Simon Peyton Jones: How to write a great research paper  - <AUTHOR> http://research.microsoft.com/en-us/um/people/simonpj/papers/giving-a-talk/writing-a-paper-slides.pdf

<comment><USER2> An okay discussion, but it falls entirely flat on its face in a very important place: related work.

What is the point of related work? Notionally twofold: to argue that there are people that care about what you're doing (because they're asking similar questions), and to argue that people haven't done the work yet.

But in reality there's a third reason: to help tell the story.

Writing a paper is telling a story. The story of an interesting problem, and how you went about solving it.

Simon thinks that related work should go at the end of the paper. Reading his slides makes it clear to me that really the issue is that he doesn't know what to do with related work; it seems to be an anachronism to him that he has to put _somewhere_ so it might as well stick it at the end where no one will notice. He also seems to have missed that related work helps answer the "It's an interesting problem" and "It's an unsolved problem" sections of his story -- both of which he's got thrown up in the "Conveying the idea" slide. This tells me that he's likely not written a good related work section.

Related work is motivation. It's part of the story. It should be relatively up front. The story should go like this:

\- Introduction: Here is a problem

\- Related Work: Other people have gone after this problem and have failed to figure it out, or danced around it. People care about it.

\- Approach: Here is how I solve the problem

\- Details: Here is what I did

\- Discussion: Here is what the results were

\- Conclusions and Further Work: Here's what I'm going to do next.

<comment><USER3> _Related work is motivation. It's part of the story._

It depends on the paper -- in many cases, I think that a paper can be adequately motivated in the introduction, without explicitly enumerating all the potential related work. Given that most people stop reading quite early into a paper, I think there's a lot to be said for getting to the "Good Stuff" quickly -- and the related work is rarely the "Good Stuff".

Perhaps related work is more important for incremental, technical results: "problem A is important, B and C tried to solve it but their solutions were imperfect for reasons D and E, and therefore we propose F." But when you're, say, describing a new piece of systems software, the related work is less likely to be an essential part of the motivation for the paper.

</comment></comment><comment><USER4> John Cochrane (economist) has some excellent tips on writing for PhD students:

[http://faculty.chicagobooth.edu/john.cochrane/research/Paper...](http://faculty.chicagobooth.edu/john.cochrane/research/Papers/phd_paper_writing.pdf)

</comment><comment><USER5> They should require every first year graduate student to read this or something similar. The ratio of well to poorly written papers is far too low.

</comment><comment><AUTHOR> Non-Flash GView version: [http://docs.google.com/gview?url=http://research.microsoft.c...](http://docs.google.com/gview?url=http://research.microsoft.com/en- us/um/people/simonpj/papers/giving-a-talk/writing-a-paper-slides.pdf)

<comment><USER6> How is this different from clicking on the PDF link above (and not the auto- inserted, value-free scribd link) ??

<comment><AUTHOR> It is more convenient; there is no need to download the PDF and it can be viewed directly in the browser.

<comment><USER6> I'm using Konqueror on KDE on SuSE and it comes up fine in the browser directly. Your link appears to me to add an extra layer. Maybe I'm missing something.

Not important, just confused. Situation normal ...

<comment><USER7> Congratulations, you're happily using one of the few browsers with flawless built-in PDF support (the other being Safari on OS X).

The vast majority are not nearly as fortunate.

<comment><USER6> Hmm. Also works fine on Firefox 1.5.3 on KDE on SuSE. I guess I'm just lucky to have two of the few.

Oh, no, hang on, it works in IE7 as well. Hmm. I have three of the few.

What are you using?

</comment></comment></comment></comment></comment></comment><comment><USER8> One of those rare sets of slides that are both readable and highly informative as well as pleasing to the eye.</comment>


The Mind Wanders - <AUTHOR> http://bit-player.org/2018/the-mind-wanders <comment><USER2> I wasn't able to finish, but the first section was worthwhile. Very interesting ideas about how the brain encodes and associates information, and trying to find an algorithm and data structure that behaves the same.</comment>


eHarmony? IPO? Oh god... - <AUTHOR> http://money.cnn.com/2007/09/14/magazines/fortune/fastforward_eharmony.fortune/?postversion=2007091413 Say it ain't so. <comment><USER2> $59 a month? Are you kidding me? If people want a product like this that badly, its no wonder free competitors like PlentyOfFish have done so well. I am simply shocked the monthly fees are so ridiculous. People actually pay that?

In light of this, date matching with mobile devices (bluetooth or GPS enabled) could be a tremendous opportunity.

<comment><USER3> You can actually get a much cheaper monthly rate if you commit to several months. I don't remember exactly but it's something like $35/mo for 3 months and $25/mo for 6 months (the article quotes a $21/mo figure for a whole year), and when that time is up they continue billing at the reduced rate. They also offer ex-members lots of deals (which seems like blatant price discrimination to me)

Also, the membership fee and the sign-up process is designed to weed people out as much as it is designed to attract people.

</comment></comment><comment><USER4> My startup is similar to eharmony and chemistry. We have more than 800 users in Mexico. But we still don't know how to make money. The trick is that advertisement is expensive and people are secretive about their use of the service and they don't tell their friends.

<comment><USER5> > The trick is that advertisement is expensive

Dating keywords are bid up, way, way up.

I am in a similar boat with a small advertising budget, for the past 2 years I have been using www.adbrite.com. At first it takes spending some time getting ads on sites to determine if they could drive the right traffic but now I am saving a huge sum over what I was spending on Google ads. My marketing budget is really low, about $2 a day so I am really serious about getting the right traffic instead of junk traffic.</comment></comment>


Show HN: Put TODOs in their place - <AUTHOR> http://imdone.io/

<comment><USER2> I know it's supposed to be a check mark, but your logo is awfully similar to the Steam logo: [http://store.steampowered.com/](http://store.steampowered.com/)</comment>


Automatically "block" people in images using a pretrained neural network - <AUTHOR> https://github.com/minimaxir/person-blocker <comment><USER2> The road to hell is paved with good intentions. And I think software engineers are this century's key perpetrators of "good intentions." Here's a hint: if you saw it in a dystopic thriller you probably don't need to build it, even out of morbid curiosity.

<comment><USER3> You can't stop progress, even if it's negative. Especially something that is relatively easy to make. If nukes were easy to make, we'd all be dead.

<comment><USER4> You can't. But you can choose not to be part of it. I refused politely an interview with google and facebook for the same reason in the past.

The world is what you make of it

People keep saying you can't change the world. That you can't do anything about it.

Well yes you can. Don't be part of it.

Oh yes, there is a price to pay.

</comment></comment></comment><comment><USER5> This would combine well with an in-painting algorithm-- or the video equivalents: [https://research.adobe.com/project/content-aware- fill/](https://research.adobe.com/project/content-aware-fill/) [https://www.youtube.com/watch?v=j3uCV0JYMJ4](https://www.youtube.com/watch?v=j3uCV0JYMJ4)

<comment><USER6> Will someone kindly smash this repo [https://github.com/fivemok/image- inpainting](https://github.com/fivemok/image-inpainting) together with the submission?

<comment><USER7> Or, [https://github.com/DmitryUlyanov/deep-image- prior](https://github.com/DmitryUlyanov/deep-image-prior)

</comment></comment></comment><comment><USER8> Why are we building the technology of a dystopia? What happened to shows like Star Trek which gave us more helpful goals to work toward?

<comment><USER9> The Star Trek whose utopia needed a world war against the ethnic cleansing of genetically engineered Nazi supermen and an alien invasion to "civilize" humanity in the post-apocalyptic aftermath? After which which humankind just _somehow_ evolved beyond the petty desires and violent impulses that had hitherto been baked into its primate genome for millions of years?

I love Star Trek but one person's utopia is another person's dystopia, it's just a matter of perspective.

And as far as technology goes, the original series predicted a couple of things, and we got a Space Shuttle named after the Enterprise, but most of it is magic and therefore useless to the real world. No matter how hard we work or how much we believe in ourselves we're never getting matter replication or transporters or holodecks that will create sentient life on command.

We could look at the _ideals_ of Star Trek, but remember that what we see is quasi-militaristic, autocratic and there is no real sign anywhere of privacy or freedom from the surveillance infrastructure of the computer. Even the transporters keep copies of people's entire genetic code.

<comment><USER10> Depends. In TNG the outlook tends to be far more rosy than in DS9 or DIS. There were a few episodes which hinted at darker tendencies in Starfleet but those usually turned out to be corrupt individuals or some kind of alien influence.

Having grown up with TNG my impression of the Federation was much like what the US was pretending to be prior to 9/11 (i.e. prior to "world police"), a beacon of liberty, equality and hope for mankind, but with all the ills of real-world USA eliminated by scientific progress and a more idealistic and altruistic society.

The show had a few militaristic undertones initially but they mostly went away in season 2 and later, except for the ranks. The ranks and offensive capabilities are lampshaded a number of times but Picard and other characters frequently prove that those are just born out of necessity and for self- defense, never to attack. The Borg represent such a threat exactly because they are not interested in diplomacy and Starfleet has to fight an all-out war to survive them -- unlike the Romulans or Klingons who even at the worst of times mostly didn't outright attack them.

</comment></comment></comment><comment><USER11> "I thought what I'd do was, I'd pretend I was one of those deaf-mutes."

<comment><USER12> Also, that Black Mirror episode.

Edit: Turns out it's exactly what the author intended. Damn.

<comment><USER13> Not exactly "intended", but rather, for want of a better quote, the person you've replied to, chose Ghost In The Shell reference, based on a J.D. Salinger quote.

The " _author_ ", meanwhile, wrote the article we're discussing in this HN thread.

</comment></comment></comment><comment><USER14> This doesn't seem to work for me. I ran "python person_blocker.py -i images/img1.jpg -l" after installing dependencies and I only get:

/home/d33tah/virtualenv-py3/lib/python3.6/site-packages/h5py/__init__.py:36: FutureWarning: Conversion of the second argument of issubdtype from `float` to `np.floating` is deprecated. In future, it will be treated as `np.float64 == np.dtype(float).type`.

      from ._conv import register_converters as _register_converters

Using TensorFlow backend.

