Defending Against Hackers Took a Back Seat at Yahoo, Insiders Say - <AUTHOR> http://www.nytimes.com/2016/09/29/technology/yahoo-data-breach-hacking.html?_r=2&mtrref=t.co <comment><USER3> From the article:

 _> The "Paranoids," the internal name for Yahoo's security team, often clashed with other parts of the business over security costs. And their requests were often overridden because of concerns that the inconvenience of added protection would make people stop using the company's products._

That's the best summary of the problem for the industry as a whole, not only tech but any industry where failures are uncommon but with grave consequences.

A quote from Fight Club that illustrates that problem:

 _> Narrator: A new car built by my company leaves somewhere traveling at 60 mph. The rear differential locks up. The car crashes and burns with everyone trapped inside. Now, should we initiate a recall?_

 _> Take the number of vehicles in the field, A, multiply by the probable rate of failure, B, multiply by the average out-of-court settlement, C. A times B times C equals X._

 _> If X is less than the cost of a recall, we don't do one._

That's the current mindset of the technological world, estimating whether the cost of atoning for the problem is lower than the cost of securing the systems.

<comment><USER4> Calling them the 'paranoids' probably seemed like a fun idea at the time, but I wonder if it set up a subconscious bias against their work. I wonder if they had been called 'The Guardians' or 'The Defenders' there would have been a different outcome.

Seems trivial, but words matter.

<comment><USER5> The Yahoo Paranoids chose their own name. It was designed to be light-hearted in a way that didn't make them seem stuffy so that engineering teams would be more receptive to their work. In my experience, this is incredibly important from the outset.

Anyone who has worked in information security for a _month_ knows that the relationship between product engineering and security engineering defaults to antagonistic. It takes a lot of work to make it friendly and productive, and as a security professional I think "Paranoids" is much better for overall collaboration than something like "Defenders", which in my opinion reeks of self-importance.

The more pertinent issue here is management not fostering the culture enough.

<comment><USER6> Where I'm working now, we've got security engineers assigned to seating in each development team.

They're not managed by, or working for, our teams. They have their own manager and security work that they're getting on with.

Having them sitting amongst the team, however, is resulting in a much different narrative than any I've been around before. There's a much higher quality, and less antagonistic kind of engagement going on. They've become someone you chat with at the watercooler, or at their desks, instead of having to file tickets, or wait for scheduled reviews to raise things.

People can quickly consult with them and deal with a whole heap of small potential risks way early on in the development process, and it's paying serious dividends down the road.

<comment><USER7> That approach Works well with Q&A too.

<comment><USER8> You're talking about Squads basically. Bring different people in the same group. And yeah, QA is very similar to Security in some points, but if you think straight QA should include security. Weird to say that a software has quality without security included, but the truth is that security is specific that the regular QA usually can't handle.

<comment><USER9> You've capitalized Squad, but it's hard to Google. Where did you get that term, and where is it defined outside your head?

<comment><USER7> As xxr said, Squad is how Spotify names their (previously Scrum) teams. Other interesting concepts they use are "Tribes" and "Guilds". Take a look at the Spotify engineering practices, they are really inspiring.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER10> Funny timing. My in-laws (both 70+) just had to change their passwords (both using @yahoo.de email addresses) and my mother in law probably botched it / managed to type the wrong thing twice or something.

Password reset requires 2 security questions (ugh - already ugly) and while she's 100% certain that she knows the answer to both the second one isn't accepted - probably another spelling issue (think St. Marlo vs. St Marlo vs. Saint Marlo vs. Sankt Marlo vs ..).

All of this is her fault, not yahoo's. But now she's stuck. There are no ways to contact support, at all, and by now her 'resolve this problem' links already contain a "In rare cases like these, we suggest creating a new account" line.

Anecdotal moral of the story: Yahoo has no customer support at all. Migrate your elder family members away while you still can. :)

<comment><USER11> I just had to convert my online bank account to their _new_ (2nd in a year) system, which now requires five security questions. As a single man who doesn't have a "favorite" anything, this proved to be a challenge. All questions were either regarding spouses, favorite somethings, or questions about descendants which I have no clue about.

I ended up just picking random questions and setting them all to the same answer, which has nothing to do with any of the questions - something that I can't even misspell if I tried. This is going to be my new strategy moving forward.

And don't even get me started on their silly username and password "security" rules.

<comment><USER12> I use 1Password and randomly generate answers for each question and log them in the "Notes" of the account.

I'm sure other tools like KeePass have similar sections to do the same thing.

That way the answers aren't reproducible and you have them safely stored somewhere.

<comment><USER13> As an added bonus, this means someone armed with the real answers to those questions won't be able to get access.

When Sarah Palin's "personal" email was hacked during the 2008 election, the attacker used her Wikipedia page and recovery questions.[0]

[0]: [http://nypost.com/2008/09/19/dem-pols-son-was- hacker/](http://nypost.com/2008/09/19/dem-pols-son-was-hacker/)

<comment><USER14> 'hacking'

<comment><USER15> "to circumvent security and break into (a network, computer, file, etc.), usually with malicious intent"

Just because they didn't impress you by finding a side channel timing attack for the password hashing algorithm used by Yahoo, doesn't make it any less of a hack.

Why spend millions investing in a network of computers to break encryption, when the key can be gained far more easily with a $20 tire wrench applied with sufficient force to the DBA's knee caps?

</comment></comment></comment></comment></comment></comment><comment><USER16> I can relate to a company not putting value on security, or thinking the cost of securing systems may be higher than the cost of getting hacked.

I once worked for a company where I inherited a RESTful API. It stored the company's core data, including private customer information. It had no authentication, completely open for anyone on the internet to read or update any of our data.

I alerted my manager about this and that made its way to the highest levels of the company. The decision was to create a backlog item. It took about a year before we got to it.

The reason we ended up finally fixing it was because we were contacted by a security researcher one day. He said he had found a vulnerability in our system, but wouldn't tell us what it was until we disclosed our bug-bounty terms (basically promising to pay him if he had found a real vulnerability). If we wouldn't do this, he was going to write a blog post about it.

My manager used some delay tactics to buy us some time, while we spent the next 24 hours slapping a bandaid on the API. Once we had fixed it and agreed to pay the researcher, he disclosed his vulnerability and it had nothing to do with our API. It was a minor XSS that couldn't leak any sensitive information.

<comment><USER17> That sounds a lot like blackmail

</comment></comment><comment><USER18> I wrote a few days ago about how easy it is to compromise your ethics when trying to save a company. The problem is that once you compromise once, its very easy to do it again.

[https://news.ycombinator.com/item?id=12557163](https://news.ycombinator.com/item?id=12557163)

The problem is, it's way too easy to look past the action you are taking because you can talk yourself into believing its for the greater good.

And this is a huge ethical breach by Mayer, if she did this way back then, it's pretty reasonable to assume there are some more skeleton's hiding in the closet.

I don't really think I'd be wanting to give Verizon a reason to reconsider the takeover......

<comment><USER19> You might be interested in the research on "normalization of deviance". Most of the solid research in in safety critical operations like aerospace, however plenty of people have made parallels to other industries.

</comment></comment><comment><USER20> Can I just inject some perspective and say that the question would (should?) have gone something like this?:

"So we got 500 million passwords stolen. We're using bcrypt with an adequate number of rounds, so we only anticipate 1000 of those passwords ever being broken. Should we issue a mass reset?"

It's never black and white, you have to weigh things against each other.

<comment><USER21> Didn't the breach disclosure say "most" passwords were hashed with bcrypt? Obviously I don't know what everyone else got, but it can't have been better or they'd have said so...

I don't mean to detract from your point, good prevention beats reactionary resets. It just raised my eyebrows at the time as a strange weasel word in a claim that users were safe.

