Introducing AWS Elastic Beanstalk - <AUTHOR> http://aws.typepad.com/aws/2011/01/introducing-elastic-beanstalk.html <comment><USER2> Wow. The benefits of Google App Engine without the limitations? Sure, an app on GAE is probably cheaper in terms of monthly expense, but factor in the development costs for a Java team unfamiliar with App Engine and Beanstalk is probably a far better investment.

<comment><USER3> no, with different limitations I believe, e.g. no cool google storage, but only SDB or RDB (which may be ok anyway)

<comment><USER4> I agree. It's definitely meh without a useful and truly scalable database. That's the hard part. SimpleDB isn't particularly useful, and RDB isn't particularly scalable.

<comment><USER5> Don't worry, by the time you'll be so big that you scale out of RDS, you'll be able to build your own datastore.

</comment></comment></comment></comment><comment><USER6> It's easy to find holes in this announcement: Beanstalk doesn't have X, or they compare unfavorably to AppEngine and Heroku in certain areas. The bigger news here is that Amazon has staked a flag in the ground and decidedly shown their intention to enter the PaaS arena.

What has AWS done in the past? They've introduced a new product, then over time:

1) Made it easier to manage 2) Made it more automated 3) Added additional bits of functionality

Why would we not expect them to do the same with Beanstalk?

</comment><comment><USER7> Just to assist with cross-referencing, there's another, slightly older discussion of this here:

<http://news.ycombinator.com/item?id=2118778>

</comment><comment><USER8> I'm not sure how useful this really is. It just handles the application layer, leaving you on your own for dealing with the database. Now, Amazon has some services to help you out (RDS, SimpleDB), but SimpleDB is kind of crap, and RDS is expensive.

More importantly, that loses some of the simplicity, meaning that you still have to think about infrastructure to a degree.

Heroku is git push to deploy, and if you have a standard Rails app, that's it.

Whereas to deploy a standard Rails app, after you package up your app as a .war with JRuby (and deal with possible gem incompatibilities), you have to spin up an RDS instance too. And change the config in your Rails app so that it knows how to talk to the RDS instance. And if your RDS instance crashes, they backed it up for you, but you still have to manually restore from the backup.

And once you're already thinking about infrastructure to that degree, you've lost a lot of the benefit of a PaaS.

<comment><USER9> RDS pricing appears competitive to Heroku's dedicated databases. It's hard to compare them directly since RDS separates instance type, on-demand and reserved instances, provisioned storage, replication (crossing availability zone boundaries), and number of requests. Heroku on the other hand provides a fixed amount of storage (and one that's twice the max one can provision for RDS), a mix of instance types, and a connection cap limit. It's not clear if Heroku provides multiple availability zone instances similar to RDS.

Ignoring provisioned storage and request costs one can have a small on-demand RDS instance for ~$80/month. Heroku's instance (RAM/CPU) equivalent (Ronin) is $200/month.

</comment></comment><comment><USER10> AWS never fit into my definition of a "cloud" solution. It's a VPS with a rich API and a lot of addons (load balancer, EBS, S3...).

From what I'm reading, Beanstalk changes this and clearly puts AWS in the category they've long claimed to be in. Not that their service wasn't great/unique before. This just puts them that much further ahead.

It's along the lines of what Heroku does with their routing mesh layer (as far as I understand it).

<comment><USER11> Amazon's execution with EC2 over the past few years has been excellent. If Amazon makes a Rails version of Beanstalk, Heroku should be worried as Beanstalk could take some market share from Heroku.

<comment><USER12> According to press release

"We're working with AWS to provide an Elastic Beanstalk Ruby on Rails container that leverages the optimized Engine Yard stack which has been battle-tested by thousands of high-growth companies." John Dillon, CEO of Engine Yard

[http://www.businesswire.com/news/home/20110119005591/en/Amaz...](http://www.businesswire.com/news/home/20110119005591/en/Amazon- Web-Services-Introduces-AWS-Elastic-Beanstalk)

</comment></comment></comment><comment><USER13> Questions: What does Elastic BeanStalk mean for me?

1\. Can my database auto-scale?

2\. Can my JVM heap auto-scale beyond 2 GB without GC pauses?

<comment><USER14> It's built on EC2, so no and no.

</comment></comment><comment><USER11> Just to be clear, this is only for Java apps right? This does not include PHP or Python?

<comment><USER15> This is just the first step, according to techcrunch ruby is next.