2018-03-31 12:53:18.777911: I tensorflow/core/platform/cpu_feature_guard.cc:140] Your CPU supports instructions that this TensorFlow binary was not compiled to use: AVX2 FMA /usr/lib/python3/dist-packages/scipy/misc/pilutil.py:480: FutureWarning: Conversion of the second argument of issubdtype from `int` to `np.signedinteger` is deprecated. In future, it will be treated as `np.int64 == np.dtype(int).type`.

      if issubdtype(ts, int):

/usr/lib/python3/dist-packages/scipy/misc/pilutil.py:483: FutureWarning: Conversion of the second argument of issubdtype from `float` to `np.floating` is deprecated. In future, it will be treated as `np.float64 == np.dtype(float).type`.

      elif issubdtype(type(size), float):

<comment><USER15> Author here: All of these are warnings, they shouldn't block the script. Check the current directory for person_blocked.jpg and person_blocked.gif.

<comment><USER14> Thanks! That helped.

</comment></comment></comment><comment><USER16> What's next, cameras that refuse to take pictures of specific things? I find this unsettlingly creepy.

<comment><USER17> Scanners have been refusing to scan certain things for ages.

<comment><USER18> It's always a "fun" party trick at the office to show people that you can't scan money.

<comment><USER19> In a stallman-esque world, this is just a problem in installing custom firmware in the scanner, right?

</comment></comment></comment></comment><comment><USER20> This reminds me of the character _Laughing Man_ in the anime Ghost in the Shell:

[https://en.m.wikipedia.org/wiki/Ghost_in_the_Shell:_Stand_Al...](https://en.m.wikipedia.org/wiki/Ghost_in_the_Shell:_Stand_Alone_Complex)

</comment><comment><USER21> In some cases the shape is too small and left a few pixels around the person, or it has corners that are too sharp. Is it possible to add an option to enlarge the shape a few pixels?

[Bonus points for another option to make soft shadows near the border of the shape, so it is not so sharp.]

</comment><comment><USER22> We are now a few steps away from Peril Sensitive Sunglasses. [1]

1: [http://www.hhgproject.org/entries/perilsensitivesunglasses.h...](http://www.hhgproject.org/entries/perilsensitivesunglasses.html)

</comment><comment><USER23> What purpose does this serve? I'm genuinely curious what are the applications of this?

<comment><USER24> Imagine wearing AR glasses and blocking out people you find annoying or disagree with.

<comment><USER25> Or animals that frighten you.

</comment></comment></comment><comment><USER26> Prepare your bicycle!!!</comment>


Consent will be required for cookies in Europe - <AUTHOR> http://www.out-law.com//default.aspx?page=10510

<comment><USER2> I'm mostly against top-down regulations like this. They rarely solve the problem and make other problems.

But HTTP cookies are a horrible hack mostly created to by-pass the problems of stateful sessions with a stateless protocol. HTTP needs fixing or perhaps something on top of it. The current state is a disgrace.

It's not OK advertising groups track people's internet use around the world with 1x1 pixels and all those tricks. And never mind the evil Adobe tracking people with Flash, those are even worse and much harder to delete from your computer.

There are just too many poorly implemented web services using ridiculous amounts of large cookies. People run into problems because of the 8KB HTTP header limits in Apache and 16KB in IIS. Also I've worked for a large dotcom using multiple J2EE technologies running out of cookies in IE6/7 (20 max) and losing sales as people couldn't add a check-out/basket cookie.

Programming a cookie-based website preventing session hijacking is quite hard and even major sites had issues. How can you expect people less competents like mom-and-pops shops and banks to be secure?

This problem needs a proper solution from standards and browser vendors.

[http://en.wikipedia.org/wiki/HTTP_cookie#Drawbacks_of_cookie...](http://en.wikipedia.org/wiki/HTTP_cookie#Drawbacks_of_cookies)

</comment><comment><USER3> That's one law I will simply be breaking. If the powers that be want to take me to court for it then yes, please. Let's get it over with.

I also wonder if this law as it is written right now goes for sites hosted in the EU or for sites that are visited by EU citizens (which would have much further reaching consequences).

<comment><USER4> Laws cannot extend beyond physical territory. All sites hosted on European servers have to comply; EU laws do not extend to any sites hosted on foreign servers.

<comment><USER5> This is not true. Example: you have to collect and transfer to EU tax authorities VAT for downloadable goods sold to customers located in the EU if you're not located in EU. If you don't, you can't sell to EU customers. This is ridiculous, but I guess, they can "force" you to block EU users from accessing your website.

I'm not sure how this is actually enforceable, but I think you'll have problems with EU (for example, if you decide to go to Europe for holidays) for not complying with their rules. Which is sad.

<comment><USER3> Do you have any citation for that ? It is completely contrary with what I know of EU tax law.

An EU citizen buying abroad is responsible for paying the VAT (usually to customs), not the merchant, and if it is 'downloadable' then VAT only applies if the merchant is european.

<comment><USER5> The law is active since July 2003. There were a lot of buzz among e-commerce companies and shareware developers about it.

 _The changes eliminate an existing competitive distortion by obliging non-EU suppliers to charge VAT as EU suppliers when they are providing electronic services to EU non taxable persons, something which EU businesses had been actively seeking for some time._

[http://ec.europa.eu/taxation_customs/taxation/vat/traders/e-...](http://ec.europa.eu/taxation_customs/taxation/vat/traders/e-commerce/index_en.htm) (official website)

Article:

<http://www.internetnews.com/ec-news/article.php/2194111>

Also:

<http://www.avangate.com/articles/software-vat-123.htm>

 _Private customers (consumers) in EU countries must be charged VAT for electronically supplied services and products, both by EU and non-EU providers.

...

Non-EU companies that trade with European consumers (private customers) need to register and account for VAT._

</comment></comment></comment></comment></comment><comment><USER6> This is so absurd. I couldn't help but think that this would have made a good Onion article.

</comment><comment><USER7> I'm in European territory. For general purpose and informative sites, like a personal site, this makes no sense.

But, when you're talking about stores, web applications, entire online platforms (including advertising ones), I think you _have_ to ask user permission to do whatever with user's data. I guess this is why EC decided to ask for opt-in.

Many sites, including Google, Facebook, Wikipedia, require registration, and you have to agree with the TOU and Privacy Policy, where usually they place the cookies TOU and policy.

How do they enforce this? I guess browsers with extensions like Firefox (eg. CS lite) would be advantaged. I remember only Chrome and Firefox with extensions and Opera's widgets.

EDIT: (some conspiracy) could this be a move against IE? (ActiveX is discouraged)

</comment><comment><USER8> This looks like Vista UAC meeting the interwebs. Annoying as hell and probably extremely damaging to datacenter operations in the EU.

</comment><comment><USER9> Honest question: Can somebody explain to me why this is a bad thing? Ads can be served without cookies, right? Sure, (behavioural) targeting would break, but is that really a problem?

<comment><USER10> Cookies are by far the most prevalent system for identifying which user made a given web request. This isn't just about advertising. Pretty much every site that supports "logging in" (including HN), and many sites that don't, use cookies to track user sessions.

<comment><USER11> How is that not covered by the following provision to the law?

 _An exception exists where the cookie is "strictly necessary" for the provision of a service "explicitly requested" by the user_

<comment><USER12> Have you ever seen two lawyer argue over what "strictly necessary" means? One would claim that ad serving cookies are always "strictly necessary" to an online business, the other would argue that cookies are never "strictly necessary" because you can replicate most cookie functionality with a "?sessionid=12354" header in a GET request.

<comment><USER13> Indeed "strictly necessary" to achieve what? If it doesn't tell you then that leaves a hole the size of reality in the law through which many truckloads of lawyers salary can pass.

Strange how all those lawyers aiding the writing of the law would miss such a thing ...!?!</comment></comment></comment></comment></comment>


The big problem with one of the most popular assumptions about the poor - <AUTHOR> https://www.washingtonpost.com/news/wonk/wp/2016/06/08/the-problem-with-one-of-the-most-popular-assumptions-about-the-poor/ <comment><USER2> As far as I have understood: Some poor kids don't wait for the second marshmallow because they don't trust the promise they will get the second marshmallow if they wait. They aren't impulsive. They consider carefully the risks and decide it's better to have a marshmallow now, because what if the adult just takes the marshmallow away when he returns? After all this is what they experience every day: non-trustworthy adults.

This is both sad and fascinating. Sad because it's a terrible world for children not to trust people. Fascinating because the conclusion is a lot more deep than I would have expected. Half a year ago I tried this experiment with my three year old son. He waited for the second cookie. Now I realize that I also tested his trust. He was trusting me and therefore willing to wait for the second cookie.

</comment><comment><USER3> A fascinating article. Thank you for posting.

Foolishly, I read some of the comments. It's sad to see so many people use the article as a fulcrum for their pet issue without having read, or at least understood, the article.</comment>


Evolution of the Internet: From Decentralized to Centralized - <AUTHOR> http://blog.onename.com/evolution-of-the-internet/

<comment><USER2> > Recent advancements in Bitcoin/Blockchain have the potential to take us back > to the promised land of a truly decentralized, free, and open Internet.

I keep hearing this, but really, how? The only useful thing on this front to fall out of the blockchain is Namecoin and, despite being a really good idea, nobody knows how to stop name hoarding. There will also never be a mechanism for name dispute resolution... and who wants to register a name that could cost $5 this year and $1000 to renew next?

Bitcoin itself has and likely will continue to trend toward centralization because of the tendency for people want want lightweight clients and instant transactions. Services like Bitpay already consolidate merchant interaction, and too many people already accept the Gmailification of wallets by holding web wallets. This is probably for the best because people can't be trusted to guard their own keys. It's also debatable whether total blockchain decentralization is a good thing, given that currently the hash power is all held by a bunch of very dodgy unknown Chinese ASIC mining shops instead of a bunch of very dodgy but well-known multinational banks.

</comment><comment><USER3> > The promise of centralized services boils down to choosing convenience over > decentralization.