<comment><USER20> Now that you mention it, I remember that too. Seems weird, I don't know why you'd have some passwords hashed in other ways. Even if you've migrated, why not migrate everyone at once?

<comment><USER22> You need the user to login once to get their raw password to rehash it. Unless you like rewrapping old hashes in every new one as it comes along.

<comment><USER20> Yep, exactly. You wrap them all in the new one, and migrate when the user next logs in.

</comment></comment></comment></comment></comment><comment><USER23> Referring to the infosec team as "paranoids" is a really bad idea. I have our infosec team report into me and they terrify me on a regular basis but they are not paranoid. They worry, the poke around, they find stuff and they fix it.

<comment><USER24> The team calls themselves "paranoids" since at least 1999. I worked with them and have only praise.

"We try to be somewhat lighthearted about security," [head of department] said. "As important as it is, I also think it helps adoption if it is not too serious." [http://www.zdnet.com/article/at-yahoo-it-pays-to-be- paranoid...](http://www.zdnet.com/article/at-yahoo-it-pays-to-be-paranoid/)

</comment></comment><comment><USER25>
      "At Yahoo, we have a deep understanding of the threats facing our users and continuously strive to stay ahead of these threats to keep our users and our platforms secure,"

Why do I always get the almost unresistable urge to yell at my flat screen whenever a corporate spokesdrone opens his or her mouth?

Is the ability to talk plattitude-gibberish a requirement for such a job?

<comment><USER26> _Is the ability to talk plattitude-gibberish a requirement for such a job?_

It's not just a requirement, it is their job. How would you re-phrase that sentence in a way that A) isn't an actual lie, B) doesn't admit to any wrong- doing, C) keeps your customers calm and D) keeps your shareholder calm.

<comment><USER27> I generally agree with this, and it's been my consistent experience too.

But since I'm in full-on Elon Musk fanboy mode right now, have you seen in him the exact opposite? He's extremely up-front about things, good, bad and ugly, and it's so refreshing.

Additional tangent: I suspect that's what drew so many people to Trump and Sanders. Though it's hard for me to put both of them in the same sentence together, one thing they have in common is, at least, the appearance of being straightforward. In Sanders' case, I think he _is_ truly being straightforward.

</tangent>

<comment><USER26> _He 's extremely up-front about things, good, bad and ugly, and it's so refreshing._

As much as I love Elon Musk as well, I have to admit that some of comments around Autopilot and the accidents and possible problems surrounding it have had a distinct whiff of corporate new-speak to them.

<comment><USER27> I think I know what you're talking about, but to be clear, are you talking about his 'stern' tone about driver error? I won't disagree with that point.

<comment><USER28> Do you remember Ferdinand Piech telling Americans they didn't know how to drive when the Audi acceleration thing was happening back in the late eighties?

<comment><USER27> I don't.

</comment></comment></comment></comment></comment></comment></comment><comment><USER29> I am not sure what end-to-end encryption would have done to defend Yahoo's users against the entity that broke in and hoovered up its databases. Similarly: the password reset situation is sad (understandable --- it would have cost them millions of users at a point where their declining user base was being carefully watched by the market --- but infuriating) but again, what difference would it have made with respect to the most recent breach?

There are just a few companies in the whole world who both run tens of thousands of servers _and_ are equipped to go head to head with serious attackers. Yahoo isn't one of them. Has it ever been? No.

<comment><USER5> In the interest of discussion, would you be up for naming those companies, in your opinion?

<comment><USER29> Google, Microsoft, Facebook, Apple.

Maybe 3-4 other "smaller" big startups that have anomalously great programs, which I'm not going to name.

<comment><USER30> Seems like the banking industry has at least a degree of competency here as well. Who would bother with identity theft if you could just hack the banks and steal the money directly?

<comment><USER29> Strong disagree. The reason you don't see tons of bank compromises --- apart from the fact that banks don't routinely disclose breaches --- is that it's harder to monetize a breach than people tend to assume it is.

Think it through. So: you "hacked" a "bank". You're on their internal network. Talk me through "stealing the money directly".

<comment><USER30> Isn't that the point? If you can't monetize a breach of their network then it seems like they're doing their job.

<comment><USER31> There are many ways to monetize a breach.

<comment><USER30> Yeah. I'm not suggesting that it's an A+ job well done. But at the same time, relative to the target they are, seems like they're doing something right.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER32> >>"...said the company spent $10 million on encryption technology in early 2014..."

What does that mean, exactly? Is it really possible to spend $10 million on encryption or is that some kind of marketing spin on things? I'm genuinely curious about this.

<comment><USER33> I would guess that the bulk of the costs is installing the processing power that enables the encryption.

<comment><USER32> Ah, I just reread that article and now I see:

"The current and former employees say he inspired a small team of young engineers to develop more secure code, improve the company's defenses — including encrypting traffic between Yahoo's data centers"

So that makes more sense now, I guess it's possible to spend that much on "encryption". People and processing power are expensive I suppose.

<comment><USER33> They really are!

</comment></comment></comment></comment><comment> at-fates-hands Its the same issue since Grog tried to hide the first rock from Og:

 _The "Paranoids," the internal name for Yahoo's security team, often clashed with other parts of the business over security costs. And their requests were often overridden because of concerns that the inconvenience of added protection would make people stop using the company's products._

Infosec is never easy, and part of making things secure is that you give up conveniences for peace of mind. It's 2016 and I'm still a but surprised that people willingly open themselves and their data to hackers in lieu of stock holders and customer retention. It's unreal when you stop and think about it.

<comment><USER25> It's the same problem compliance departments at financial institutions face.

Compliance, by definition is bad for business. They will, after all, try to crack down on doing business with criminals, shady oligarchs or - <USER2> dictators, which can be highly profitable.

In the end, though, the best working banks are those where compliance has real teeth.

</comment></comment><comment><USER34> If Yahoo end up being successful like, for example, Slack or Dropbox these security issues will not be at all discussed here.

I did not see any outrage when Slack security issues back in May 2105 [1]: majority of people were saying "but it is great software". Dropbox the same.

So Yahoo did a similar bet as all other companies (focus on features - we will fix security latter) but they lost that bet.

[1] [http://www.makeuseof.com/tag/slack-hack-need-know- collaborat...](http://www.makeuseof.com/tag/slack-hack-need-know- collaboration-tool-security-breach/)

</comment><comment><USER35> Perlroth is gawker themed Krebs wannabe. Everyone involved in this story should be ashamed for helping fuel an unsourced article that is purely CYA for the former security team. Shame.

</comment><comment><USER36> The iron cliches:

\- Security is a process, not a product.

\- You _always_ pay for security. Up front, after the compromise, or both, if you're unlucky or bad at your job.

</comment><comment><USER37> If Yahoo had indeed positively identified the breach to have originated from a 'state-sponsored actor', it is possible that their thinking was something along the lines of "Resetting the passwords wouldn't help us much anyway against someone with so many resources."

Of course, I'm just speculating based on what I see in news reports. Perhaps the 'state-sponsored' actor was just PR spin to save face? I really just don't know what to think.

</comment><comment><USER38> "Mr. Bonforte said he resisted the request because it would have hurt Yahoo's ability to index and search message data to provide new user services. 'I'm not particularly thrilled with building an apartment building which has the biggest bars on every window,' he said."

How about an apartment building where everybody's shit keeps gets stolen then? Everybody tries like hell to move out, and the only tenants left are those with no place else to go. Which on the internet is nobody.

</comment><comment><USER39> If this is true it taints Marissa and any business that hires her in the future, because it's hard to think of a more stark example of putting the interests of the user last.

<comment><USER40> Did she put the interests of the _customers_ last or first, though?

