typically manage a TLD such as .com, you'll probably see a much higher per second throughput than through the google server, but still constrained by rate limits.

</comment></comment></comment></comment></comment><comment><USER6> Writing a simple DNS resolver is a common assignment in networking courses, and I do recommend it --- keeping in mind that the protocol was designed to work on machines with a fraction of the memory and CPU power as those today, helps understanding some of the otherwise odd design decisions; for example, requests and replies have the same format and header to allow the same buffer to be reused for both receiving the request and sending the reply. The QCLASS is another field from a time when people thought DNS would be used for networks other than the Internet.

A minor correction: DNS deals only with the _hostname_ or _authority_ component of the URL, so any mention of "URL encoding" doesn't make sense in this context.

<comment><USER7> I'd say any mention of URL should be avoided for the sake of confusion.

I can't count the number of times I've been asked by a developer running a web server on a random port to "make sure to include the port" on the A record I'm adding.</comment></comment>


Scaling Your Org with Microservices [slides] - <AUTHOR> https://bridgetkromhout.com/speaking/2017/srecon/ <comment><USER2> If anything is trendier than microservices, that is bashing microservices.

Before this comment pool spirals into that, I'll just leave this: It all depends on your project.

Did you have a bad time with microservices? Maybe the implementation was wrong. Maybe the project doesn't fit the model. Heck, maybe the project would STILL be screwed under a monolithic approach. There are so many variables to what classifies a success/failure in the microservice world (like most other things in software development, actually).

What's important is to not have a polarising opinion: "microservices suck", "microservices should be used for everything". Analyse your requirements. Imagine your professional project a few years down the line. Educate yourself on the subject (there are books on the subject!). Make. Sure. It. Fits.

I've personally had successes and losses with microservices, just like I had successes and losses with other architectural styles.

<comment><USER3> I've taken a middle of the road approach often I've often seen recommended. First build a monolith then split it apart logically when it makes sense. Not really 'micro' but my application with 6 medium components is easier than with one monolith, and easier than 20 micro.

Of course if I go to an interview I'll say I built microservices because it's a buzzword/checkbox.

<comment><USER4> This. Build monolith or SOA then shard off the pieces that are bogging down the application, then node them out.

</comment></comment></comment><comment><USER5> I recently completed a "next generation" architecture prototype for a client using microservices (that part was specified by them).

I developed a dozen microservices to mimic aspects of their existing applications and used Kafka as a message bus. The services rarely spoke directly to each other, but instead listened to events fired into the message bus and updated accordingly.

My biggest takeaway - the client should not use microservices, but could learn some other lessons from the prototype. Microservices make many things harder and the only benefit to them, in my opinion, is they can scale well. But if you're not working at Netflix scale, they're more trouble than they're worth.

What I did recommend: \- Build new applications API-first. By that, I mean your front end UI (assuming you have one) communicates to your backend via an API that can be exposed to the world. And assume it WILL be exposed to the world.

\- Avoid bloat in your applications. Stop adding every possible feature to your existing app, and pay attention to when it's getting too big. This is mostly a gut/intuition feel, but you can tell it's a problem when your developers start to look like a deer in headlights when you discuss a new feature.

\- (optional) Do create an enterprise message bus, and each application can fire events into the bus. This will help future-proof your organization, as new applications can be built to listen for events without having to understand the other systems.

</comment><comment><USER6> I have yet to see a good technical implementation of microservices. It always seem to get messy, inefficient and hard to organize.

Everything seems so hard. To follow and debug requests for example. How do you do that in a good way? Running a local microservice application is another.

Maybe microservices is good for very large corporations, but even then I am not really convinced since it seems easier just to learn one bigger codebase that is structured well rather than digging in to many different ones that may be writter in different languages etc.

The hype is so big and the benefits are very unclear. At least to me it seems like there are only negative aspects of doing microservices.

<comment><USER7> I always tell people: Microservices sacrifice _everything_ at the alter of scalability. Everything but scalability gets harder, not easier. You point out some good examples of places where this is true.

You should not be doing microservices unless you need that scalability. If you don't, regular SOA or even modular monoliths work fine. Microservices live in the place where those break down in scaling. That's a very extreme place, and so microservices are an extreme response.