The issue with the entire post is that you can have both. I can use Facebook messaging to talk to my family while using IRC to answer questions about Java or talk to strangers about video games. They are not mutually exclusive. Just because there are these centralized, mega-services does not mean that the decentralized ones stop existing.

<comment><USER4> > They are not mutually exclusive

Diminishing the active population of a service may result in less software development targeting it - resulting in a death spiral to the profit of the centralized services who reached critical mass.

Even when the open protocol becomes dominant through network effect, when a major service provider attracts a significant population fraction he can fork into a centralized proprietary direction : see for example how Google used XMPP to strengthen its initial Google Talk user base and then cut them off from the rest of the XMPP world... Embrace, extend, extinguish.

I'm still using IRC - but it is an IT ghetto. I'm still using XMPP - but only with technophile friends, my family or other people to whom I am a prescriptor. This decline may be caused by chat no longer being considered a standalone functionality but an adjunct to web applications that implement a social network...

</comment></comment><comment><USER5> Some of the things need to be centralized to work. The post mentioned GMail spam filtering - it's hard to make a good filter without the level of data Google has. Cloudflare's ability to protect you from threats is another great example - by centralizing traffic of so many web services under one command, they can notice the threat against one and immediately set up defenses for everyone.

Another benefit of centralization is efficiency - when everything is distributed, everyone does all the same work over and over again, which could be done just once.

The question is, how can we keep centralized just the things that (users of them) really benefit from it, and let the rest be decentralized?

<comment><USER6> > Buttflare's....

Ummm what?

<comment><USER5> Sorry. A weird mishap with Cloud-to-Butt extension I use. Fixed now.</comment></comment></comment>


Ask HN: Can Larry Ellison Become the CEO of Tesla? - sahin-boydas <comment><AUTHOR> In his copious spare time?</comment>


Top (Effective) Software Resume Templates and Samples for 2020 - <AUTHOR> https://myresumeseed.com/blogs/resume-templates/software-engineer-resume-templates-samples-and-examples <comment><USER2> A lot better than the shitty Word docs that Microsoft provides. Thx @op</comment>


How to avoid start-up success?  Not offering equity! - <AUTHOR>

<comment><AUTHOR> How many start-ups sabotage their chances by being too stingy when it comes to equity?

I thought I'd save everyone the trouble of going to a blog by ranting here directly.

A while back I was interviewing at a small company that really needed another developer or three. They wanted to hire and made an offer -- a 20k pay cut, _but_ they were going to give me equity -- the magic word! Except the president/founder of the company wanted to keep 99%+ of the equity for himself, so anyone else let in on the deal had to share a fraction of the remaining 1%. I calculated that if the company was successful to the tune of $10 million, my share would still be worth less than my initial pay cut. I pointed this out to the senior developer who was trying to convince me to join, but his blind loyalty to the company seemed to preclude arithmetic.

Prior to that I worked at another smallish company where the president/owner kept around 95% of the stock. A few top people got 1% or less. Other companies say they want to hire "top talent", but they pay "market rates" -- which usually means the average according to some salary survey, or less, and no equity.

It seems like some founders are so attached to ownership that they can't part with it, even if it means greater success for themselves! It's like they have visions of dollars from owning the entire company instead of a vision of what's needed to get there. While a fraction of a percent of Google is worth a lot now, in order to get to that point, the founders had to part with the majority of the equity.

Some start-ups work with two founders, but some have half a dozen (like Excite) or more. Even reddit got more "founders" after the fact. If it turns out you need a new band member, are you prepared to redo the original founders' percentages, or do you have other plans?

<comment><USER2> I think its a dangerous generalization. I feel its more about knowing the market rate for your employees and making sure they are compensated for what they contribute. Equity is only one piece.

In your example, it sounds like a pretty weak deal. However, thats not to say that the lesson to learn is to attract employees through equity.

Owning equity is about risk. Employment is about security. If your really a savvy investor and think that equity in a given company is the best return on your investment, you should offer to put as much cash and man-hours into the company as you can for the greatest return. Then you are on par with the founders.

For interesting reading, look at Warren Buffett's philosophy on employee and management stock options. In earlier days he attracted key management with a fair salary, a good work environment, and an absolute lock out of equity.. he figured he was the only one taking the risk.

<comment><AUTHOR> > look at Warren Buffett's philosophy on employee and management stock > options. In earlier days he attracted key management with a fair salary

Today's environment is much, _much_ different. ALL key manangement will require equity.

That example is kind of like saying Apple attracted people with a 1 MHz 6502 system. Different time, different standards.

<comment><USER2> I'd agree, environment is different. Risk of being on a management team is different. As is the culture of compensation and employee marketplace.

What has not changed is that company ownership is about investment risk.

</comment></comment></comment></comment><comment><USER3> I actually agree with this.

I'm a 35 year-old entrepreneur and enjoy following the YCombinator stuff. Like clockwork, when I mention the idea of YCombinator to other elder entrepreneurs like myself, they say, "Pish Posh. $5k per founder for 5% of equity?!"

The reality is that you have a pretty low chance of success. If you can eek out a few more percentage points by giving away a small slice of your company, it's worth it. Whether it's to YCombinator or a key employee.

And, I'd also point out this-- Willingness to give away equity for increased chance at success shows that you are committed to the idea of business success (rather than the idea of personal wealth).

<comment><USER4> I'm puzzled by the reaction of "$5k per founder for 5% of equity?!"

I've been eagerly reading about YCombinator and it seems to me that they are offering a great deal more than money. It appears that the value of their consultation, connections and the other founders you end up spending time with are probably worth _far_ more than the 20k-ish they invest in your company.

I can't imagine not taking their deal if I had an appropriate startup. 5% of equity in something that is currently completely speculative in return for what appear to be world class consulting and networking services? If they maintain their current success rate, I think it's safe to say that far from being expensive, YC is spectacularly cheap and leaves a lot of money on the table. Which is probably why they are getting 1400 applications for 10 slots.

<comment><AUTHOR> IIRC this time they had about 500 applications and no fixed number of slots. In a previous round they had 30 interviewees and I think 13 were picked...</comment></comment></comment>


Ask HN: Examples of well-written JavaScript/TypeScript applications? - <AUTHOR> Any examples of well-structured jest/mocha/<insert test framework> projects? Any typescript code base you would read to enhance your testing skills?<p>For instance, vscode: https://github.com/microsoft/vscode <comment><USER2> Office Fabric React has some good React + TypeScript code that has good testing which is very necessary with the level of commit activity into a shared component library.

[https://github.com/OfficeDev/office-ui-fabric- react](https://github.com/OfficeDev/office-ui-fabric-react)</comment>


Gow - A lightweight alternative to Cygwin - <AUTHOR> https://github.com/bmatzelle/gow <comment><USER2> Related: If you find yourself in a Windows terminal a lot, check out Cmder ([http://gooseberrycreative.com/cmder/](http://gooseberrycreative.com/cmder/)). It's the only thing keeping me sane when using a Windows console.

Cmder is a little slow by default, but faster if you disable the git branch in the prompt. Other people I know use Clink ([http://mridgers.github.io/clink/](http://mridgers.github.io/clink/)), the library the powers the readline-like portion of Cmder.

<comment><USER3> Why not mention ConEmu, the best solution? [https://code.google.com/p/conemu- maximus5/](https://code.google.com/p/conemu-maximus5/)

<comment><USER4> Because that's a very subjective answer. I've had a lot of issues with ComEmu. On several occasions, (I'm speculating that it's been after updates) it seems to completely forget all of my settings, and revert to defaults. It happened several times when I didn't have the time to track down the problem, so I've stopped using it.

<comment><USER5> Cmder is just a shortcut to using ConEmu. It literally is ConEmu with a different set of default settings and some extras preinstalled.

</comment></comment></comment></comment><comment><USER6> Is there an overview article about the different unix emulators on Windows and how they differ in terms of what they provide, and how they are supposed to be used?

Between MSYS, MINGW, Cygwin, Cmder, Clink, Babun, etc. I am just wildly confused in general. I've used linux, I've used windows. Admittedly I am blessed enough to stick with Python but I know that even Anaconda does some msys magic behind the scenes on windows as well.

<comment><USER7> They all have something wrong with them. Grep is broken(so old there is no recursive option, or there is one but doesnt work) at least in MSYS, MINGW and Cygwin.

<comment><USER8> Not a direct answer, but I use the Windows port of The Silver Searcher (ag) and it works well: [http://blog.kowalczyk.info/software/the-silver-searcher- for-...](http://blog.kowalczyk.info/software/the-silver-searcher-for- windows.html)

<comment><USER9> Windows has this built in, it's called findstr, probably some gaps in the feature set compared to ag but it's quite capable.

</comment></comment></comment></comment><comment><USER10> This won't be to everyone's taste but if you value 'lightweight' over 'feature-complete' busybox-w32 [1] may be worth a look. It's a port of BusyBox to WIN32, with random code borrowed from GNUlib for stuff that Microsoft omitted.

I maintain the most active fork and got into using it when I ported my last employer's software to Windows. This was originally developed in the early 1990s to run on Unix workstations. For portability it used Bourne shell (not bash) and nawk (not gawk). BusyBox allowed them to bundle a single executable with the Windows version that was adequate to run those scripts.

Some projects use busybox-w32 to allow a Unix-centric build system to work on Windows. Julia, for example, seems to use it just to get echo and printf.

[1] [https://github.com/rmyorston/busybox-w32](https://github.com/rmyorston/busybox-w32)

</comment><comment><USER11> If Microsoft added these utilities to Windows and included a decent shell it would go a long way to getting developer mind share back from Apple.

<comment><USER12> FYI: these tools install with GitExtensions for windows, and that includes a bash shell.

I use it with ConEmu, and it goes a long way towards usability. I also use Clover as a file explorer wrapper/replacement. I usually have a couple browsers, editors/ide, clover and conemu open at all times.. tabbed interfaces are beyond useful.

As is having a bash shell (although some things aren't quite the same).

</comment></comment><comment><USER13> Lol... Bunch of .exe files checked into Github. Seems legit

</comment><comment><USER14> Why put the executable in source control without the actual source text files?