</comment></comment><comment><USER41> I stopped using Yahoo the first time I setup an account for a friend and they were already on Yahoo's spam email reseller list faster than I could disable the opt-out setting. There was spam waiting in the inbox on an email account less than 5 minutes old.

I appreciate some of what they've done for the larger community, but decisions like that which make users take such a distant backseat to the bottom line make me not want to be a yahoo user ever again.

</comment><comment><USER42> See also: [https://news.ycombinator.com/item?id=12563798](https://news.ycombinator.com/item?id=12563798)

Quote:

> Whenever mega-hacks like the Yahoo! fiasco hit the news, inevitably the > question gets asked as to why the IT security systems weren't good enough. > The answer could be that it's not in a company's financial interest to be > secure.

</comment><comment><USER43> Reality check: Security (especially IT security) takes a back seat in 90% of businesses. The only exceptions are corps who gain significant power over govs and users by being secure (I think Google and Facebook here), and when regulations require a corp to do some kind of security fundamentals then these are applied as necessary to avoid fines.

</comment><comment><USER44> _Google hired hundreds of security engineers with six-figure signing bonuses, invested hundreds of millions of dollars in security infrastructure and adopted a new internal motto, "Never again," to signal that it would never again allow anyone — be they spies or criminals — to hack into Google customers' accounts._

Wow! Security starts at the top!

</comment><comment><USER45> That begs the question; what was in the front seat? Has Yahoo achieved anything of note since the 90's?

</comment><comment><USER46> Things are not going so well for Marissa. She's a technical person and should have known better.

<comment><USER47> I think she is financial wellness person and she is doing rather well for herself.

<comment><USER46> I think that beyond a certain level of financial success, it's the reputation and power that matters more. Marissa will never have to worry about money in her life. But power and reputation are ephemeral. Doesn't take much to ruin them.

<comment><USER48> Concretely, though, what consequence does this have in that respect? Is there a marginal party she's not going to get invited to because of the loss of rep from this breach? Is there an introduction she's not going to get?

Is there someone who matters to her who will deprive her personally (i.e. not Yahoo) of something due to having remembered this event?

</comment></comment></comment></comment><comment><USER49> I'm not a big fan of regulation, but it feels like there is very little _internal_ motivation for a place like Yahoo to take security seriously.

Not sure what the solution is, but unless there is a financial reason to create, I don't think we'll see much change.

</comment><comment><USER50> Keep in mind shit like this is what happens when people get fired and blame management, rumors & shit get started like this. We don't know the real story.

</comment><comment><USER51> Companies should have a Chief Risk Officer who have a big component of their bonus based upon the success of their risk management strategies.

</comment><comment><USER52> Newsflash: struggling company doesn't spend time and effort on things that don't directly make them money.

</comment><comment><USER53> I just returned from DerbyCon. An amazing security conference that covers both attack and defense. All talks are on youtube. Here is a good summary of the powershell talks. Really good stuff.

[https://blogs.msdn.microsoft.com/powershell/2016/09/27/power...](https://blogs.msdn.microsoft.com/powershell/2016/09/27/powershell- security-at-derbycon/)

</comment><comment><USER54> Google hired hundreds of security experts with 6 figure bonus... Is this kind of bonus norm in the Valley?

</comment><comment><USER55> Interesting how internal politics works. Breach news coming right after aquisition. Blame the new owner.

</comment><comment><USER56> How did they know it's the "Chinese military hackers" who's behind the attack?

<comment><USER57> Reading between the lines, it is the same attack that hit google way back when. Google disclosed it, and disclosed that 20 other companies were affected, and none of the other companies came forward.

<comment><USER58> Quite plausible, but what evidence is there to support that?

<comment><USER57> I don't have any other than there were 20 other companies who were not named at the time, Google was hacked by chinese military, now Yahoo claims china.

Deduction on my part, but no further evidence than that.

<comment><USER58> Sure, but China has also (allegedly) been responsible for many other breaches unrelated to the Google incident.

</comment></comment></comment></comment></comment><comment><USER59> The way Yahoo! has been running I think their front seat is completely empty.

</comment><comment><USER60> Marketing by deception... It's postponing the inevitable.

</comment><comment><USER61> Cannot wait for the class-action suit, I wonder if everyone across the world can join if it's based in the U.S. or if they would need to create class- action suits in their home country.

</comment><comment><USER62> > Google hired hundreds of security engineers with six-figure signing bonuses

Who left jobs working at other places and in theory left them more vulnerable and drove up the costs for hiring as well.

</comment><comment><USER63> I never would have guessed!

</comment><comment><USER64> Can anybody cite a single one good decision Marissa Mayer took? Honestly?!

<comment><USER65> Good depends on the perspective. She made a bunch of people fairly rich by buying their apps, even useless ones.

</comment></comment><comment><USER66> Does Twitter seem to take security seriously?

</comment><comment><USER67> I haven't even read the article, but based on headline I'd say "AND 99% of ALL companies EVERYWHERE." The headline makes it seem like this is an unusual thing.

Nothing is secure, anywhere. A few companies actually prioritize it. Very few.

And I truly think the economy could not bear the cost if everyone actually tried to prioritize security above all else.

</comment><comment><USER68> This is incredible. Hiding a breach like this is bad enough but to not even forcing password resets should be criminal. I think we're living in an age where information security is still in the cowboy stage of things. I think we're due for some tough regulations here. Clearly businesses do not have our interests in mind and in these cases our interest will conflict with theirs.

<comment><USER69> Regulations would be impossible to enforce. You can write up as many laws as you want but trying to enforce security constraints on new websites alone is an impossible task.

<comment><USER70> > trying to enforce security constraints on new websites alone is an > impossible task.

Why 'new websites alone'? Enforcing security standards on new/small websites would be harder than on large ones, and the large ones are more important. There are already many cyber-security related laws that are in place and more- or-less enforced. Having these laws makes large companies invest money into at least attempting to follow them for fear of legal repercussions.

<comment><USER71> > Enforcing security standards on new/small websites would be harder than on > large ones

Wait, you think the larger a property gets, the easier it gets to secure it?

<comment><USER33> I'm guessing s/he means that there are fewer total such sites, so any regulatory body wouldn't have as many individual properties to monitor.

That is to say, it's a reference to the effort of the regulatory body, not of the property managers themselves.</comment></comment></comment></comment></comment>


How do you find a temporary office space in bay area / NY? - <AUTHOR> We're trying to build airbnb for commercial real estate, but have hit some kind of roadblock in our thesis, so I thought I'd turn to you guys for help.
I want my users to book office space entirely virtually. However, people I have talked to (friends and family members) insist on visiting the place before renting it, even if it is for temporary purpose (1-6 months).
Since many of you are entrepreneurs or decision makers (my target segment), what would it take for you to have entirely virtual transaction for a temporary office for team size of 1-10 people? How do you do it today? <comment><USER2> If by "entirely virtual" you mean "sight unseen", I wouldn't do it at all.

<comment><AUTHOR> DrScump, by "entirely virtual", i mean you can ask for any kind of digital information - it may be lots of pictures, videos, 360 video, feedback about landlord from previous tenants, amenties etc till the point it becomes redundant for you to visit that place for booking it.

Also, some other things we are thinking about it like no lease policy - enabling you to move on whenever you want to.</comment></comment>


What is "Modern Perl"? - <AUTHOR> http://perlgeek.de/blog-en/perl-tips/what-is-modern-perl.html <comment><USER2> I have a friend who has done some really neat stuff with Modern Perl. I think that is the perfect name since it seems to be just using modern methods of development with Perl.

So, here is a serious question for the Perl geeks though:

Is Modern Perl basically TMTOWTDI falling out of favor? It seems like the article is saying "This is probably a better way" (TIPABW?)