As an example, let's take scaling services over a hybrid cloud. You have your own metal for the baseline request volume, with the capability to provision more capacity from a public cloud. A modular monolith is obviously out of the picture at this point. You would have two separate monolith instances, and would have to consider how and when to pass work between them... Possible, but at that point you're basically inventing a service architecture within a monolith, so why not just move to SOA? If you already have a SOA system, you still have work: Which services to deploy to the cloud, when to deploy them, how to recover and load balance to them, etc. Specific answers to these decisions are what led to what we consider modern microservices: What to deploy is the smallest unit possible, so that you can keep scaling as fine- grained as possible. Every request is routed through a discovery and load- balancer to any and all available instances.

<comment><USER8> What do you mean by scalability?

<comment><USER7> That's a great question. I mean ability to serve concurrent requests, or throughput. Microservices will typically worsen other metrics like individual response time.

<comment><USER8> I am not sure microservices are good for scalability in that sense. Microservices divide your application vertically, but for scalability you want to divide it horizontally. You don't want a separate service for each feature of your app, you want an application server that you can replicate as many times as necessary.

<comment><USER7> Microservices can scale both directions, same as other systems. You can allocate more resources to individual service instances (vertical), and you can allocate more service instances (horizontal). The later scaling should be done in an automated fashion.

If you look at something like Spring Boot, you will find that an individual service instance _is_ a stand-alone application server. That is what is duplicated when a new service instance is created.

</comment></comment></comment></comment></comment></comment><comment><USER9> From TFA: "I don't think anyone should approach management as a thing they move in to permanently. It's psychologically disfiguring."

Such a great quote. The longer I only do management-only work, the more anxiety creeps in silently about not being able to do these things on my own, not being competent enough, being a fake etc. The moment I decide to solve some problem for myself all is cool again - and I'm more trustworthy for the team as well. The problem is that such an approach tends to create conflict of interest - as a manager you shouldn't interfere too much and allow the team to solve the problems. Maybe the notion of manager is a problem in itself. It's a tempting perspective, but as far as I remember Google thought so as well and at some point they had to step back and reintroduce classic managers again ( [https://hbr.org/2013/12/how-google-sold-its-engineers-on- man...](https://hbr.org/2013/12/how-google-sold-its-engineers-on-management) ).

</comment><comment><USER10> Incredibly cringey presentation...

"Hard things are HARD", etc. plus a bunch of memes and my little pony pictures.

</comment><comment><USER11> Micoroservices are great for _RUNNING_ your app, monolithic are great for _DEVELOPING_ your app. I wish there was a way of developing like a monolithic and deploying like microservices.

Monolithics are good because you get a "stack trace" of an error! That stack trace is so much better than all that Ziplin stuff that barely work and takes so much longer to just see what caused the error!

</comment><comment><USER12> Someone eventually is going to build an app framework that offers clean reusable abstractions for micro services in the context of a further- abstracted orchestrated and containerized provider-agnostic automatically highly available and scalable infrastructure, complete with backup, security, log analysis, and all open source and installable through a single remotely executable shell script.

</comment><comment><USER13> to me this slide deck is "how to not completely fail at getting a minimally viable microservices arch going in your organization" which is good because apparently these lessons are not self-evident. But when are we going to get to "now that you're a healthy microservice company, how do you make it better? For you and your customers?".

I guess I would take the recent honeycomb outage as an example since charity majors in on the slides. When reading through the post mortem (which I liked a lot) the one question I never had answered was what are they doing to make sure 1 customer can't take down the entirety of their service? Assuming that failure is going to happen (via code bugs or bad actor customers)how do we better isolate individual customers from one another while still enjoying the benefits of mulitenancy? As we as an industry become more comfortable with microservices we must also learn how to better serve customers and mitigate failures by isolating and limiting blast radius, as well as deploying software in safer and saner ways.</comment>


Building trello.com for multiple devices - <AUTHOR> http://blog.fogcreek.com/building-trello-com-for-multiple-devices/

<comment><USER2> I'm surprised Trello doesn't support IE8. IE8 is the most IE popular browser for now, and that won't change very fast. IE10 might be the first break in IE legacy we'll see, with it's auto-update feature (thanks Chrome).

Google has announced to support the current version of 4 popular browsers and the previous version, and we've adopted that as our policy as well. I guess Trello has the luxury to be able to not support IE8, you lucky bastards ;)

<comment><USER3> I keep trying to decide if it's bravery or slight madness with their stated goal of massive traction.