<comment><USER15> Or why put output binaries to source control at all? Who is going to ever clone that? Github has "releases" feature for that which the project seems to be using too ([https://github.com/bmatzelle/gow/releases](https://github.com/bmatzelle/gow/releases))

<comment><USER14> You've expanded my point, which made me reflect on how I communicate. In my mind I did mean what you said, "binaries to source control at _all_"

</comment></comment></comment><comment><USER16> I really like the idea of gow but it's _horribly_ unmaintained. Check the issue list length. You're probably better off installing Git with the "add gnu utilities to PATH" option ticked.

<comment><USER17> Yes. wget 1.11? It's not even funny. I understand author took last GnuWin32 release, but amount of changes in wget related to many things (including adequate https support) since 2008 is too big.

Moreover, using cross-platform Unicode-aware tools in (still not really Unicode-aware) cmd.exe will blow up sooner than later on "funny" filenames. As others said, you need proper shell and terminal.

<comment><USER14> Honestly, I'd recommend anyone to just install native GNU/Linux operating system. Getting the awesome, absolutely amazing coretuils to work on Windows seems like swimming upstream.

<comment><USER18> Windows is pretty ok for my gaming box. Nice to also be able to sling some code with it.

</comment></comment></comment></comment><comment><USER19> Am I blind or are there no sources for the binaries?

<comment><AUTHOR> Looks like the maintainer provides the sources in the release section:

[https://github.com/bmatzelle/gow/releases](https://github.com/bmatzelle/gow/releases)

<comment><USER20> Most of the sources and binaries are from 2012. That version of bash would have the shellshock bug(s).

This project is a Good Idea, but it would be overwhelmingly more useful if it tracked modern versions.

</comment></comment></comment><comment><USER21> Channeling my inner stallman. This looks like a lot of GNU utilities for windows, just like the name says. But the title says Linux utilities.

<comment><AUTHOR> My first post. I wanted to put something up that would spur interesting discussion. I'll be sure to look closer at how I name a submission.

</comment></comment><comment><USER22> Can someone familiar with `UnxUtils` evaluate this and determine the difference?

Both are out of date and distributed as binaries... What else? :)

Seriously though, if you fork the project and dump the tarballs into a branch, I'll check it out and run make. Or, I'll write a script that runs a bunch of individual makes. Whatever.

I like `UnxUtils` (and Gow) but this practice is not sustainable..

<comment><USER23> UnxUtils hasn't been maintained for a dozen years. There is also GnuWin32 which has only been dead for five years.

GoW is pretty much the same thing but not abandoned yet. Some things are definitely out of date, I end up pulling curl from elsewhere, but it provides most of the important things and they Just Work. Beats the hell out of using Cygwin.

</comment></comment><comment><USER24> msys2 is also a good alternative to Cygwin with slightly more up to date packages than Gow.

<comment><USER25> Msys2 doesn't emulate file permissions, at least not since I checked last. Cygwin does. This saves a lot of hassles when working with version control.

</comment></comment><comment><USER9>
        > * Shell window from any directory: Adds a Windows Explorer shell
        >   window so that you can right-click on any directory and open a
        >   command (cmd.exe) window from that directory.
        > * Simple install/remove: Easy to install and remove, all files
        >   contained in a single directory in a standard C:\Program Files path.
        > * Included in PATH: All binaries are conveniently installed into the Windows
        >   PATH so they are accessible from a command-line window.

These three bullets seem contradictory, how can it modify explorer context menu and PATH by just adding files in a Program Files directory. Besides, the first bullet is already built into windows explorer without any add-ons, just hold shift while right-clicking and the option will appear.

</comment><comment><USER26> @statico cmder is definitely a great thing for windows, however it's fault buggy due to way it operates.

Overall the best long term option is to simply stop developing on windows and start using Linux, docker, mono, nodejs etc.

I did this 10 years ago, and the situation on windows still hasn't improved.

<comment><USER27> What do you mean "due to way it operates?" Can you explain?

Also, how does node have anything to do with this discussion?

</comment></comment><comment><USER28> earlier thread:

[https://news.ycombinator.com/item?id=8577359](https://news.ycombinator.com/item?id=8577359)

</comment><comment><USER29> > Shell window from any directory: Adds a Windows Explorer shell window so > that you can right-click on any directory and open a command (cmd.exe) > window from that directory.

That's one of the reasons why I keep virtualbox around on my Windows box. I don't want any integration with the shell, I want applications to be self- contained and not spam on Windows as much as possible.

</comment><comment><USER30> Along sort of similar lines, StExBar adds a few nice features to explorer:

[http://stefanstools.sourceforge.net/StExBar.html](http://stefanstools.sourceforge.net/StExBar.html)

The regex rename for multiple files is quite nice.

</comment><comment><USER31> > It is designed to be as small as possible, about 10 MB, as opposed to Cygwin > which _can_ run well over 100 MB depending upon options.

What's the size of a new cygwin install? Well it _can_ be larger than 100MB, sure. It has lots of packages.

</comment><comment><USER32> I personnally use mingw if I need to compile something to C or C++ for windows , and for any serious work , Vagrant and Linux. Cygwin an likes are just horrible and I just don't see the point of these today.

<comment><USER14> Nit pick, but, I think it's safe to say you don't compile anything to "C" or "C++", when you're using mingw, you're compiling a "C" or "C++" program to assembly.

<comment><USER33> Nit pick, but plenty of things compile to C / C++.

[https://stackoverflow.com/questions/6498850/programming- lang...](https://stackoverflow.com/questions/6498850/programming-languages- that-compile-into-c-c-source)

<comment><USER14> Sure, I agree. But, I believe the parent comment believed she was compiling to C/C++ from C/C++

<comment><USER33> Hmmm, the other grammar and spelling errors made me think that "to" was also just a mistake.

</comment></comment></comment></comment></comment><comment><USER34> Yeah, like most other people on here...color me unimpressed.

libmingw if you want lightweight, msys if you want an env + mingw, cygwin if you want something with a nicer unix env.

No matter what env you have, if its on win it going to suck a bit.

</comment><comment><USER35> The terminal is one of the most painful things about Windows. Every time I give Windows a try (I'm a Linux user) I end up getting sick because of the terminal. The tooling in Windows is in general good.

</comment><comment><USER36> How's this different from MSYS(2)?

</comment><comment><USER37> What are the advantages in relation to Cygwin?

</comment><comment><USER38> The testimonials remind me of infomercials that exaggerate people's struggles to do everyday tasks like cracking eggs or retrieving items from shelves.

Who frets about 100MB on their hard drive in 2015, and why wouldn't these mythical users just install only the cygwin packages they need?</comment>


HIPAA 101 for Software Development Teams - <AUTHOR> https://www.aptible.com/blog/common_HIPAA_questions.html <comment><USER2> What I've learned over the last few years:

1) The requirements are theoretically tractable by an SMB but only just.

2) Non-compliance is ridiculously widespread. Ridiculously. This is partly because HIPAA prohibits people from doing things they really want to do (emailing about a patient, perhaps to that patient) and partially because the requirements are so vague.

3) Be prepared to use HIPAA as a pricing segmentation engine and for your providers to use it on you. Getting a BAA with Rackspace, for example, quintupled our costs.

4) Get insured. Because literally everyone is exposed to this and investigations are infrequent, the industry treats them like acts of God. You can insure, minimally, the cost of responding to an investigation (though my policy doesn't cover any fines assessed) and breach notification.

<comment><USER3> _This is partly because HIPAA prohibits people from doing things they really want to do (emailing about a patient, perhaps to that patient) and partially because the requirements are so vague_

My healthcare provider solves this by having a health portal that I log in to to send/receive messages to my doctor and view test results.

It's all SSL encrypted and protected with my individual password, which is more than they can guarantee with plain email. When I have a new message in the message center, they send me an email to tell me to log in.

I should hope that any healthcare provider that wants to share PHI with a patient does the same rather than using email, where they have no assurance that the email is encrypted, stored securely, or protected by a strong password.

<comment><USER2> This is a great example of a HIPAA poser, because that system: still a violation if one treats the regulations as actually meaning what they say. The "We have a message for you" disclosed a doctor-patient relationship (protected health information) about an email address (personally identifiable).

It's unlikely they'll receive a complaint/investigation for installing that software.

<comment><USER3> I fail to see how the email discloses anything protected, since it's completely generic:

        Dear member,

        You have a new message from *Redacted Healthcare System*

        Please click on the link below, or copy and paste the link into your browser.

So from the email it's impossible to tell if it's even a message for me, or someone else in my household that I'm authorized to receive healthcare information for. And it hardly seems any more revealing than the weekly "wellness emails" that every healthcare system seems to send to its members.

HHS specifically allows a provider to use email:

 _The Privacy Rule allows covered health care providers to communicate electronically, such as through e-mail, with their patients, provided they apply reasonable safeguards when doing so. See 45 C.F.R. § 164.530(c)._

[http://www.hhs.gov/hipaa/for-professionals/faq/570/does- hipa...](http://www.hhs.gov/hipaa/for-professionals/faq/570/does-hipaa-permit- health-care-providers-to-use-email-to-discuss-health-issues-with- patients/index.html)

<comment><USER4> Exactly. He's calling himself a poser with a claim like that. The use of protected portals with generic notifications is both allowed and widespread in use. Almost every provider I've run into does a variation of this. There's even turn-key solutions in this and other regulated markets. Incidentally, it was also the solution secure email providers came up with for when people don't have your encryption software but do have regular email & HTTPS-enabled browsers.

I'll go further to say it's probably one of the best models a company can use since vast majority of INFOSEC research and product development goes into exactly that sort of construction and tech. Even high assurance sector has solutions for some of that. Plus it has high usability and compatibility. Win across the board.

</comment></comment></comment></comment></comment><comment><USER5> From the team at TrueVault, a GitHub repo with a developer's guide to HIPAA compliance. Similar to Aptible, they pitch themselves within the guide but still a good resource:

[https://github.com/truevault/hipaa-compliance-developers- gui...](https://github.com/truevault/hipaa-compliance-developers-guide)

<comment><USER6> The guide is pretty good and definitely helped me get up to speed with HIPAA. The product, not so much. They had _10 days_ of downtime around Thanksgiving. Not a happy holiday for my team.