<comment><USER3> _Is Modern Perl basically TMTOWTDI falling out of favor?_

Instead its morphed into TIMTOWTDIBSCINABTE, which fortunately is lovingly referred to as "Tim Toady Bicarbonate" :)

In full... _There's more than one way to do it, but sometimes consistency is not a bad thing either_

ref: [http://en.wikipedia.org/wiki/Theres_more_than_one_way_to_do_...](http://en.wikipedia.org/wiki/Theres_more_than_one_way_to_do_it)

<comment><USER2> corrected link: [http://en.wikipedia.org/wiki/There_is_more_than_one_way_to_d...](http://en.wikipedia.org/wiki/There_is_more_than_one_way_to_do_it)

That is awesome. While I don't write Perl these days, seeing things like this is like meeting up with old college buddies.

</comment></comment></comment><comment><USER4> Also, I rarely see listed Devel::REPL. Excellent, excellent tool. Run re.pl with perl -d, and you have half the useful REPLness of CL.

<comment><USER5> It's ok... It's better than nothing, but sometimes it can be pretty confusing (one can argue that's correct, but it's definitely not what I'd expect).

        $ my @a=(1,2,3)
        $ARRAY1 = [
                1,
                2,
                3
              ];
        $ my $r=[1,2,3]
        $ARRAY1 = [
                1,
                2,
                3
              ];

<comment><USER3> Thats just standard Data::Dumper output so nothing to worry about:

        $ say $_ for @a;
        1
        2
        3

        $ say $_ for @$r;
        1
        2
        3

You can switch on the _Data Dumper Concise_ plugin (Devel::REPL::Plugin::DDC). It will still display @a has a array reference but its nicer to look at:

        $ my @a=(1,2,3)
        [
          1,
          2,
          3
        ]

        $ my $r=[1,2,3]
        [
          1,
          2,
          3
        ]

_It's ok... It's better than nothing_

Come on its a lot better than nothing! Checkout the plugins on CPAN because this really makes it a very powerful tool: [http://search.cpan.org/search?query=devel%3A%3Arepl%3A%3Aplu...](http://search.cpan.org/search?query=devel%3A%3Arepl%3A%3Aplugin%3A%3A*+&mode=module)

<comment><USER5> I meant the array reference that looks weird even if you're listing an array.

Well... it is a usable REPL, but I'm used to running IPython+pdb as my login shell. `re.pl` cannot be really compared there.

<comment><USER3> I find _re.pl_ more than just an usable REPL and considering its a lot younger project than IPython then I'd have to say its progressed/progressing extremely well.

<comment><USER5> No sympathy there, unfortunately. IPython started in 2005 and was very usable shortly after. Actually, it was more usable then, than Devel::REPL is now. Devel::REPL is now 3 years old (released first cpan version, 1.0 in 2007) and I really can't defend it. It's just not on the same level yet. Even Zoidberg is better in some ways, but it didn't provide nice enough access to Perl syntax the last time I tried it.

<comment><USER3> No need to defend or provide any sympathy because I find Devel::REPL to be a great REPL and it fulfils all my needs. I've used REPL's in Ruby (irb), Io, Rakudo and Clojure and IMHO Devel::REPL is no where near the bottom of this list!

BTW, a couple of points:

* Zoidberg is a shell clone (ala Bash, Korn, csh, zsh) and is more akin to projects/products like psh (<http://sourceforge.net/projects/psh>). While there are overlaps Zoidberg isn't really a full REPL (like Devel::REPL, PerlConsole or even Perl::Shell).

* Devel::REPL started as a blog post in April 2007 ([http://chainsawblues.vox.com/library/post/a-perl-read-excute...](http://chainsawblues.vox.com/library/post/a-perl-read-excute-print-loop-repl.html)). It may have been called version 1.0 but it was just an _proof of concept_ at this time.

</comment></comment></comment></comment></comment></comment></comment><comment><USER6> While I quite like the article, I'm amused to note that 5 out of the 10 "aspects of Modern Perl" are things I screwed up, struggled with, and standardised on - in a project back in the late '90s.

Tests, 3 arg open, strict and warnings were all things that came to prominence (at least in my head) shortly after the Perl4 - Perl5 update. To a lesser extent "best practices" (the same concept but before the book was published) and "care and marketing" were all things being discussed and in clpm back around the same time everybody was worried about y2k issues. Even the OO stuff was well underway, with things like Abigail's "inside-out objects" being experimented with and discussed well before the start of the Moose project...

<comment><USER3> And this is all good news because it shows that Perl is progressing and continually improving. For eg. from Perl 5.012 you can now do this:

        #!/usr/bin/env perl

        use 5.012;
        use warnings;

That _use 5.012_ now automatically switches on _use strict_ along with all the extra Perl 5.12 features ([http://search.cpan.org/~jesse/perl-5.12.1/pod/perl5120delta....](http://search.cpan.org/~jesse/perl-5.12.1/pod/perl5120delta.pod)).

Perl + CPAN + time = programming darwinism :)

</comment></comment><comment><USER3> Also see perl5i for a _hypermodern_ version/vision/patch of Perl 5: <http://search.cpan.org/dist/perl5i/lib/perl5i.pm>

</comment><comment><USER7> Just one request from this old Perl hack: please make it easier to learn than Ancient Perl. If you need to be an expert on Vanilla Perl to be able to "get" Modern Perl, then it's going to have a hard time getting traction. Like those Java web frameworks that you needed to be a JSP guru to be able to grok.

Oh well, back to my usual Ancient Perl hacking...

</comment><comment><USER8> Python?

<comment><USER9> What about Python do you find better than modern Perl? Besides Pygame and NLTK, there's nothing in Python I can't do faster, easier, or more maintainably in Perl. I much prefer Moose to Python's barely-there OO, and nothing compares to the availability (and testing and other infrastructure) of the CPAN.

<comment><USER10> Not having to deal with copious amounts of accidental complexity needlessly introduced by the language? Just look at the example on the o'reilly page for the Perl Best Practices book which is linked to by this article. In Perl, there's more than one way of creating file handles, and one of them is the older and less effective way. What a useless fact I have to memorize!

Perl was actually the first dynamic language I learned, and when I looked online to see how to open a file, I found the old way first. Later on, I was like, "Hey! How do I pass this $@($*& thing to a function!?" So I looked online and found several competing ways to do it. I first learned of the OO way of doing it, but that required rewriting a lot of code. Then I discovered the syntax required to assign your file to a normal variable, which required me only to add sigils to my code! Unfortunately, I never got so far in my newbiedom as to learn the syntax for passing typeglobs around. This page describes the madness so wonderfully as a "perl recipe": <http://docstore.mik.ua/orelly/perl/cookbook/ch07_17.htm>. Yum!

And, of course, Steve Yegge describes what I'm saying much better at [http://sites.google.com/site/steveyegge2/ancient- languages-p...](http://sites.google.com/site/steveyegge2/ancient-languages- perl):

"There are no rules, no heuristics, no patterns. It's pure memorization. Commit the Perl Periodic Table of the Operators to memory, and you're officially 1/1000th of the way down the road to Perl Zombiedom. "

<comment><USER9> I don't know what to tell you other than if you deliberately write clunky code, you'll have trouble understanding and maintaining it. Passing typeglobs around isn't modern Perl; it hasn't been necessary for over a decade (to be specific, it hasn't been necessary since 22 March 2000).

... and I know Steve and I like Steve, but I wouldn't take medical advice from him either for much the same reason.

<comment><USER10> Steve may not be a medical doctor, but he is a programming language expert, so I really don't get your ad hominem refutation of what he said about Perl. Perhaps you can comment on what he actually said, not who he is?