In the end I guess the target market probably won't be the kind of person who has IE8 installed while unable to upgrade, the only downside I could see is if you as a consumer wanted to use it with clients.

I'd also say Google's 'decision' is totally arbitrary and only meaningful in relation to IE, more specifically support for IE7, don't copy them. What if MS start releasing versions like firefox are now? FF also got some flack from corporate clients who can't keep with the schedule. If a massive corporate with XP machines who are unable to go past IE8 suddenly pops up on Google's radar I wouldn't be surprised if that policy suddenly disappears when IE10 comes out.

<comment><USER4> We are both brave and mad!

Just kidding.

Imagine a traffic chart. The x-axis is time. Trello will last for 20 years, so imagine it going from 2011 to 2031.

The y-axis is usage. The numbers climb up and to the right. We think we can get to 100 million. So imagine either a linear curve or geometric growth or whatever you want, climbing from zero to 100,000,000.

Now think of the area under that curve.

What percentage of it is using IE 8?

Is it worth spending much money on them? Is it worth slowing down to build something for a small group of users that will be gone anyway, and which are only a tiny percentage of the overall usage of Trello over 20 years?

</comment></comment></comment><comment><USER5> I just discovered this last night. Fooling around with Trello on my alt monitor, I resized the page to a little under the iPad screen resolution and I saw a new layout. Going down to the smallest size, it was now an iPhone- friendly page.

I've started using Trello for personal projects and a little at work, and finding this kind of stuff is awesome. Knowing I won't have to fiddle with zooming in and out on my iPad/iPhone makes Trello a service I would love to pay for.

</comment><comment><USER6> Pretty impressive that this all happens with only one media query (two, really, but the second is for print), and that's just for the high-res images.

</comment><comment><USER7> Huge fan of the service and have enjoyed reading about the stack and other insight on how Trello came to be. Keep that Up.

Quick question about how you are handling security for your API. Are you using a 2-leg OAuth setup for your web requests? How do you handle the security of having the "secret" in the code?

</comment><comment><USER8> They must have created a request router based on the User-agent that pulls in all the right stuff for various combinations of device/browser type. This isn't hard to do, but very few take the time to do it. Nice.

<comment><USER9> Its not a request router ..one of the founders of the Mobile Monday stuff did one a few years back, his was shelved because he could not figure out how to support via ads though.

</comment></comment><comment> johnx123-up Is it based on any responsive CSS frameworks? or just JavaScript?

<comment><AUTHOR> Here is the full detail of the Tech Stack behind Trello - <http://blog.fogcreek.com/the-trello-tech-stack/>

<comment> johnx123-up I think that's old link (already did hit front page). But, I'm talking in _this_ context.</comment></comment></comment>


3scale: Open Source API management, auth and monetization - <AUTHOR> https://3scale.github.io/ <comment><USER2> [https://github.com/3scale](https://github.com/3scale)</comment>


Ask HN: What are you working on this decade? - <AUTHOR> <comment><USER2> My buddy and I did an alpha launch for our very first product yesterday. Even just showing our close friends revealed all sorts of bugs and obvious UX problems. We're working through all of those now, but it's really exciting to have launched something, even if it's extremely early.

[https://www.actionspanel.app](https://www.actionspanel.app)

It's a way to manually trigger your GitHub Actions, which is a feature that they somehow haven't done yet.

</comment><comment><USER3> My goal is figuring out how to combine my interest in medicine and technology as a physician. Unsure how I will do this since I'm currently a third year medical student, but I hope the opportunity presents itself soon.

What are you working on OP?

</comment><comment><USER4> My swift and brutal rise to power.</comment>


Mass exploitation of CVE-2019-11510 (Pulse Secure VPN exploit) has begun - <AUTHOR> https://twitter.com/bad_packets/status/1164592212270673920 <comment><USER2> A link to the actual scanning intel or report would be helpful.

<comment><USER3> Found this [https://www.securityweek.com/enterprise-vpn- vulnerabilities-...](https://www.securityweek.com/enterprise-vpn- vulnerabilities-expose-organizations-hacking-espionage)

> An attacker can gain the root shell on the target SSL VPN system with no > authentication required! The only thing he needs to do is to send several > malicious/crafted requests.</comment></comment>


Show HN: Jenkins 2.0 First Impressions - <AUTHOR> http://blog.alexellis.io/jenkins-2-0-first-impressions/ <comment><AUTHOR> I am a huge fan of Jenkins for Continuous Integration (CI) and the other uses people have found for it as a task/batch file runner and cron substitute. It has a wide range of community-supported plugins which also cater for .NET and Node.js (my main software stacks) making it a great choice at work and at home.