<comment><USER7> @servercobra is correct.

Our Search API (all other services unaffected) experienced an extended outage last Thanksgiving affecting ~9.2% of our customers. This is the full incident report: [https://drive.google.com/file/d/0B-CT1SxLwR31X293VXFCSll3Z1E...](https://drive.google.com/file/d/0B-CT1SxLwR31X293VXFCSll3Z1E/view?usp=sharing)

<comment><USER8> Nice report, sounds like a nightmare scenario. You seem to take care to don't mention any names of the used technologies/vendors even though the report specifically says they have admitted to misleading you. Is this because you have reached some kind of settlement with them?

</comment></comment></comment></comment><comment><USER3> _Is it reasonable and appropriate not to encrypt traffic between an app and a database inside a virtual private cloud? ... There is little official guidance for engineers and developers today_

While HHS may not tell you what to do on your own private cloud, if you host on a public cloud, you'll have to sign a BAA where the provider will tell you what you need to do to ensure HIPAA compliance of their platform. AWS, for example, requires encryption everywhere -- end-to-end encryption from the client to your servers, encrypting all PHI data sent between your servers (web, app, db servers, etc), and encrypting all data at rest.

[https://aws.amazon.com/compliance/shared-responsibility- mode...](https://aws.amazon.com/compliance/shared-responsibility-model/)

If public cloud providers require encryption everywhere, I'd sure hate to have to explain in a HIPAA audit why I thought it was not "reasonable and appropriate" to do the same thing in my own datacenter after investigation for a breach that used a network sniffer between my servers.

We had one application that did not support encryption natively, everything was sent in the clear, so we ended up setting up a point-to-point VPN between those servers to encrypt data in transit. Otherwise, AWS wouldn't have signed off on the BAA if we could not assure them that all PHI was encrypted.

<comment><USER4> "We had one application that did not support encryption natively, everything was sent in the clear, so we ended up setting up a point-to-point VPN between those servers to encrypt data in transit. "

That's basically the hack I used for situations like that, too. I have considered modifying something like tcpcrypt w/ authentication with hooks that force the application to use that. Not entirely sure it's a good idea but might help on legacy stuff. Put the keys and whitelists in there manually. Optionally put it and TCB in a TCP/IP offload card that also provides a performance boost as further justification. What you think?

</comment></comment><comment><USER9> Does anyone have experience with HIPAA who is not based in the US?

It can obviously be useful as a sales avenue to US based customers, but I'm wondering what channels you need to go through if you are not a US based company.

<comment><AUTHOR> We have several non-US customers. What do you mean by "channels you need to go through"?

Generally, if you can meet the requirements, you can handle patient data for US customers. HIPAA doesn't have any sovereignty requirements (geographic restrictions on where the data are stored/transmitted), although it's fairly common to see them introduced in contracts or BAAs.

<comment><USER9> I had assumed that you would need to register to claim to be HIPAA compliant, but that doesn't actually appear to be the case. It looks that if you claim it, you can be audited by Dept of Health and Human Services (HHS). I wonder how that works internationally?

<comment><AUTHOR> Exactly, there is no official registration or certification for HIPAA. It's more that HHS will take an interest if you come to their attention and appear to be creating/receiving/transmitting/maintaining regulated patient data.

There are a few ways to come to HHS's formal attention:

1) A complaint; 2) Via another enforcement action, usually against one of your business partners; or 3) An audit

Phase 2 of the HIPAA audit program is starting this year. The first step is a questionnaire that asks you to confirm if you are a business associate. HHS is also asking that each entity they contact provide a list of their business associates.

All of the above is true even if you are based internationally. Most of the Phase 2 audits are desk audits, meaning HHS will ask auditees to submit documents and other data. I'm not sure how an onsite audit would work for an international entity.

<comment><USER10> Do US companies need to be HIPAA compliant if working exclusively with international companies ("covered entities" if they were located in the US)?

<comment><AUTHOR> Focusing on the data help clarify this. This is a negligently simple explanation, but: HIPAA regulates identifiable patient data that touches a US- regulated insurance transaction somewhere in its lifecycle.

If you're in the US, but working with only international healthcare providers and international patients, HIPAA is less likely to apply. You may have other privacy laws and regulations to deal with, however, especially in Europe.

</comment></comment></comment></comment></comment></comment><comment><USER11> This was a good read. It's something that I can point people to, since even as a health care provider (firefighter/paramedic) we frequently run into other levels of provider that are clueless about HIPAA and use it as an excuse to not provide information that we need. (in other words, they're being lazy, and claiming "that's a HIPAA violation" is way easier for them.)

It's amazing just how misunderstood HIPAA has become.

</comment><comment><USER12> Not subject to HIPAA as in the UK but something I'm working on stores medical data, this looks interesting though.

I wish the UK had something so concise.

<comment><USER13> Yes. As someone who's worked in the healthcare industry in both Australia and the US I actually miss HIPAA in Australia. While it was a huge PITA, the majority of what it specifies is actually common sense and good security / privacy practises. The explicit nature of the guidelines and the force of law sitting behind them is very empowering to engineers who want to implement these practices but struggle to convince senior management that they are important otherwise.

</comment></comment><comment><USER14> Full disclosure: I'm an engineer at Catalyze Inc, a direct competitor of Aptible's.

That being said working with payers and providers you are obviously going to want to learn the ins and outs of HIPAA. However increasingly providers, and by proxy, payers are requiring that their vendors be HITRUST certified. It is worth realizing that being HIPAA compliant will not be enough for a lot of the big players. Just something to be aware of!

FYI, my company's platform is HITRUST certified, beyond the simple self-study, which, again, is often not enough for the big players in health care.

<comment><USER15> Educating the startup community on the complexities and necessity of HIPAA is important. I'm glad Aptible is helping the YC community.

To tack on to my colleague at Catalyze: We provide two thorough guides to both HIPAA and HITRUST. If anyone is looking for a deep dive on either topic, you can access the guides here:

[https://catalyze.io/hipaa-compliance](https://catalyze.io/hipaa-compliance)

[https://catalyze.io/hitrust](https://catalyze.io/hitrust)

The guides are a thorough summary and aggregation of all our content spread throughout the web, which is why they are behind a form. If you would like to access all the content directly, it's largely all available for free as separate entries in our Academy:

[https://catalyze.io/learn](https://catalyze.io/learn)

<comment><USER16> Thanks for these guides.

You may want to re-word what you say about patient rights in [https://catalyze.io/assets/media/HIPAA-Compliance- Guide.pdf](https://catalyze.io/assets/media/HIPAA-Compliance-Guide.pdf) \-- you say that HIPAA "gives individuals ownership of their health records", but I don't think that's quite right. The Office for Civil Rights has a good overview on patient rights at [http://www.hhs.gov/hipaa/for- individuals/medical-records/ind...](http://www.hhs.gov/hipaa/for- individuals/medical-records/index.html) and when it comes to the right to access, there's an excellent in-depth overview at [http://www.hhs.gov/hipaa/for- professionals/privacy/guidance/...](http://www.hhs.gov/hipaa/for- professionals/privacy/guidance/access/) .

(Note: it would be nice if you made your PDFs searchable; currently they're images, which makes it hard to find and cite relevant content.)

EDIT: for an in-depth treatment of the "ownership" issue (in its nuanced glory) see [http://www.healthinfolaw.org/comparative-analysis/who- owns-m...](http://www.healthinfolaw.org/comparative-analysis/who-owns-medical- records-50-state-comparison)

<comment><USER15> Thanks a bunch for the feedback, Josh! Forwarding right now to our Privacy Officer.

</comment></comment></comment></comment><comment><USER17> I have a place in my heart for concatenative languages. When I was a junior engineer in 1970 working on the first sealed hard disk, I used forth to build test routines for the disk. I started with transferring bytes, to seeking, up to reading any block. It went fast and was very flexible.

<comment><USER18> Looks like you meant to post that to another thread; possibly [https://news.ycombinator.com/item?id=11377847](https://news.ycombinator.com/item?id=11377847)?

<comment><USER17> Yup. How did that happen? I'll have to be more careful. Oh well, a bunch of downvotes won't kill me.

</comment></comment></comment><comment><USER19> Asking HN commenters: Regarding HIPAA requirements, how do you get protected from malicious software on Macs?

<comment><USER2> Document something akin to the following:

 _164.308(a)(5)(ii)(B): We have policies for guarding against, detecting, and reporting malicious software. Specifically, we require our workforce to use Macs or Linux machines, and we exclusively host our applications on Linux machines, as industry consensus is that these machines are less vulnerable to infection by viruses than Windows machines. We will revisit this policy annually and revise if we determine that the risk of infection of a Mac or Linux machine is greater than Very Low. Our present assessment is Very Low. See also $POINTER, where we discuss securing the applications we host. Accordingly, our risk analysis recommends against spending engineering resources on this threat. Note that this subsection is Addressable, not Required, so we believe that this is sufficient for this subsection._

Welcome to HIPAA! You can do _almost anything_ as long as you document the heck out of it.

<comment><USER4> "Welcome to HIPAA! You can do almost anything as long as you document the heck out of it."

There's already lists of code smells where you know the code might be shit if you see things on the list. I propose regulation or certification smells for things like above. Your process has it? Then it's not going to make things better for real.</comment></comment></comment>


Ask HN: Beta swap? - <AUTHOR>

I'm beta testing a new web stats product and am looking for sites that have just launched or are about to launch. Would you like to swap beta testing? I'd be happy to try your new product and give you feedback if you are willing to do the same. Calling my product 'beta' is actually a stretch, probably more like 'alpha', but I'm ready to get some external feedback.<p>If you haven't launched anything lately and still want to help, I'd love to hear your ideas on finding new (or about to launch) startups. I'm looking in some obvious places like Ask/Show HN, producthunt, betalist, etc. but would love to hear more ideas! <comment><USER2> Hey guys, I want to keep this thread going. This concept jump-started my noggin and wanted to gen-up a quick concept. The mockup has not been made responsive yet as I do not have the resources where I am currently.