Also, I think you missed the entire point of my post, including the example. I'm also not sure of how else to word it to help you get it. My point was that Perl requires you to deal with a host of issues that have nothing to do with solving your actual computing problem. One simple example of these many thousand idiosyncracies, which the article itself indirectly brings up, is Perl file handles. Even if you know the "modern" way of using them, you still had to go through the learning process to differentiate between the old and new styles, and you still have to commit a bunch of useless facts to memory. Worse, you may still encounter and have to deal with the old way in the wild!

I love the description of the perl5i CPAN module at <http://search.cpan.org/~mschwern/perl5i-v2.2.2/lib/perl5i.pm>:

"perl5i - Fix as much of Perl 5 as possible in one pragma"

Why not use a language that lets you get stuff done faster, instead of a language that's been feature-patched to death to fix the terrible design flaws it began with?

<comment><USER9> _Perhaps you can comment on what he actually said, not who he is?_

Certainly: that particular comment is irrelevant nonsense.

 _There should also be a CPAN module called Python. Fix as much of perl 5 as possible in one new language!_

I expect better discussion from Hacker News.

<comment><USER10> You're right about the Python comment, and I edited it out. However, I would also say that you've provided no discussion of value in your comments. I at least back up my statements with correct supporting arguments, even if I sometimes use overly strong language in making them.

<comment><USER9> My point is simple: the past ten years of Perl development have changed the language and its ecosystem dramatically. You can still write Perl as you did in 2000 or 1994 or 1987, but the Perl community tends to use terms like "Modern Perl" and "Enlightened Perl" and "Perl Renaissance" to distinguish between code we know to be buggy and clunky and difficult to maintain and the code we write now that we know so much better.

If you want to compare Python to Perl, compare Python 1.x to the ancient Perl that always comes up in these comparisons. (You may or may not deduct points from Python for breaking backward compatibility in the past near-decade.)

<comment><USER10> Then we don't have anything to argue about. I agree that modern Perl is a lot better than older perl, and that modules that fix perl, like perl5i, Coro, and Moose, enable you to write decent code using the language. I never tried to say otherwise. My point was, why bother, when you can use a language that doesn't need to be fixed in the first place? Life is so much simpler without all the extra accidental complexity.

<comment><USER9> _My point was, why bother, when you can use a language that doesn't need to be fixed in the first place?_

Because I'd rather have to add on Moose (something I _can_ fix while remaining compatible with other libraries) than use a language in which variables automagically spring into existence (which I _can't_ fix).

Worse than that, while I'm sure that new Python 2 classes and metaclasses allow someone to write a better object system for Python, no one would ever use it.

Thus my main non-syntactic gripe with Python is that the things I most want fixed either I can't fix and still have Python or no one in the Python community would ever support, because of the peer pressure to hew to one obvious way to do things.</comment></comment></comment></comment></comment></comment></comment></comment></comment></comment>


ZFS & MySQL/InnoDB Compression Update - <AUTHOR> http://don.blogs.smugmug.com/tag/lzjb/

<comment><USER2> I've done some similar testing with my ZFS pool with excellent results. I have hundreds of gigabytes of rarely used and easily compressible data that I store as gzip-9 and all of my data is at least lzjb compressed. I also experimented a little with different checksums and found that sha256 was too slow so I use fletcher4.</comment>


My Weekend Startup: Find Hot News Faster - <AUTHOR> http://karmafeeder.com

<comment><USER2> Why do people feel the need to compete for karma? It's not a competition.. if you find/have something of interest, share it, if not, go find something better to do..

<comment><AUTHOR> "karmafeeder" is meant somewhat tongue in cheek. Really it is just a better news aggregator, that is all.

</comment></comment><comment><USER3> Hiya, I kind of get the interface but don't really know what I'm looking at. Maybe something when a user first comes to the site to explain what's going on? Specifically, where do the stories come from and what determines their position on the page. And, some explanation of why I might 'log in with Facebook'

Cheers, congrats on putting something out there.

<comment><AUTHOR> The site is basically just an RSS reader + voting system. These are sites that constantly show up on HN front page and in other community news sites: the idea is that you can repost from this site for instant karma.

The number of sites that I am pulling from is still kind of low. As I add more sites, the story quantity will get higher and then I will look at ways to increase story quality too.

The facebook auth is required to vote, which I need to add a prompt if you try to vote before logging in.

Thanks for the feedback.</comment></comment>


iOS build automation and Fastlane - <AUTHOR> I recently discovered Fastlane(https://goo.gl/Bh5L82) and I couldn't be more excited by it's promise. So for those who do not know about it, well Fastlane seems pretty awesome and just imagine how much time it can save when uploading a new build for your app. My only complain is that Fastlane moves quite fast i.e. it is updated quite frequently and as such some of the online tutorials that focus on an older version become less useful like this one(https://goo.gl/8Q46HY) so if anyone knows a tutorial for a more recent version of Fastlane please mention that in a comment. <comment><AUTHOR> anyone has anything to add to this?</comment>


Build a Successful Product Team by Former PayPal Senior Product Manager - <AUTHOR> https://www.productschool.com/blog/product-management-2/build-successful-product-team/ <comment><AUTHOR> Anyone else see the irony in the title of this article? ;)</comment>


The impossible task of creating a "best VPNs" list - <AUTHOR> http://arstechnica.com/security/2016/06/aiming-for-anonymity-ars-assesses-the-state-of-vpns-in-2016/ <comment><USER2> So who is this article aimed at? If you intend to torrent, you're not going to roll your own on a VPS that is going to forward DMCA notices right back to you. DO and AWS are not cool with operating as high-transfer seedboxes and will be fairly expensive. If you're trying to remain hidden from a nation- state level actor you're obviously not going to use a VPS, but you also have bigger problems than HideMyAss accidentally leaking your ipv6 address. If you're like most people and don't want to pay $$$ a month for a VPS but want to torrent a bit, you just want a straight up regular VPN recommendation which they never provide. "Choosing a VPN is hard", yeah no shit, that's why I was hoping you would provide some value by doing the work for me.

I was in the market recently and ended up going with iVPN for $100/year. Their "18 questions to ask your vpn provider" [1] page is basically a more practical version of this article. Not that I am going to use it, but they also have guides showing you how to created nested and branched chains of tor/pfsense vm clients across countries, if you really did want to hide traffic from a nation state. If putting your trust into a VPN is the issue it's much easier to trust someone that links directly to security forums and openvpn documentation.

[1] [https://www.ivpn.net/privacy-guides/18-questions-to-ask- your...](https://www.ivpn.net/privacy-guides/18-questions-to-ask-your-vpn- service-provider)

<comment><USER3> >you're not going to roll your own on a VPS that is going to forward DMCA notices right back to you

Why not?

>DO and AWS are not cool with operating as high-transfer seedboxes and will be fairly expensive

DO and AWS are certainly the last providers you'd want to use for anything high-transfer. Why would you even consider them over, say, OVH?

</comment></comment><comment><USER4> So what's the best way to browse anonymously these days? Is it running a hypervised OS (some hardened GNU Linux/BSD Unix variant?) with a randomly changed LAN MAC upon every boot, connected to a VPN operating outside US with OpenVPN & 4k PK (e.g. in Romania), browsing using TorBrowser with NoScript and WebGL turned off? Or even two VPNs at the same time, one in the base OS, the other in the hypervised one?

<comment><USER5> You can browse with Tor but most sites (including this one and Twitter) won't let you sign up/post with Tor. Very dubious practice by the site operators IMO.

<comment><USER6> Not dubious, tor is used by all sorts of abusive spam bots and people who just want to shitpost for the lulz.

<comment><USER5> User based voting solves both those problems without having to nuke the ability to post anonymously.

<comment><USER7> How do you differentiate between legitimate new users with no record, and a returning shitposter's 10000th spam account with no record?

How do you differentiate between legitimate new users with a bunch of existing users vouching for them, and a returning shitposter's 10000th spam account with a bunch of existing stealth-mode accounts vouching for them?