[http://techcrunch.com/2011/01/19/amazon-web-services- introdu...](http://techcrunch.com/2011/01/19/amazon-web-services-introduces- elastic-beanstalk-for-easier-app-deployment/)

<comment><USER16> Ruby already works, actually: [http://blog.headius.com/2011/01/jruby-on-rails- on-amazon-ela...](http://blog.headius.com/2011/01/jruby-on-rails-on-amazon- elastic.html)

</comment></comment></comment><comment><USER17> The real question is: can this offering compete with the specialized PaaS services we have seen emerge in the last year - heroku, GAE, djangy.djangozoom/eldairon, various node.js services, phpfog, etc...

The specialized services will be less work to maintain for developers, and will offer unique additional features that Amazon will have a hard time keeping up with if they try to spread themselves too thin.

<comment><USER18> Because Iwork mainly in Python, I just checked out the offerings you mentioned for Python that aren't GAE. Both Djangy and Djangozoom are in private beta still, so I can't imagine they're that far along. Eldarion doesn't look self serve, although maybe that's just their site.

It seems likely that, not only can Amazon compete, but could probably dominate. Heroku is a big outlier and really the first to demonstrate that the need/power of a PaaS. It doesn't look like there's anything nearly as mature for Python. Don't know about other languages/frameworks, but if it's like Python, Amazon has a big opportunity here.

<comment><USER17> Agreed - the only one I have actually used is GAE, and I was definitely not trying to endorse the other services as "too good to beat." Just trying to say that with all the different stacks out there for different languages and purposes there will be a benefit to specialization, which might not benefit from amazon's skillset as much as the provisioning of VPS's and other infrastructure has.

For python hosting, GAE is probably the only real competition at this point. There is a HUGE opportunity to eliminate sysadmin work on all these stacks for smaller developers especially. I am just not sure if Amazon will domiate both the infrastructure and platform layer.

</comment></comment></comment><comment><USER19> This is cool, but not earth shattering. It is essentially a management stack/abstraction layer/deployment tool on top of existing AWS services: EC2, CloudWatch, load balancing, route 53, autoscaling, AMIs. It is a PaaS sort of... but single-tenant and not in the same sense as a multi-tenant, higher level PaaS like AppEngine or Heroku. Elastic Beanstalk gives you flexibility (full root access - do whatever you want), but with that comes more responsibility from a management perspective, and more opportunities to shoot yourself in the foot.

</comment><comment><USER20> Cool new feature. Not too tough to see this coming though. One of the biggest barriers of entry to AWS has always been scaling/deployment. With companies like Cloudkick and Scalr helping to alleviate this, but being somewhat platform agnostic (Cloudkick supports aws, rackspace cloud, etc) Amazon would want to have an all-encompasing solution that has more of a vendor-lock in to their products. With solutions like Beanstalk and their free web tier, AWS is becoming easier to step right into each day. I predict that in a few years there will be no such thing as shared web hosting...

</comment><comment><USER21> Sounds like a great idea, though the naming is a bit unfortunate, there might be some confusion between the Git hosting and collaboration application: beanstalkapp.com.

<comment><USER22> An Amazon marketer might say that's Beanstalkapp's problem now

</comment></comment><comment><USER23> There's still plenty of room for competition. Beanstalk is limited in its ability to innovate because it is simply a management layer on top of AWS, which will restrict its potential feature offerings.

I think smaller developers stand to reap huge productivity benefits from easier to use and more feature-rich platforms such as Heroku.

<comment><USER24> Why is being a "simple" management layer atop AWS limiting? Bear in mind that Heroku is, in your terms, simply a management layer atop AWS. Using it as a technical yardstick and considering Amazon's strong financial position and commitment, it stands to reason that there is a long runway for Beanstalk's innovation.

</comment></comment><comment><USER25> Would that make a good fit for an Apache Solr server? Put the index on EBS?

</comment><comment><USER26> At the moment I'm able to launch applications in the US East region only. When will the other regions support Elastic Beanstalk?

<comment><USER6> Yes, US East region only for now. From their official FAQ, other regions in the future:

<http://aws.amazon.com/elasticbeanstalk/faqs/#regions>

</comment></comment><comment><USER27> <http://news.ycombinator.com/item?id=2118778>

</comment><comment><USER28> "beanstalk is built using a number of existing AWS services, not from magic beans."</comment>


AppCode: Objective-C IDE from JetBrains goes public - <AUTHOR> http://blog.jetbrains.com/objc/ <comment><USER2> At first I was excited that Xcode had some competition, so I downloaded this as soon as it was available.