Check out the write-up and the way I've used Docker Compose to evaluate the software without having to install it.

</comment><comment><AUTHOR> If anyone found this useful I've put up a Github repo with a docker- compose.yml file and a tiny Jenkins agent image of around (150mb) down from 650mb.

[https://github.com/alexellis/jenkins2docker/](https://github.com/alexellis/jenkins2docker/)</comment>


Interview with Flyboard Air creator Franky Zapata - <AUTHOR> http://www.theverge.com/2016/4/15/11439798/franky-zapata-racing-jet-powered-flying-hoverboard-interview <comment><USER2> looks crazy, and like others it strained my credulity. But the interview sounded pretty authentic and the description of the development process also sounded credible. The Hiller Air Platform [1] was reasonably successful in the 50's and had less HP than modern RC turbojets can produce so the physics would seem to be credible as well.

[1] [https://en.wikipedia.org/wiki/Hiller_VZ-1_Pawnee](https://en.wikipedia.org/wiki/Hiller_VZ-1_Pawnee) (you can see this at the Hiller Museum in San Mateo)

</comment><comment><USER3> So as I've recently submitted my ParaWing concept to ApplyHN this is of course of interest! Quite a development and I'm glad to see it getting some attention. Skepticism is important as is being open minded.

Bottom line: It works. Caveat: It's dangerous as shit

Okay so this is the quote that got me:

> _It's a logic system inside the board that helps stabilize the machine. It's > extremely hard to stabilize, so yes it's not only my balance. For example, > we use like the same kind of electronics like you use on a drone to > stabilize. The problem is to create the algorithms, the right algorithms, to > combine the intelligence in the board and in your brain. So we spent about > four months to make that work._

That's why the ParaWing is such an important development in designing an airfoil and method that will allow the flight stability algorithims to have a wide range of viable parameters. All this computing power they've developed and deployed as a proof of concept is really, really impressive. It's almost as though a 'down-grade' version could be applied to the ParaWing for stability flight management.

Now, talking about those power sources - look at the numbers. 250 HP each? On something with zero lift? It's staring me right in the face. Put one or two of these on a ParaWing with the stability controls and now we're talking seriously revolutionary.

Sweeeeeeeeeeeeet.

<comment><USER4> Your ApplyHN is more of an idea for an application that an application. [https://news.ycombinator.com/item?id=11501823](https://news.ycombinator.com/item?id=11501823)

I would encourage you to resubmit including a mockup (not just a picture of a notebook), and in particular to talk about whether it is designed for recreational use and whether a pilot's license would be required.

<comment><USER3> Well the parameters of the Apply HN concept according to the original posting indicates "idea or prototype stage" submissions are suitable. As the UAV situation has indicated thus far the FAA is not a worthwhile entity to bother with in the non-public release stages. It would be in the Ultralight or Microlight, non-license category anyway. I've got the math, working in private to get "a mockup" going as able, and would encourage you to offer technical resources as you're able if you happen to be able. Or you can volunteer to be a test pilot when the time comes. That works too.

</comment></comment></comment><comment><USER5> Nice video, I like that people will pursue the craziest ideas because whatever, Homo Sapiens :)

The French accent was a nice touch too.

</comment><comment><USER6> This submission title is link-baitey, not the original title, and wrong (I had parsed this as meaning 10k ft _altitude_ , there doesn't seem to be any mention of this 10k number anywhere in the article).

I sympathize with the submitter that the article's title ("Yes, the jet- powered hoverboard is real, and yes, the creator has crashed it") is useless, but the slug in the URL isn't awful (franky-zapata-racing-jet-powered-flying- hoverboard-interview). So how about _Interview with Flyboard Air creator Franky Zapata_.

<comment><USER7> Good suggestion. Title changed from "Jet powered flying hoverboard reaches 10000 ft in air". Thanks!</comment></comment>


Digital IDs Are More Dangerous Than Thought - <AUTHOR> https://www.wired.com/story/digital-ids-are-more-dangerous-than-you-think/ <comment><USER2> Agree with the article. I think we generally underestimate the privacy- destroying power of the UUID: a single random-looking number can track absolutely anything.