I think you're using an extremely weak definition of "solve".

<comment><USER5> Although Reddit is not perfect, it doesn't seem to be a big problem there. Tor works and you can start posting as soon as you sign up.

<comment><USER6> reddit rate-limits new posters to something like 1 post every 15 minutes until they've accumulated some positive karma.

<comment><USER5> Yes, but they allow new posters to be anonymous by simply not blocking usage through Tor.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER8> One big advantage of using a popular VPN is shared endpoints. Your traffic is mixed in with hundreds of thousands (if not millions) of other users.

Using your own VPS means you are easier targeted, tracked (on layer 3) and located -- since your VPS likely has a dedicated IP and you probably have a non-anonymized account with the provider. You're still relying on your VPS provider to not monitor outbound connections as you are on the VPN provider.

<comment><USER9> Maybe if you're a black hat firing up a brand new computer from a cafe while you left your phone at home. For the rest of us that just want to, say, watch the US Presidential debates from another country going through our own VPS is far better than relying on some possibly skeezy third party VPN. Personally I use HideMyAss when I'm travelling to countries I don't trust or when I'm on wifi networks that I fear may be monitored, but I'd rather spin up a Digital Ocean box if setting up my own VPN were as easy.

<comment><USER10> > but I'd rather spin up a Digital Ocean box if setting up my own VPN were as > easy.

I thought the same thing, until I found openvpn-installer [1]. You just need to run 1 command - the entire OpenVPN setup process takes 5 minutes. I used it on both Debian and CentOS and it works flawlessly.

At the end, you just grab the config file using rsync or SFTP, and load it into your OpenVPN client. Now I have a dedicated droplet for VPN use. Once a month I destroy it and create a new one, because I'm slightly paranoid :P

[1]: [https://github.com/Nyr/openvpn-install](https://github.com/Nyr/openvpn- install)

<comment><USER11> openvpn-install creator here :)

Thanks for the mention!

<comment><USER10> Man, I can't even imagine how much time your script has saved us! Thanks for the awesome work!

</comment></comment></comment></comment></comment><comment><USER12> > Tor makes people more susceptible due to its reliance on an outdated version > of Firefox.

Tor uses a current version of Firefox and automatically updates it.

</comment><comment><USER13> Cf. [https://thatoneprivacysite.net/](https://thatoneprivacysite.net/)

<comment><USER14> I cannot rate this site highly enough. The guy running it is doing a tireless service to weed out scam reviews and fake service descriptions.

He also has a subreddit:

[https://www.reddit.com/r/vpnreviews/](https://www.reddit.com/r/vpnreviews/)

</comment></comment><comment><USER15> The article recommends 'Streisand' [1]. According to their GitHub page their VPN is resistant to DPI.

>Distinct services and multiple daemons provide an enormous amount of flexibility. If one connection method gets blocked there are numerous options available, most of which are resistant to Deep Packet Inspection.

I don't know too much about networking, but didn't realise it was possible? How can they do that? What protocol/service can bypass this? The network security team at work challenged me to see if I could bypass their WSA, so would like to give it a try.

[1]: [https://github.com/jlund/streisand](https://github.com/jlund/streisand)

</comment><comment><USER16> Something I consider but most articles do not: jurisdiction. I want and use a VPN in Sweden for a reason. I wouldn't go anywhere near any VPN with even a tiny US footprint. Similarly, I wouldn't use a VPN in my home country. Location location location.

<comment><USER17> US has no mandatory data retention laws, part of the reason I pick PIA specifically over VPNs outside the US.

<comment><USER16> No written laws specific to that point. But just look at the NSLs Yahoo released a couple days ago. They can do whatever they want whenever they want. While such things may be possible in Sweden, if they do happen they are extremely rare. The US is the surveillance state.

<comment><USER3> You do that Sweden wiretaps _all_ traffic that crosses their borders, right?

They're doing more aggressive surveillance than the NSA.

</comment></comment></comment></comment><comment><USER18> Isn't the best simply running your own for $5 on DO?

<comment><USER19> Not all wifi points allow VPN traffic. At various coffee shops, I've had both OpenVPN and Cisco Any Connect traffic outright blocked.

Getting around such blocks (such as with a SSL tunnel) is possible, but requires more than just a default install.

Also, setting up anything other than OpenVPN is a real pain in the arse. Even OpenVPN required a fair bit of Googling to make it fully functional.

<comment><USER8> I've found the most success with getting passed captive portals on non-free "Free WiFi" is simply OpenVPN over dns/53\. It works a lot of the time and sometimes conveniently bypasses throttling/QoS.

</comment></comment></comment><comment><USER20> I didn't find this article very convincing.

1\. "You must trust the VPN." This is true, but you must trust something (your cafe, your ISP, your computer). In fact the entire article really hinges on this point -- the VPN provider could, if it were malicious (or compelled to by a government) log every aspect of your traffic, or even insert malware. However, so could your home ISP or your coffee shop.

In particular I found this statement very bizarre: "VPN services require that you trust them, which is a property that anonymity systems do not have." This is true in a vacuum. In the real world, unless you're running your own hardware with software you have written yourself from scratch (on a system which you monitor continuously), you are trusting a huge amount of stuff even with the best anonymity system. The point is knowing what you are trusting, rather than trusting it implicitly.

Essentially the point of the article seems to be to point out that VPN providers may be (there are a lot of hedge words) untrustworthy. The only actual example given of an untrustworthy VPN provider is a free one which re- sold its users' bandwidth (point 8).

Real-world examples are important, because reputation is important -- at some point it is very likely that you will end up trusting someone, even if you are being very careful.

2\. "Some VPNs don't permit peer-to-peer sharing and/or log such sharing". You must rely on reputation, which is not a great option. However, no alternatives are presented for someone who wants to torrent copyrighted or illegal works (TOR is heavily FUDded in the article). You certainly wouldn't roll your own VPN for this -- see below.

3\. "VPNs don't protect very much against ad tracking". This is true, but I mean VPNs don't make your teeth much whiter either.

4\. "A dodgy VPN could log all your data". This is the same as point 1.

5\. Preshared keys. OpenVPN with server certificate checking would seem to address this.

6\. "Your VPN provider might log your data". This is the same as point 1.

7\. "Leakage". It's useful to inform people about this. However, once informed, it is quite simple to use one of many online services to verify that no information is leaked.

8\. "Snake oil" and in particular a free VPN which sold its users' bandwidth. Fairly obviously, be aware that if you are using a free product the company will attempt to monetise you in some way.

The suggestion to set up your own VPN seems to be presented as a way to improve privacy. This is very strange particularly since no threat model is presented, and the common one (mass surveillance) gets much worse with a personal VPN.

Firstly, shared hosting providers such as DigitalOcean, AWS, OVH and so on are presented. There is no particular reason to suspect that these are more or less trustworthy than any given VPN provider. In particular, shared hosting in the US will certainly be subject to the monitoring whims of the US government.

Secondly, using such a DIY solution will associate all your traffic, and only your traffic, with a single outgoing IP address, easily traceable to you (since you're paying for it). Compare this with any shared-endpoint VPN, where your traffic is combined with that coming from many other users, and the owner of the IP address is a VPN company. In the former situation nobody would even need to inform the hosting company -- they could just monitor its traffic (though as discussed in point 1 they certainly _could_ contact the hosting company if necessary). In the latter situation, the VPN company would need to be involved. At this point a certain amount of process is required. If your threat model is mass surveillance rather than targeted monitoring, then the shared VPN provider certainly seems like an improvement over a roll-your-own solution. "The best place to hide an incriminating letter is in a letter rack!" \-- Edgar Allen Poe.