Thoughts? [http://codepen.io/matthewjamesr/full/LERpOB/](http://codepen.io/matthewjamesr/full/LERpOB/)

<comment><USER2> If you like my contribs, please up-vote, I need some of that so-sweet karma.

</comment></comment><comment><USER3> Tangent: This sounds like an awesome product idea actually. Like BetaList, but more reciprocal. People leave feedback for you in exchange for feedback for them. Somebody build this please. :)

<comment><USER2> This sounds like an amazing idea to me as well. I have half a mind to make this. Maybe a simple version at first with HN type style then progress to talent matching and more. Thoughts?</comment></comment>


YC wants to let people invest in its startups through the blockchain - <AUTHOR> https://techcrunch.com/2017/09/20/yc-wants-to-let-people-invest-in-its-startups-through-the-blockchain/ <comment><USER4> > "Do I think ICOs are silly, bordering on scams? Yes, they are," he > continued. "But, there are a few that are important, and the blockchain is > more important than not… ICOs need to be regulated."

> At the same time, it could mean working, for the first time, with investors > who are not "accredited," meaning high-net-worth investors — an idea that > appeals to Altman.

I guess he sees blockchains as a vehicle to getting the regulatory framework he wants for securities, and (I assume) doesn't feel he can get for traditional stock.

> Added Altman of the appeal of ICOs in particular, "People are watching their > friends get really rich and it's making them [frustrated and wanting to get > rich, too]."

> "One of the trends that bothers me about Silicon Valley," he continued, is > that "more and more of the wealth creation here is not available to most > people, and I think that's very bad in a society with already so much wealth > inequality. If there's a way that new technology can make it practical and > possible to democratize this, I think that'd be great."

I mean, he _just_ said he recognizes it's a bubble. Doesn't a bubble usually suggest wealth transfer instead of creation? Of course it's frustrating to not get in on that money. It's even _more_ frustrating when you see the situation as ethically gray, and here's Sam signaling that YC should jump on board.

<comment><USER4> I guess I'd ask this question:

Is it ethical to want to bring in unaccredited investors to a market that's known for being scammy and overhyped?

<comment><USER5> It doesn't bother the government when the middle class spend its hard earned money in gambling, sport events or entertainment. Somehow, there's suddenly a moral imperative to protect those poor sheep from doing as they please with their property. But, wait, only if their capital inflow will dilute the returns of established investors.

It's to protect the middle class of course, though one can only wonder why the blatant double standard. I have no idea!

The "accredited investor" regulations are a sham, an unfair and artificial barrier to entry that ought to be removed. Yes, some people will get abused. This might even create local instability. But, that is clearly the long-term optima. Those who lose money to scams can leave it to law enforcement to do their job. Others who invest more they can afford to lose into bad apples will learn that you should always hedge risk. As a whole, society gets smarter when it is allowed to make mistakes, even costly ones. Smarter and less fragile.

<comment><USER6> > It doesn't bother the government when the middle class spend its hard earned > money in gambling

Isn't gambling heavily regulated in the US to the point of being barely legal in many states? Isn't that basically how many Indian tribes make money - <USER2> being outside this regulation?

<comment><USER7> Running a casino is heavily regulated. Gambling at a casino is open to anyone over 21 where its legal. That was the OP's point.

<comment><USER8> Yes, and everyone entering casino is _aware that it is gambling_.

ICOs, on the other hand, is like entering a street shell game. Something non- regulated, where you are sure to get skinned.

</comment></comment></comment></comment></comment></comment><comment><USER9> Every headline from Techcrunch disrupt that I have seen has been directly contradicted in some way in the video. For example, Vitalik Buterin spends about 10% of his talk explaining why not everything will be or should be decentralized. The title of his video? "Decentralize Everything with Vitalik Buterin"

<comment><USER10> This is called clickbait and is why Techcrunch is a trash website.

<comment><USER11> I understand the aversion to clickbait, but using clickbait doesn't make writers trash. Some of my favorite creators use the most shameless over the top clickbait you can imagine.

That is what smart people do - they do things that work.

Why on earth would you decrease your success by 20-30%(I'm guessing) by using less appealing headlines?

Clickbait doesn't devalue the articles. It only presents problems for websites like HN, but here it is already moderated.

<comment><USER12> > Why on earth would you decrease your success by 20-30%(I'm guessing) by > using less appealing headlines?

Because you respect yourself and your audience enough to be honest, even when dishonesty could attract more eyeballs to advertisements?

<comment><USER11> In my opinion, honesty and artistic integrity comes down to article/video delivering the promised value/entertainment.

The purpose of a headline is to get more people to click so that they receive the value you've created. If your headline is a little less compelling - <USER3> people will receive the value, the world will be a little worse off. So if you believe in your ideas, and care about expressing them - you do whatever it takes to convey them successfully. Utilitarian ethics.

You know you are competing with a huge amount of clickbaity entertainment, so if the things you create are high quality, it makes sense to do things that won't predictably cause you to lose.

I understand your point of view and why you'd find this distasteful, and, personally, I don't use as much clickbait as I probably should. But my opinion on this stuff has shifted over time, so I just want to express it.

</comment></comment></comment></comment></comment><comment><USER13> It feels like there are two different moving parts here. First, should YC open up to a new class of investors? That's just a business decision for YC: either it suits their plans or it doesn't.

The second question is _how_ they open up their business to new investors. It's a little tricky to raise money from retail investors, so I wonder whether this talk of an ICO is designed to skirt regulation. I know I sound very un- hip when I say this, but that regulation is there for a reason. The vast majority of investors don't have the background or knowledge to assess the risk of alternative investments.

It's not impossible for YC to market to retail investors, just more difficult. They should either raise money in the conventional way or not at all.

</comment><comment><USER14> I can see why startups raising money benefit from an increase in the numberof potential investors and capital. But apart from this, is there a good reason to want to _" democratize access to investing,"_ and open the field to non- accredited investors?

I share the instinctive response to a rule where " _only rich people can X_ " but (1) Are startups such a great investment that unaccredited shlubs are substantially disadvantaged by excluion? (2) Do they have enough (risk tolerant) money to make a difference? (3) Will companies financed these ways be better in some way.

If we assume the bigger fraud-ish problems get solved, what is the big upside?

I can vaguely see an argument for something between kickstarter/patreon & NASDAQ enabling new kinds of things, but is there really something here. To put it more generally, why should people other than Sam Altman agree with him?

<comment><USER15> I'd say the biggest problem is "fraud". Once you make it accessible for the average person to invest and the sophisticated fraudster to advertise and raise money, what you get is ... ICOs.

IPOs do have fraud but at least it is controlled a lot. To raise capital you need to be a specific person/company and you have a set of responsibility toward your investors.

For ICOs? Not really.

</comment></comment><comment><USER16> I bought some Bitcoin for a family member as a gag gift recently thinking we could have some fun paying each other with Bitcoin for little things like household chores and whatnot. This was my first time using Bitcoin, and I was shocked to learn that it costs roughly $5 worth of Bitcoin to make a single transaction using Bitcoin! The fee is known as a "Bitcoin mining fee." I'm an open minded person and honestly believe d that Bitcoin might work prior to actually using it. However, after discovering the actual cost of using Bitcoin, it is clearly inferior to US Dollars in every way. Bitcoin is a scam, block chain is all hype, and everyone involved with Cryptomania is going to look silly when the music stops and someone has to eat the soggy biscuit.

<comment><USER17> I feel it's necessary to point out some problems with your argument here. "I'm an open minded person and honestly believe d that Bitcoin might work prior to actually using it." First of all, it seems kinda strange to me that you say you believed Bitcoin would work, without even using it. So you made an approximation of the technologies value before using it. Then, after using it once, you then totally changed positions. This hardly seems like a decent analysis of the situation, and I think you should probably do some more reading and learning.

Number 2, writing off an asset, and furthermore, an entire asset class based on one instance of a transaction fee (a problem that is being actively worked on, might I add) is lazy and dangerous, to conflate this to "it is clearly inferior to US Dollars in every way. Bitcoin is a scam, block chain is all hype, and everyone involved with Cryptomania is going to look silly when the music stops and someone has to eat the soggy biscuit" is ridiculous and you haven't made any decent points. Your entire argument is based on conjecture and no technical information.

Do yourself a favour next time you decide to shoot Bitcoin and Crytpocurrency down, ask yourself if you've actually done due diligence on your opinion, or if you've settled for the lazy option.

PS: If you are that disgruntled, you're welcome to submit PRs.

<comment><USER16> Maybe if the community can fix the Bitcoin mining fee problem it will work. But if they can't get the mining fee down to like 30 cents per transaction like with square or stripe, the overwhelming majority of people aren't going to want to use it.

And to be specific, I used Coinbase to purchase my Bitcoin and then transferred it to an Electrum wallet and then to another wallet.

People have told me that you don't have to pay the $5 mining fee, but I did not see an option anywhere with those two wallets to avoid or substantially reduce the mining fee.

<comment><USER17> Eyo, sorry for the delay on this reply. I agree wholeheartedly with everything you said, and didn't mean to come off too aggressive with my first comment, even though I probably did. There is a lot of bullshit going around these days around Bitcoin and Crypto, and sometimes it can be pretty grinding to see "big media" out-and-out gunning it down without exposing their true intentions and who it is that they're backing with their comments. Either way, this isn't your fault. So I apologise for coming off aggro.

The transaction fee thing is a problem many people, in particular new users notice, and it's on the forefront of issues being solved by the community right now. In regards to your comments on 30 cent transaction costs, from what I understand, they are indeed on the path to this. If you are interested in seeing what this will look/feel like, buy a small amount of LTC, and send it to another wallet. I had many of the same issues you had with Bitcoin a few months ago, but as soon as I gave LTC a go I was blown away. This, for all intents and purposes, is what the BTC Core team intends to bring to Bitcoin. To give you an idea, transactions cost 2c on the LTC network, with a max time to completion of 2.5 minutes. When you first experience this, it's a great feeling.

Coinbase is always gonna be tricky, their transaction costs for buying BTC are, to put it bluntly, fucking horrendous.