Digital systems should require auth via public-key crypto rather than global IDs but keys can be correlated too. Whenever possible we should build systems with technical and economic incentives to preserve privacy, but I wish we had better ways to do that.

</comment><comment><USER3> It is too late, the current path has been chosen and none of the individual players in this game is able to change the rules of this game, every player is keeping all others hostage. Humankind has passed the treshold of self destruction in slowmotion and there is no way back. Be very thankful if you are still able to die by natural causes, coming generations will not be granted this gift. They will live and die under much worse conditions than we are. You will oppose my view of this but in your heart you know I am right, the door chosen by our forefathers was the wrong one, we are not able to cope with our own weak mind that is playing tricks on us and enable the most poweful of us to do things that are not healthy for our species. Try to debate me, but remember, you know I am right.

<comment><USER4> It is going to be weirder than that. Much that is hidden or implicit will be exposed. HIV accelerated gay rights. Humankind destroying itself with overuse of digital indentifiers could accelerate human rights, digital rights, or help to clarify what intellectual property actually is and what boundaries should it obey.

</comment></comment><comment><USER5> Deniable authentication [1] should be incorporated in all possible protocols where coercion could be employed or the messages have intrinsic value.

Didn't see that concept mentioned explicitly, but the article stayed pretty non-technical.

[1] [https://en.wikipedia.org/wiki/Deniable_authentication](https://en.wikipedia.org/wiki/Deniable_authentication)

</comment><comment><USER6> Is advanced bio-authentication the most solid path to "true" digital identities? i.e. some way to convert/verify dna to a digital id.

<comment><USER7> Absolutely not. Biometrics, unlike most other methods of authentication, cannot possibly be changed. This makes it impossible to change it in the event of a compromise. Also, most biometric identifiers are pretty easy to collect from someone in person without their knowledge. We leave DNA and fingerprints on everything we touch.</comment></comment>


If you did only one thing on a research paper, what was it? - <AUTHOR> https://www.overleaf.com/blog/32-hack4ac-text-mining-and-analyzing-author-contributions-in-plos-articles#.VQDvEPzkdcQ

<comment><AUTHOR> Has there been any more recent analysis of author contributions to research articles? It seems like an obvious thing to do, but there is very little data available on it...</comment>


Ask HN: Do you use odd numbers or prime numbers in CSS - <AUTHOR> My OCD prevents me from use odd numbers or prime numbers in CSS values. Do any of you have such a self-diagnosed OCD? :D <comment><USER2> I see from your article at [https://medium.com/dharma-experiments/join-a- startup-to-acce...](https://medium.com/dharma-experiments/join-a-startup-to- accelerate-your-life-d123a758acc#.1j7lk2z3w) and your comments at [https://news.ycombinator.com/item?id=9574548](https://news.ycombinator.com/item?id=9574548) and [https://news.ycombinator.com/item?id=5861582](https://news.ycombinator.com/item?id=5861582) that the prime numbers 2, 5, and 7 are not something you are not prevented from using in non-CSS, so I hope it's okay for me to use them as examples in a comment without triggering any undesired reactions.

I do not have such a issue. Looking through my CSS I do use such numbers. For example, I have an H1 definition which is 2em, and I have color definitions which are primes or odd numbers encoded as 6 hex digits.

In many cases I could use a decimal number, like "5.000004" instead of 5, or represent color as float rgb() values.

If it's the physical representation of the number, rather than the concept, which affects you, then a preprocessor like SASS would let you write "70/10" as a substitute for 7, etc.

This will be less maintainable, and if you have any co-workers you may have difficulty maintaining round-about solutions to represent values comfortably, give that few others will even notice that a 4 digit value like a year, or a hex, is odd, much less prime.

Last year, at [https://news.ycombinator.com/item?id=9568640](https://news.ycombinator.com/item?id=9568640) , you made a reference about how HN's CSS changed from 9pt to 10pt. This makes me wonder if your OCD has recently become worse. If so, that may be something you need to talk to a professional about, rather than ill-informed HN readers like myself.

<comment><AUTHOR> Who are you :O? Thats some serious observation skills. Thanks for taking the time to help me isolate the disorder.

Its not that I don't use them[odd and prime numbers], its more like I try and avoid them. :)</comment></comment>