Thirdly, with a DIY solution you are implicitly claiming that you are better at hardening a system and staying on top of security patches than is the VPN provider you were considering going with. This isn't necessarily true.

If you are just concerned about opportunistic data collection from your coffee shop, then a personal VPN would help. But it's quite limited, and significantly simpler solutions like HTTPS Everywhere would get you 90-100% of the way there.

If you are specifically concerned about an entity with the resources of a government monitoring specifically you, none of the options presented will be any use.

</comment><comment><USER21> ffs... Just read this

[https://thatoneprivacysite.net](https://thatoneprivacysite.net)

</comment><comment><USER22> Reminder that Opera has a free built-in VPN

not private but free and always available

<comment><USER23> It's a proxy—not a VPN: [https://gist.github.com/spaze/558b7c4cd81afa7c857381254ae7bd...](https://gist.github.com/spaze/558b7c4cd81afa7c857381254ae7bd10)

<comment><USER24> What's the practical difference? And don't say it's because it only affects Opera traffic: you can configure a system-wide proxy, and you can VPN a single program.

<comment><USER25> What happens to outbound UDP packets when the 'VPN' is active? Can they be inspected or modified by your ISP?

<comment><USER24> I don't think Opera would be sending UDP packets. If if did, they would be encrypted through the tunnel.

<comment><USER25> This is incorrect, at least it was in April this year:

The head engineer of Opera for computers Krystian Kolondra: "Currently WebRTC and plugins are still not routed that way"[0]

The _technical_ difference between a VPN and a proxy is typically that the proxy works at the application layer (layer 7) of the network stack, whereas a VPN creates a new network interface and operates at the network layer (layer 3).

The _practical_ implications (which you asked about) are:

i) With a proxy, there's no new system network interface, so no way for other apps to use it

ii) A proxy is application-specific (in this case HTTP and HTTPS) so other protocols (even those that opera supports, like WebRTC) can't go through it.

[0][https://www.helpnetsecurity.com/2016/04/22/opera-browser- vpn...](https://www.helpnetsecurity.com/2016/04/22/opera-browser-vpn-proxy/)</comment></comment></comment></comment></comment></comment>


Capons: Are Chickens Without Their Testes a Forgotten Delicacy? - <AUTHOR> http://modernfarmer.com/2014/04/capons-unfairly-forgotten-piece-agriculture-somewhat-disturbing-luxury/

<comment><USER2> You used to be able buy them at the West Shore Farmers Market in Lemoyne, Pennsylvania, a suburb of Harrisburg. But I don't recognize the stand's name on the current map, and I don't suppose that Cumberland County is really a hub of HN readers.

</comment><comment><USER3> Cruel and unusual. Being the organisms with the most intelligence, we sure do stupid things. Not an example we would want to set for when the smarter aliens come. Oh succulent human Eunuch meat...

</comment><comment><USER4> We encourage pet owners to spay/neuter their animals. Caponizing is no different, except for the intended purpose. It sounds tasty, so now I'm curious.

<comment><USER5> No different? You do understand that the procedure is invasive and dangerous? That the person who perfected it killed thousands of birds getting it right?

</comment></comment><comment><USER6> Vivisection is immoral and evil, be it done on a human or an animal.</comment>


Shifting data bandwidth on your Android 4G device to double battery life - <AUTHOR> http://silverwraith.com/blog/2012/02/significantly-increase-your-4g-androids-battery-life/

<comment><USER2> Interesting. My device on sprint lets me disable wimax from my status screen. Also, it powers down its wimax radio when not in use.

<comment><AUTHOR> The basic idea isn't unlike the "Battery mode" (which I think is part of the Motoblur stuff, not stock Honeycomb?): Disable mobile network data when it isn't needed. In this case, "when" is "any time a wifi network isn't in range" :-)

</comment></comment><comment><AUTHOR> I sincerely hope this is helpful to others. If there are any suggestions, or improvements, I'd be happy to include them.</comment>


Rotten Tomatoes makes it next to impossible to delete your account - <AUTHOR> https://twitter.com/aminozuur/status/1271818835998445568 <comment><USER2> Off topic but OP, if you are the owner of the Twitter account please think about seeing a counselor. I really think you need to talk about the things on your mind that have lead to you making those statuses and Twitter isn't the place to do it. A counselor will listen and serve as a much better outlet. All the best.

<comment><AUTHOR> I appreciate your concern. Those tweets are ment to be humorous (for those few with similar dark taste in humor). I love myself and my life, and guard my peace of mind well.

<comment><USER2> I'm glad to hear it mate. :)

</comment></comment></comment><comment><USER3> Posted to a site where it's _actually_ impossible to delete your account.

</comment><comment><USER4> I fail to understand here, it's impossible to delete your account, unless you follow the instructions?

</comment><comment><USER5> If you don't have the mental capacity to fill a form, yes I guess they are making it next to impossible.</comment>


PostCSS Plugin and 128 Bytes Script to Use WebP in CSS at Chrome/FF/Edge - <AUTHOR> https://github.com/ai/webp-in-css <comment><USER2> Why not just HTTP content negotiation?</comment>


Open Source gurus need some advice Discuss thread - <AUTHOR> Hey guys. What do you guys think about open source projects. Do you contribute to some? Why? And if not why not? I thought about coding a open source platform for open source projects. It should introduce "noobs", who can code already into the beautiful world of open source projects. Do you guys participate at opensource projects? <comment><USER2> Brilliant strategy, starting your message by insulting those whom you want advice from.

<comment><USER3> hahahha i thought the same. But its nice he got my attention. It worked out

</comment></comment><comment><USER3> Hey buddy. I guess it is a nice start to help people to get more into open source. At the moment there is a really high barrier to get into those open source projects, thats why i am to lazy to inform myself. Tell me about your idea and how do you kill that barrier

<comment><AUTHOR> I want to build up a community of open source projects. Lots of companys provide open source project with a mentoring program. That means if you contribute to a project you get connected to a mentor, who knows about the project and can help you instantly. Besides that you always know exactly what you have to do. Every Project should have well defined goals for the contributor. It is a win win situation for both partys. The mentors get code done for free and the beginners get job experience.</comment></comment>


Protean: The World's First Reactive Gaming Keyboard - <AUTHOR> https://www.kickstarter.com/projects/archtor/protean-the-worlds-first-reactive-gaming-keyboard?utm_source=hacker%20news&utm_campaign=hacker%20news&utm_medium=media <comment><USER2> Seems like a gaming version of the Optimus Maximus which was very expensive. Are the screens needed for this so much less expensive now that you can manufacture one for £99?

<comment><USER3> The Optimus Maximus had one big screen under it, with quite a high resolution. These keys all have individual screens with a a resolution that is not that high.

I'm surprised about the price too. Mechanical keyboards tend to be really expensive, let alone mechanical keyboards that have screens in the keys.

</comment></comment><comment><AUTHOR> Protean has a screen embedded in every key you can create your own unique interface, modifying key layout and function for any game or app.

This is pretty cool.</comment>


New Startup Aims to Commercialize a Brain Prosthetic to Improve Memory - <AUTHOR> http://spectrum.ieee.org/the-human-os/biomedical/bionics/new-startup-aims-to-commercialize-a-brain-prosthetic-to-improve-memory <comment><USER2> Lots of hype but sadly very little science going on here. They have a few superficial models of hippocampal circuitry but almost nothing about how that circuit fits into the larger systems of learning and memory.

There so many major technical issues that make this little more than vapor wear.

The hippocampal neural code is largely un-understood. Without the code they'll be flipping random bits and hoping for the best (akin to flipping bits in ram without understanding how the OS is representing data in RAM).

We still don't have reliable hardware for reading the activity of the brain. Most implants go bad after a few weeks with very few lasting up to a few years. Surgery every few years is unreasonable as each implant will leave behind permanent damage.