In regards to your comments on not having to pay the fee, there are some wallets that allow you to pick the priority of your transaction, one that springs to mind is IndieSquare Wallet. Bear in mind this will affect the way your transaction goes through, speed wise.

Hope I actually answered your questions on this, sorry for my intial comment. If you have any more q's, just holla. I can either answer them, or get someone with more knowledge than I to answer them.

However, in the interest of getting you to fall in love with Crypto, please, buy a small amount of LTC, transfer it, pay the fractional charges and be blown away. If you aren't impressed by it, I will be surprised.

</comment></comment></comment></comment><comment><USER18> YC isn't even reaching most accredited investors and it wants to go to unaccredited? Sounds like they want liquidity.

<comment><USER19> I'm not sure I understand, could you elaborate?

<comment><USER18> If YC can create a vehicle like this it will give the employees sitting on relatively small amounts of common shares someone to sell to without an IPO. I don't know what their deal might be, but I imagine the partners all have the equivalent of carry and the run of the mill employees do not.

</comment></comment></comment><comment><USER20> Surprised CoinList isn't mentioned here, as they did a successful ICO for FileCoin and serve as a platform for pretty much this exact use-case.

<comment><USER21> That was accredited investor only.

</comment></comment><comment><USER22> Personally I think just enabling trading would not be a good idea. That said, I also want to do something similar to this. Securities laws in the 1st world are hopelessly out of date.

So I've looked in other jurisdictions but I've had huge problems finding the right country to do it in.

The last time I tried I got scammed by a Corporate Service Provider in the Isle of Mann that went out of business about a month after I sent them $$.

If anyone is looking for a co-founder in this space, and is interested in having a chat, email is in my profile.

</comment><comment><USER23> There are currently other possible ways to access and invest in the private markets. For example, EquityZen is a platform that lets people to invest in private pre-IPO companies.

EquityZen: [https://equityzen.com/?utm_source=https%3A%2F%2Fnews.ycombin...](https://equityzen.com/?utm_source=https%3A%2F%2Fnews.ycombinator.com%2Fitem%3Fid%3D15299359&utm_medium=Hacker%20News&utm_campaign=Hacker_News&utm_term=news)

</comment><comment><USER24> It would be nice to remove some of the complexities, friction and cost of holding and trading shares in companies beyond the vehicles that exist today, and I think we can get that via blockchain.

It would need to be regulated though - to reduce scams, and also because regulators wouldn't allow tokens that are securities (shares in a company) unless it's regulated. That part, to me, feels like it will take a long time - would require changing legislation.

</comment><comment><USER25> OK, so you buy a YC token. What do you have? A share of YC's equity pool? What makes YC pay you if they have a big win?

<comment><USER26> what makes them pay investors today if they win big?

<comment><USER27> The government, mostly. I guess the investors would sue and a judge would order them to pay or go to jail.

Your implied point is true though. I'd trust YCombinator to pay out their tokens as long as they don't go bankrupt.

<comment><USER28> Don't most ICOs explicitly state that the token does entitle the holder to...anything? With a stock or bond, there are legal structures that underlay the promised mechanism by which an investor might get a return on investment.

While it's all nice and fuzzy now, it seems to me that the recipients of the ICOs funds can do as they please with the money.

They are structured this way as an attempt to avoid the securities regulations.

It's an interesting solution to the problem. Securities regulations are setup so that investors have a chance at a return. They are intended to prevent the situation where companies raise funds, and don't return value to the investor.

So the sponsor of the ICO just says, no worries, we're not even promising an effort at returning value to investors!

It's unclear how this is going to play out from a regulatory point of view. It is clear, however, that the chance of these companies generating real value and returning it to the token holders is close to zero.

My guess is that most people putting their money down recognize, at least on some level, that they are joining a ponzi scheme. People love to gamble.

<comment><USER29> I think the biggest hurdle regulators will have to overcome if they want anything other than a blanket ban on ICOs will be verifying "good faith" execution of their business plans.

If you create a cryptotoken that has a real business purpose and sell it with the expectation that it will be redeemable for that purpose (basically selling gift cards for a service that doesn't exist yet), and a secondary market forms that appears to believe that the tokens are stock and trades them accordingly, are you guilty of securities fraud? What if you never actually develop that service, would that impact your case? If so, how do you distinguish between something that was a ponzi from the start and a mismanaged project that failed to deliver?

</comment></comment></comment></comment></comment><comment><USER30> Please, let's not attempt to legitimize ICOs.

<comment><USER31> Why not? They can be used legitimately, even if the majority of the use cases at the moment are cash grabs.

<comment><USER32> Why do they need to be on a blockchain?

<comment><USER33> Where else?

<comment><USER32> A database? Do you understand what blockchains are for? Why does regulated securities trading need to be censorship resistant rather than just secure?

<comment><USER33> Those two properties seem to go hand in hand.

How do you imagine an ICO taking place without a blockchain? It seems like a contradiction in terms: the "C" means a blockchain token.

</comment></comment></comment></comment></comment></comment><comment><USER34> Yes, I would invest.

<comment><USER35> Agree

</comment></comment><comment><USER36> im good, already invested in one company that a YC company from this summer's batch ripped off... including copy and vendors

</comment><comment><USER37> If we could stop hindering real progress with all this blockchain bullshit, that would be great...

<comment><USER38> What progress are blockchains hindering?

<comment><USER37> All those investors could actually invest in something with a future.

</comment></comment></comment><comment><USER39> This is clearly a good idea. The whole broker/exchange/regulator triumvirate is a massive overhead for everyone.

Uptime: Trading hours are a 19th century anachronism. Distributed infrastructure is more reliable.

Management incentive: By removing annual and quarterly investor relations milestones businesses are incentivized to move more quickly by creating a more fluid and transparent management and investor relations style.

National access: Being 'listed' on a 'market' is a huge hassle and comes with fiscal protection mechanisms such as requisite auditing which essentially (not completely) amounts to a mafia-esque pay to play fee. Why not just go international and skip the hassle?

Regulation: Of course, the financial services establishment will cry "Regulators! Consumers need protection! Only we, the few, the humble, the experienced, can save their financial souls!" but alas their track record is pretty shocking and regulators with any guts should _encourage_ innovation with some oversight and involvement. The thing is, since blockchains are international regulators are nominally sidelined in a default approach. There should be a middle ground where they can perform basic services such as corporate registration, legal good standing, fair taxation and IP asset attestation, for example, without becoming intimately involved in day to day business.

Transparency: Instead of occasional, high level audits, if transparency is required why not require that in order to be blockchain listed, companies must either use a public blockchain or otherwise effectively real time (eg. daily batched reporting) to transparently manage their financial assets? This would provide superior transparency than the establishment, potentially with crypto levels of trust (thus auditors cannot be bought/make mistakes).

Fiscal restructuring: Being able to do stock splits and so forth could work very well on chains.

Conventional asset financial connectivity: Sooner or later you have to interact with the off-blockchain world. Gatekeeper financial institutions need to validate inbound capital by showing things like source of funds. This is nontrivial with anonymous blockchain inflows, and requires setting up a significant KYC process as per larger crypto exchanges.

Of course there are issues. If there is a gatekeeper to enforce due diligence then is it truly blockchain anymore or are you just doing rebranded ICO 2.0 and issuing your own tokens? I fear the latter. We must find a middle ground. The devil is in the details.

<comment><USER40> Trading hours aren't an anachronism. As someone who trades cryptocurrencies, I frequently need to stay up well into the next morning if markets are moving. It never stops, sleeping is never completely safe. Trading hours make it human

<comment><USER39> Efficiency is profit and is rewarded by the market. Therefore, humanistic single timezone centric trading hours are disincentivized, and because they are not _required_ , they _will_ eventually disappear. Therefore, I view them as an anachronism.

</comment></comment></comment><comment><USER41> SEC regulations are failing the average american in a big way. When it is impossible to own stock in basically any of the high growth tech companies, every person with retirement funds/401k in index funds or markets is missing out, and all the gains are going to a handful of investment banks. I'm not sure whether this represents an intentional move by banking lobbyists, but following the money I'm sure it is.

The ICO market may be bubbly and ridiculous, but at least it will make founders consider an alternative to traditional VC which may give more money for less equity.</comment>


Paranoia and deletion: the wipe man page - <AUTHOR> http://www.boingboing.net/2011/01/14/paranoia-and-deletio.html <comment><USER2> I'm sorry, but this info is nearly ten years out-of-date. First, the Gutmann method was designed for encodings back in the days of RLL/MFM encoded drives. For newer drives which really push the physics quite a lot further, two passes of random data are enough to throw the magnetic domains into a statistical dead heat. There just isn't any physical room on the drive to hold old data.

Secondly, new drives reserve a percentage of the room (invisible to the user), in case some of the sectors go bad the controller will re-map them transparently to new sectors. This might leave old data in the old sectors, where you can't normally see it but an investigator armed with the proper ATA commands can. (This isn't a conspiracy of the government and drive manufacturers, it's all there in the ATA spec.) The correct way to securely erase a drive is to send the drive the SECURITY-ERASE command. The drive controller will securely erase every part of the drive. <https://ata.wiki.kernel.org/index.php/ATA_Secure_Erase> The NSA actually recommends this to other government agencies, so it's probably OK.

<comment><USER3> But how do you know if the data actually gets erased by the drive?

<comment><USER4> If that possibility seriously concerns you, follow it up by physical destruction of the drive. Magnets strong enough to actually damage the data aren't a good cost/benefit from what I gather (too strong, too dangerous, too much hassle), so either shred or melt the drive platters.

I'm generally satisfied with df if=/dev/zero of=/dev/sda because I'm not actually dealing with anything that sensitive, but if you are, just take appropriate steps. Defense in depth.

<comment><USER3> It doesn't concern me _that_ much, but I'd rather fill the drive with random data myself first. I can do the ATA-erase thing afterwards.

On a related note, I also have zero trust in manufacturer-supplied encryption that sits in the drives. There is no way for me to verify whether it actually does anything.

</comment></comment></comment></comment><comment><USER5> Silly conspiracy theory.