Unfortunately, it has a crappy Java-generic GUI. For an IDE for a platform that makes a big deal out of user experience, it really looks awful. (And it manages to be slower than Xcode 4!)

I understand that tools don't have to be pretty to be functional, but I draw the line here.

<comment><USER3> Same deal with MonoDevelop. These alien GUIs look absolutely miserable in OS X alongside the system and all the tastefully done third party native apps you have running.

<comment><USER4> Unfortunately, outside of xcode, their is no other competition. No other IDE comes close. Considering this release is a pre-beta (and not some faux-beta popular with web two point oh startups these days). Having used other Jetbrains products, I'm fairly certain that when all is said and done, the final product will be solid IDE.

<comment><USER5> > Having used other Jetbrains products, I'm fairly certain that when all is > said and done, the final product will be solid IDE.

It probably will be solid, but having used their other products on the Mac (RubyMine, IntelliJ), it's probably never going to get any less java-ugly or feel any more native.

And I think that's likely to be more of a problem for potential users of AppCode vs RubyMine or IntelliJ users on the Mac. Because its target market is either established Mac developers who care about the conventions and tastes prevalent in Mac software, and thus find AppCode ugly and alien in function, or users of other JetBrains products getting started with Mac development, for whom AppCode might feel familiar but will be a barrier to learning about the conventions and tastes prevalent in Mac software, leading them to produce sub- par experiences with the product.

<comment><USER6> Meh - it's not for those us who like everything in its place, fully native "oh my god it's so elegant" software.

It's for those of us who want something that does everything we want (plus some more) without being too hard on the system resources and has the ability to stay out of our way when we need it to.

It's true, Jetbrains products are not the most beautiful, and yes they're mostly written in java. However, they do make incredibly functional products with a slim learning curve with some amazing features. Jetbrains products (from Python to Ruby to PHP, and I'm sure their new AppCode) have consistently shown the best understanding of the code being developed which contributes to the best code sense and refactoring support I've ever seen in any IDE.

</comment></comment></comment></comment></comment><comment><USER7> I know the GUI might not look nice due to being Java, but if AppCode will get as much polish and as many features as IDEA or the smaller language specific IDEs got, then AppCode is something to really look forward to.

Even after a year of constantly using PhpStorm (yeah - _still_ no time to rewrite that huge app I'm maintaining) I'm still finding little things that show that the IDE was really made by developers.

It's just like with the iPhone: It's full of little nice touches.

Recently, I was pissed of enough about the typo in the name of an interface:

        IModuleAmmendment

and I had PhpStorm rename refactor it.

Of course it worked (and instantly over 800 files), but it also fixed the typo in a class implementing the interface (CatalogModuleAmmendment was for example renamed to CatalogModuleAmendment).

And that's just a sample: The IDEs are full of these little things. This makes me so productive that I can easily live with the less-than-perfect looking UI.

This sounds like a commercial, but I'm really just a (incredibly) happy customer of theirs.

<comment><USER6> Absolutely.

PhpStorm is simply the best IDE I've used for our very large PHP application. And I've tried almost all of them.

</comment></comment><comment><USER8> What I would pay for is not another IDE but one that handles all the code signing bullshit for me. It's crazy the amount of errors a team can have regarding code signing and push notification certificates.

</comment><comment><USER9> I'm excited to see more additional development solutions for Objective C; but why are we taking a step backward with these awful Java like GUIs that have plagued Eclipse and NetBeans?

Why in 2011, are people still building UI heavy applications with Java?

<comment><USER10> Our startup's main product uses Java for a UI heavy app because makes it cross platform out of the box and is relatively easy to develop a nice, native looking UI with if you know what you're after.

Our closest competitors locked themselves to one platform and have faced challenges trying to go cross platform.

<comment><USER9> Chrome and Firefox seem to do a good job of going cross platform.

<comment><USER11> İt is just far easier with java.

<comment><USER9> Being 'easy' is irrelative when it results in a terrible user experience. There's no way to explain to the user: "oh this would look a lot better but we wanted to use a different language so it's not our fault".

<comment><USER11> Jetbrains producsts has a good reputation. It does not apply here.

</comment></comment></comment></comment></comment></comment><comment><USER12> JetBrains does a lot of good things. The fact that they bring their ideas to a number of different languages is a great thing. Resharper, IntelliJ, RubyMine, PyCharm, Phpstorm and now AppCode - you could stick purely to Jetbrains products and have a familiar IDE layout and functionality for the various different application development tasks you undertake.