Next writing information to the brain is still in its infancy. We can disrupt processing with electrical stimulation but too much current will trigger a seizure (especially in the hippocampus). There's a lot of hope around Opto- genetics but we still need to figure out how to get targeted expression in an already developed human brain. It can take years to get expression right in developing mice.

<comment><USER3> "An implanted memory prosthetic would have electrodes to record signals during learning, a microprocessor to do the computations, and electrodes that stimulate neurons to encode the information as a memory."

or in other words -- we record "signals", then compute something, and finally "stimulate" the neurons. I appreciate that this isn't a scientific report but this borders on parody.

The magnitude of technical, computational and biological problems to be solved here in order to achieve anything even remotely close to the headline would require 3-4 major scientific breakthroughs. With all respect, you don't publish them in IEEE proceedings.

<comment><USER4> Their early experiments did pretty well with hardly any computation at all -- just recreating previously recorded patterns of activity. They can probably do some pretty cool stuff by adding machine learning (which they're definitely interested in based on who they're hiring)

</comment></comment></comment><comment><USER5> Impressive. What seems to be the underlying science:

Berger, T.W., Baudry, M., Brinton, R.D., Liaw, J-S., Marmarelis, V.Z., Park, Y., Sheu, B.J., and Tanguay, Jr., A.R. Brain-implantable biomimetic electronics as the next era in neural prosthetics. Proceedings of the IEEE, 2001, 89, 993-1012.

[http://www.bioee.ee.columbia.edu/courses/upload/Bibliography...](http://www.bioee.ee.columbia.edu/courses/upload/Bibliography/berger_procieee_2001.pdf)

</comment><comment><USER6> If it works too well we could find ourselves in a situation where anyone who uses their brain for a living will need 'enhancements' like this just in order to compete and be employable (even if they aren't strictly legal).

Much like cycling and doping :)

<comment><USER7> > anyone who uses their brain for a living will need 'enhancements' like this > just in order to compete and be employable

I presume you've heard of coffee...

<comment><USER8> There's a saying that a mathematician is a device for turning coffee into theorems. It's dual is that a comathematician is a device for turning cotheorems into ffee.

<comment><USER7> I've worked with mathematicians, but never heard that one before. Thank you! Now I know the origin of the one about programmers being devices for turning coffee into code.

</comment></comment></comment></comment><comment><USER9> This seems like a fine time to discuss the ethics of augmenting healthy brain function

<comment><USER10> I think we can wait until there is a working prototype.

<comment><USER2> you'll be waiting a very long time. The tech is decades if not centuries off

<comment><USER11> Cynicism is not a replacement for skepticism.

What make you believe that the technology is centuries off?

</comment></comment></comment></comment><comment><USER12> Seems to be way to early in the cycle to start doing startups on this...

<comment><USER13> I'd hate to be the first VP of Sales

</comment></comment><comment><USER14> Johnny Mnemonic anyone? [https://en.wikipedia.org/wiki/Johnny_Mnemonic_(film)](https://en.wikipedia.org/wiki/Johnny_Mnemonic_\(film\))

</comment><comment><USER15> Like a cellphone and the internet? Or better yet, something with heads-up display like Google Glass. Or Siri/Alexis with throat mike and headphones.

Augmenting my memory since reading about the Remembrance Agent and getting into wearable computers in the 90's [http://alumni.media.mit.edu/~rhodes/Papers/remembrance.html](http://alumni.media.mit.edu/~rhodes/Papers/remembrance.html)

<comment><USER16> This is about people with dementia, not forgetting the milk.

</comment></comment><comment><USER17> Its called "google"

<comment><USER18> This is very true.

I'm curious what kinds of evolutionary biology impacts technologies like Google's search engine have on humanity. Before the internet, there was a large motivation to memorize information in order to quickly retrieve it without a very costly lookup operation. Now, a more efficient method to access information is to "index" the information with your brain - i.e. just remember how to find it quickly with the right search terms. This way, a significantly larger amount of information can be accessed very quickly by an individual.

I have noticed this in my own life. I consider my ability to recall things with Google to be a skill, and I consciously do not memorize pieces of information which I am fairly sure I will be able to find in <10 seconds. I think that using my brain as an index allows me to ingest more concepts, and as a result of that make more connections between concepts. It's definitely not without downsides though, an obvious one being a very high level of reliance on internet access. I wonder how this will play out over time, and if there are directly observable physiological differences between individuals with and without the internet as a form of memory-augmentation.

<comment><USER17> We could study the effectiveness of this brain augmentation device simply: fill out an IQ test with and without access to google. See how many points it adds! I'd be very interested in the outcome.

<comment><USER18> I wonder if an IQ test would be able to meaningfully capture the difference between the two groups, considering that Google kung fu is only helpful for a certain set of tasks that in my experience are often very macro-scale.

</comment></comment></comment></comment><comment><USER19> I expect to see this for presale on Indiegogo or some other crowd funding site in the coming weeks...

</comment><comment><USER20> What advantages could possibly exist in enhancing our ability to store data in decaying meat?</comment>


Ask HN: How do i promote my Android App? - <AUTHOR>

Hi guys, i just released my android application two weeks ago. currently it has been downloaded 1000, and i think that's too low. How do you guys promoting android app ?, is there any website should i follow to ? this android application also happen to be my Final your project to finish my study, so i really want to do everything for this.<p>Thanks. <comment><USER2> try to submit your app in Android sites that do apps reviews, some links over the web can help maybe to spread it out</comment>


Ask HN: How much can a student ask as a first time freelance web developer? - <AUTHOR>

Hi,
I'm met some people who are founding a startup. They would like me to develop their idea. I'm a student just now "officially" learning ICT, but got some years experience with amateur webdevelopment.
It's a website that takes an expensive mandatory time-consuming activity and offers to do it online. You can do it when you want so you have more "time with the kids". They are looking for 2M euro funding and the plan is to turn breakeven after 1 year. For year 1 they estimated the total IT-related costs at 50K euro.
We talked a little about wages and concluded that I would count my hours and would be paid more than the minimum (10 euro/hour). Payment follows after each done module/feature. I think they have no idea how much they should give and that they would rather like that I ask for a certain amount.
I hear a lot of numbers. Should I go for more than 20/hour? Advice please :-) <comment><USER2> Do these guys know what they are doing? I am worried that you will end up doing lots of work for free.

Warning Signs:

* These are some people you met, who are founding a startup.

* You are a uni student with only amateur web development skills

* They are trusting you with developing their idea

* They have a very bullish goal to break even after just 1 year

I would be sceptical that they will not be able to raise the 2M Euro. They will have you work on the project and it will go no where.</comment>


An Inside Look at Y Combinator - <AUTHOR> http://www.readwriteweb.com/archives/an_inside_look_at_y_combinator.php <comment><USER2> This is actually just meta-babble about this:

<http://news.ycombinator.com/item?id=213375>

<comment><USER3> _meta-babble_

That's a great phrase. I hadn't heard it before.

<comment><USER2> Google knows 897 instances at this point:

[http://www.google.com/search?client=opera&rls=en&q=m...](http://www.google.com/search?client=opera&rls=en&q=meta- babble&sourceid=opera&ie=utf-8&oe=utf-8)

Not _that_ popular a phrase. I have no idea if I picked it up somewhere or just made it up on the spot, I think it was a subconscious thing.</comment></comment></comment>


Show HN: ScriptUI – Write React Without JSX - <AUTHOR> https://github.com/anater/ScriptUI <comment><AUTHOR> Hi HN!

I'm the author of ScriptUI. I whipped it up over the last few weekends as a proof of concept. I'm looking for feedback on whether you'd use something like this. I hope it helps make starting projects easier.

Thanks for reading!</comment>