1) The scope is too large. Too many engineers at hard drive manufacturing companies would have to know about it.

2) Too America-centric. Engineers in foreign countries, that actually build most of the stuff, would know about it. It would be an enormous security gap that they could use as well.

The sad thing is that such paranoid fantasies, that are easy to debunk, blind you to the _actual_ conspiracies, that are less comprehensive, more subtle and therefore much more threatening. I bet the TLA government agencies love these stories.

<comment><USER6> The invisible yellow dots identifying printers went a long time before becoming common knowledge. I don't believe TFA for an instance, but it doesn't seem an impossibility.

<comment><USER6> Ugh, sometimes I wish I could edit later. Make that "I don't believe for an instant". I hate responding on my phone.

</comment></comment></comment><comment><USER7> I always dissemble my old hard drives, it's therapeutic somehow.

I am not sure how they broke that disc into so many pieces though, in my experience they are incredibly strong and rigid.

The discs make great wind chimes too.

Harbor Freight has a $3 security bit set if you have drives with special screws.

<comment><USER8> Sorry to be a pedant, but I think you mean "disassemble" - I always get the two mixed up too.

<comment><USER9> Currently your comment, which adds nothing to the discussion except a simple spelling correction, has more upvotes than the parent. Sign of the times for HN?

Not to say spelling corrections are never useful, I think they often are, but I don't understand the mindset that upvotes them _over_ comments that actually participate in the discussion.

<comment><USER10> I learned a new word today: dissemble. I come to HN to learn; therefore, it got my upvote.

</comment></comment></comment></comment><comment><USER11> The man page is correct about quite a few things, but it's also a bit sarcastic:

           The  best way to sanitize a storage medium is to subject it to tempera-
           tures exceeding 1500K.  As a cheap alternative, you might use  wipe  at
           your  own  risk.  Be  aware that it is very difficult to assess whether
           running wipe on a given file will actually wipe it -- it depends on  an
           awful  lot  of  factors,  such  as  :  the type of file system the file
           resides on (in particular, whether the file system is a journaling  one
           or not), the type of storage medium used, and the least significant bit
           of the phase of the moon.

But no matter what, wipe is a really great program.

</comment><comment><USER12> I sleep at night knowing that the teams of highly effective government data recovery personnel that Hollywood portrays will never exist.

</comment><comment><USER13>
        Of course this shifts the trust to the computing system,
        the CPU, and so on. I guess there are also "traps" in the
        CPU and, in fact, in every sufficiently advanced mass-
        marketed chip. Wealthy nations can find those. Therefore
        these are mainly used for criminal investigation and
        "control of public dissent".

I'm unsure in which way a government agency could benefit from having backdoors in the CPU? Even if they did, and even if it could detect that some sort of encryption was going on, where would it _store_ the interesting data?

<comment><USER14> Well, there was/is that trusted computing thing, i.e. putting DRM on the PC in hardware. The benefit would be denying encryption from terrorists/pirates/dissenters, like he just said. Interesting data can be stored just about anywhere, from phoning home to hidden partitions to having a small flash on the BIOS, depending on what's deemed interesting (logs, sector addresses, cryptographic keys, painted files).

</comment></comment><comment><USER15> Funny, I was just having a conversation today with a friend who works for the company selling <http://www.whitecanyon.com/wipedrive-erase-hard-drive.php> and remarking that it may keep your data safe from identity thieves, it wouldn't protect you from the FBI.

<comment><USER16> Did he explain more specifically why he thinks it would "protect you from the FBI"?

<comment> DanI-S The idea that they need actual evidence to lock you up is _so_ 20th century...

</comment></comment></comment><comment><USER17> To everybody spending thought on this: Relax, nobody is interested in your porn collection.

<comment><USER18> I've used such tools to wipe my hard drives before selling or donating used computers (although I would use them before disposing of a hard drive in any way, really). I have heard of people buying up used computers and hard drives and extracting saved passwords from them.

A lot of people are smart enough to format it quickly, but not everyone will let (or know to) a computer sit for dozens of hours so that things might be wiped more securely.

<comment><USER19> I've had the experience where people agree to buy my broken computers for parts and the deal is done, until I mention that the "drives are wiped and ready to go". Then I never hear from them again.

Granted, somehow visiting the craigslist site turns ordinary people into flakes, but the "wiped" statement correlates a bit too well with the vanishing interest.

<comment><USER20> +1, but I'd stop mentioning it after the first time (unless of course you're just doing this as an experiment and aren't really interested in selling the stuff)

</comment></comment></comment></comment><comment><USER21> Any idea what's the difference between _wipe_ and _shred_?

<comment><USER22> The _shred_ man page warns you that the tool is not fully effective on journaled filesystems. I doubt wipe is, either.

</comment></comment><comment><USER23> Does anyone know if any such FOSS works with SSDs and their wear-levelling of their writes?

<comment><USER24> wipe is rather unlikely to overwrite the bits on an SSD. Even with TRIM (which wipe won't use, btw), the disk will prefer using a blank sector to one it has to erase. Reading the currently unmapped spare sectors is probably something anyone with a solder gun can do.

</comment></comment><comment><USER25> An alternative could be to overwrite the disk with null bytes.

      dd if=/dev/zero of=/dev/hda bs=1M

Wonder if it is going to be slower than wipe.

<comment><USER26> ....multiple times.

Overwriting it once prevents software reconstruction of the data, but magnetic analysis of the underlying disk itself can reveal (depending on the voltage returned by the resulting 0 or 1) whether the previous value was (within a degree of certainty) a 0 or 1.

<comment><USER27> Wait - how automated is magnetic analysis? How much would it cost to recover a gigabyte disk, for example? What about non-spinning disks, are they cheaper or more expensive?

<comment><USER26> It's expensive as hell :)

The companies that do it charge several thousand an hour, IIRC. (this was back in the 90s?)

Depending on the non-spinning disk type in question, it can be either more or less secure than the usual magnetic HDD. You've got "flash" but that's just a nice word for any number of highly-differing technologies such as MLC and SLC on the inside. And you have NAND vs NOR techs to consider as well.

Perhaps the security in non-magnetic-HDDs comes from the fact that they're so new to the table, not many specialize in restoring data from them.

<comment><USER28> Could you give the name of one of these companies?

<comment><USER29> Here's one: <http://www.krollontrack.com/>

</comment></comment></comment></comment></comment></comment><comment><USER30> For those on Mac OS X (and perhaps *BSD?), we have srm.

The Secure Empty Trash function is a frontend for this IIRC.

<comment><USER31> I wish there was a version that only overwrite once with 1's. That would be best for my SSD. (Which has wear leveling and is formatted with a journalling filesystem anyhow, so perhaps it's moot.)

</comment></comment><comment><USER32> But what to do against those brain-wave readers? I better start thinking encrypted!

</comment><comment><USER33> I love this section:

"I strongly recommend to call wipe directly on the corresponding block device with the appropriate options. However THIS IS AN EXTREMELY DANGEROUS THING TO DO. Be sure to be sober."

</comment><comment><USER34> How would a hard disk controller detect encrypted data? It is essentially a (psudo-) random stream of bytes. Even if the controller is programmed to recognize such streams, it would be easy to first wipe disk by writing small random files all over and then wiping with 0/1 pattern. So any cached data is essentially worthless.

</comment><comment><USER35> When I was younger, I erased a harddrive by covering it with burning thermite. It was pretty impressive, melting the drive, turning the sand underneath to glass, and burning through the asbestos pad into the cement.

</comment><comment><USER36> I use DBAN to wipe hard drives before disposal. If you are replacing a failed drive, the only reasonable thing you can do is physically destroy the platters.</comment>


Show HN: FEEDBACKdeck — Self hosted user feedback tool for Startups/Blogs. - <AUTHOR> http://vinnybhaskar.com/feedbackdeck/

<comment><AUTHOR> Hey Everyone, FEEDBACKdeck is a side project I'm working on while building my bootstrapped startup — Clustrr. I needed a tool to capture user feedback and short pop-up surveys seemed an excellent choice. I scoured the Internet for a service that would fit my needs. But most services meant shelling out $200 - $350 a year for the most basic plan (read limited plan). I feel that short survey tools can be decentralised and self-hosted. To me there appears no benefit of running them from a cloud infrastructure. This translates to huge savings.

The plugin can be used on any self-hosted WordPress site. Startups can use the plugin on their coming soon/launch pages months before the actual product launch and start gaining valuable user feedback. Blogs can benefit from gaining feedback on publications from it's readers.

I had a hard time writing the sales page copy. Would love to have your opinion on the copy, design and the product itself.</comment>


Ask HN: Where do you buy your domain names? - <AUTHOR> Where are you all buying your domain names and why? And for what? Do you have a favourite for personal projects? A favourite for enterprise stuff? <comment><USER2> I typically use namecheap though I have used others for specific TLDs (rnids.rs for .rs and Web4Africa for .i.ng). I moved to namecheap after the GoDaddy supported CISPA based on recommendations from HN and Reddit. I've had no problems with them and am content.</comment>


TLD DNSSEC Report - <AUTHOR> http://stats.research.icann.org/dns/tld_report/archive/20200428.000101.html <comment><AUTHOR> Posting as a reminder that DNSSEC rollout to the top level domains (TLDs) is still incomplete. Without DNSSEC, DNS is spoofable.

Further DNSSEC rollout to non-TLD DNS servers is also incomplete. DNS spoofing is still possible in 2020.

[PDF, 2008] [https://www.iana.org/about/presentations/davies-viareggio- en...](https://www.iana.org/about/presentations/davies-viareggio- entropyvuln-081002.pdf)

<comment><USER2> _With_ DNSSEC, the DNS is spoofable. The two most common spoofing modalities in practice are LAN-style spoofing (airport and coffee shop wireless) and registrar ATO, both of which DNSSEC doesn't touch. Ironically, the former spoofing modality is directly addressed by DoH (or DoT, if you trust your network operator) and doesn't require coordinated or universal deployment.

There's a reason fewer than 2% of all .COM domains are signed; it's because DNSSEC is moribund.</comment></comment>