</comment><comment><USER13> I've wished many times for ReSharper-like refactoring in Xcode. Now JetBrains (the ReSharper people) have announced CIDR, an Objective-C IDE.

Apparently CIDR is still at an early stage (pre-beta even) and doesn't yet support debugging on a physical device, but I still take this as great news. I think allowing developers to download and try CIDR now will give JetBrains the feedback they need to deliver a great finished product.

</comment><comment><USER14> I don't think most Xcode users know what they're missing. And unfortunately they still won't, just by looking at screenshots and perhaps firing this up and having a quick bash around.

Some really good screencasts are needed to show what's possible with appCode - fortunately JetBrains does excellent screencasts for their other products and I'm sure they'll do these as it gets closer to release.

As for me, I'm a long-time IntelliJ user. Xcode 3 has been incredibly painful to use - even after taking a lot of time and effort to learn the keyboard shortcuts.

Xcode 4 is a major step in the right direction and started to actually make iOS coding reasonably fun. But it still can't hold a candle to the features available in this early release of appCode - it's awesome.

<comment><USER14> Here is one small example of something that won't be apparent to someone without a demonstration.

Say I have a class called Foo and I realise, as I'm using it, that I want to add a method called doSomethingElse, I can just type the new method call and have appCode create the method for me. Ie:

Foo *foo = [[Foo alloc] init];

[foo doSomething];

[foo doSomethingElse]

doSomethingElse would be marked in red. I just have to hit command-enter, select 'Create method' and appCode creates the method signature in Foo.h, creates the method in Foo.m and puts the cursor in the body of the method ready to implement it.

This improves coding flow remarkably.

<comment><USER5> That strikes me as a good example of where the kinds of features JetBrains is known for don't really mesh with Objective-C.

If doSomethingElse is a method defined in a category I expect to be loaded at runtime, or something I expect to be caught by foo's forwardInvocation method, having it turn red and bug me to provide an implementation in Foo is exactly the wrong thing to do.

It's the kind of little feature that really only makes sense in the context of a static language like C#, where a method call without a corresponding method implementation can be known definitively to be an error.

<comment><USER15> GCC would give a warning if you tried to compile this, and Xcode 4 would highlight the offending line with a yellow bubble. appCode's behavior doesn't seem too inappropriate in this case.

<comment><USER14> Now that you mention this, I think it's highlighted in a muted color as a warning, not as a glaring red error.

</comment></comment></comment></comment></comment><comment><USER16> I can't imagine they can compete with XCode 4 and its excellent integration with profiling tools, LLVM, etc.

</comment><comment><USER17> Competition is always good. Just wish that you don't have to download Xcode again with every iOS SDK update.

<comment><AUTHOR> I never understood that. Is there a good reason why everyone have to download 4gb for each XCode and iOS SDK release?

</comment></comment><comment><USER18> I am sure it will get polished before the final release. All IntelliJ IDEs can install a very functional VIM plugin - that itself is a big deal for me!

<comment><USER19> Having a vim plug-in for Xcode 4 would make my year. For longer coding sessions i've been editing in MacVim with cocoa.vim and clang_complete.

</comment></comment><comment><USER20> As a java developer that needs to also support native iphone and android apps, this is a huge win for me. Its very nice to jump around projects using the same familiar keystrokes and functions.

</comment><comment><USER21> just for reference, here's what it looks like: <http://cl.ly/5rbn>

doesn't look ugly to me. Looks clean actually...

<comment><USER5> Clean, perhaps, but absolutely non-native, which is generally considered an ugly quality on OS X.

<comment><USER22> The disclosure triangles and combo box look native. The icons, scrollbars, tabs, toolbars, status bar, tip-of-the-day dialog (wtf?), and confirmation dialogs all are obviously non-native, some of them in ways that are trivially fixable (such as getting the button order right in the confirmation dialogs).

I understand that it's pre-beta, but if they consider the current GUI to be even a prototype instead of the placeholder that it is, they'll likely never get any traction outside of Java developers trying to cash in on Apple's App Stores.

<comment><USER23> > but if they consider the current GUI to be even a prototype instead of the > placeholder that it is

I doubt it is. It's not the first Jetbrains IDE on OSX. They may decide to go a very different graphical route for this one as it's pretty obviously OSX- only, but that's not really a given.

</comment></comment></comment></comment><comment><USER24> The project sounds cool, but the perspective of the bottle icon is way, way off.

</comment><comment><USER25> I am very excited to try this since XCode has really needed a suitable alternative for a while.

</comment><comment><USER26> Ah good, something we can point to the next time someone complains about XCode.

</comment><comment><USER27> I noticed it has the new "vanishing" scrollbars. Looks a little ugly, but it's not that bad. I expect it will get better with time. I like the color-coded tabs and easy tab switching. The editor itself lags a bit.

Strangely enough, it didn't recognize my .mm files as Objective-C++ files.</comment>


First Independent Testing of Cold Fusion Device - pierre-renaux http://www.forbes.com/sites/markgibbs/2013/05/20/finally-independent-testing-of-rossis-e-cat-cold-fusion-device-maybe-the-world-will-change-after-all/?

<comment><AUTHOR> A nitpick: the study the article links to is published on Arxiv, rather than an academic journal. This implies these findings have not yet been subjected to peer review. Since the authors have previously stated their support of Rossi, this somewhat detracts from their claim to be independent and academic.

<comment><USER2> Yes, the paper is not peer-reviewed yet. However, given the time it takes to go through a review process, it is not surprising that the authors publish a techreport on arXiv.

In any case, this is much better than what anybody anticipated.</comment></comment>


Ask HN: Where can I find a list of every YC startup? - <AUTHOR>

I would love to see a list of all of the YC startups, broken down by session.<p>Anyone know where to find this? <comment><USER2> <http://lmgtfy.com/?q=ycombinator+company+list></comment>


Ray Kurzweil Predictions for the 2020s - <AUTHOR> https://en.wikipedia.org/wiki/Predictions_made_by_Ray_Kurzweil#2020s <comment><USER2> How were his predictions for the prior decade?

<comment><USER3> [https://en.m.wikipedia.org/wiki/Predictions_made_by_Ray_Kurz...](https://en.m.wikipedia.org/wiki/Predictions_made_by_Ray_Kurzweil#2010s)

<comment><AUTHOR> So basically he got everything but the ultrasonic advertisement right - if you account for things that are technologically possible even if they aren't of common use (like Google Glass and wearable computer-clothes).</comment></comment></comment>


Signs that you're a good programmer - <AUTHOR> https://sites.google.com/site/yacoset/Home/signs-that-you-re-a-good-programmer

<comment><USER2> _Almost no committed code that is commented out_

I don't 100% agree with this one, at a company I worked at they had a policy of commenting out code, adding a date it was commented out and a reason why. After 90 days aging it would be removed by a script, which would delete the commented out code, grab the description of why it was removed and then do a commit to source control with the description. This actually worked great for documentation of changes that occurred. Now granted you can do the same thing by requiring comments on commits in source control and then researching the version history. But having it right there in the code made the process of investigating code very fluid.</comment>


Opinion Corridor: widespread self-censorship - <AUTHOR> https://en.wikipedia.org/wiki/Opinion_corridor <comment><AUTHOR> From the quote in the article:

Sweden didn't become like Denmark, thank goodness. Maybe the opinion corridor helped. But the price was too high: widespread self-censorship, a fear to examine reality objectively, a diminished belief in the power of arguments. And as a result a dumbed-down public, moral-panicked politicians and social problems that should have gotten attention and been dealt with a long time ago. It proved to be an expensive corridor.

— Ann-Charlotte Marteus, Expressen, 24 May 2015</comment>


Research Finds Outright Grants of Cash are an Effective Form of Aid to the Poor - <AUTHOR> http://news.columbia.edu/global/3240

<comment><USER2> If you find this persuasive, consider donating to [http://www.givedirectly.org/](http://www.givedirectly.org/), which performs unconditional cash transfers to the poorest people in Kenya.

Give Directly is the subject of this writeup[1] on GiveWell, and this excellent episode[2] of This American Life.

[1]: [http://www.givewell.org/international/top-charities/give- dir...](http://www.givewell.org/international/top-charities/give-directly)

[2]: [http://www.thisamericanlife.org/radio- archives/episode/503/i...](http://www.thisamericanlife.org/radio- archives/episode/503/i-was-just-trying-to-help)

<comment><USER3> Why not hand the next beggar you see a $20?

<comment><USER4> Presumably because $20 goes further in Kenya than in wealthier countries.

<comment><USER3> My only point is that to me, giving cash to Kenyans and giving cash to beggars seems morally equivalent. Not saying you shouldn't do either _but_ I do think if you give Kenyans cash but have qualms with giving beggars money, well I don't think that makes much sense.

<comment><USER5> I think the idea is to give the money to random people (not necessarily the ones who needed). A beggar is not exactly random.

<comment><USER2> No, the opposite. Give Directly finds the very poorest people in a village (as judged by the materials their house is made from), and the Uganda study used self-selected entrepreneurs. Both of these were trying to maximize the impact of each dollar by giving the money to the people for whom it would do the most good.

Giving money to a beggar in the US would not do nearly as much good, both because the US has excellent safety nets (hospitals that will treat you, food banks) and because everything in the US costs more (so you can provide less of it to someone in need per dollar).

</comment></comment></comment></comment></comment></comment><comment><USER6> I think the context is super important here. "gave cash to groups of young people so they could learn a trade and start their own businesses." In Uganda.

These people were pretty much starving before. "These were mostly farmers who had work 10 to 20 hours a week and earned about $1 a day,"

With different people, culture, attitudes, environment the effect might be completely different in America, for example.

<comment><USER7> In addition...

To get the cash, applicants had to form a group with others in their village and submit a proposal showing how they planned to use the money

It's not clear how selective they were, but it does sound more involved than just "fill out this form and get your cash." So it's a group of people that were selected, or at least self-selected, for some minimum amount of initiative and ambition.

The title of the article invites comparisons to social safety net programs in the developed world, but this sounds more like a combination of the educational and small business grant programs. It also seems like it would not be broadly applicable - you couldn't just carpet an area with $400 grants and expect the same kind of success rate.

<comment><USER8> In addition...

The simple fact that someone came after those people to check what they did with their money, for the purpose of the research, probably influenced the result (at least if they knew or suspected that beforehand). If they said they would use the money for business, but then instead spend it alcohol and gambling, that would be very embarrassing.

If on the other hand, a program like exists this for a long time and everyone knows nobody will check what you do with the money, abuse would become very likely, imo.

<comment><USER9> I think you've just hit the nail on the head. Gifts in this program have the same function as loans would traditionally have : they are supposed to be invested in improving one's life. They were obviously not free, the money was traded for promises that carry a social cost if one doesn't deliver.

A basic income would have no such effect. If it's enough to live on, why would everyone invest it in becoming a better and more capable individual ? (note the question is not "anyone", but "everyone". The aggregate effect of free money is what will determine the outcome. Not what exceptional individuals might achieve with it, but what a lazy drunkard would achieve with it matters)

<comment><USER10> Don't this:

> The aggregate effect of free money is what will determine the outcome.

And this:

> Not what exceptional individuals might achieve with it, but what a lazy > drunkard would achieve with it matters)

Contradict each other? The "aggregate effect" = "lazy drunkards" \+ the effect of "exceptional individuals" \+ the effect of everyone else. So it really isn't the lazy drunkards that matter; it's the overall effect that does. If, on average, it improves society then isn't that a win?

Very often, when talking about basic incomes and similar programs, people seem to say things like "twice as many people will take advantage of the system and be lazy." To me, that's not a sufficient criticism: it all depends on the percentages. If a program increases the percentage of bottom feeders from 1% to 2%, say, but also doubles the quality of life of everyone else, that would be a huge win to me. Obviously, the numbers I chose in my example are probably unrealistic, which just further illustrates how important it is to actually determine what the numbers are/will be.

<comment><USER9> You're right. That was wrong. I obviously meant it's the effect of A plus B.

It would depend on the amount of "bottom feeders". That's a bad way to define it though, "non-productives" might be better, since it would include pensioners, children, students (including people who go back to studying if this program is introduced, but are older than 0-24 years), really ill people, ... mostly not people I'd define as bottom feeders.

I would say that it's a lot larger than 1-2%. Let's assume that a lower bound on the non-productive people would be 30% of the total (which would mean tax levels need to be, at bare minimum . I would say that various factors are going to make that close to 50% over a period of time that's not very long.

Suppose you'd have the same tax level for these things as you currently have for social programs + medical programs (~50% of total taxes), then here's how much it could be (ignoring administration costs, which would take another bite):

Non-active population => basic income possible using 50% of govt. budget

30% => 11,249

40% => 9,642

50% => 8,035

60% => 6,428

70% => 4,821

(the current labor force participation rate is 65%. Since that is likely to drop, prudence would suggest you take the 50% or 60% figure as realistic. Increases in the govt. budget dedicated to this cannot make these numbers rise by a significant amount. So I would think the 30% figure is the maximum attainable even if the military were to be defunded)

Since even the largest of these numbers is only barely sufficient to live + insurance + ... is this really worth it ? This amount is not of the level that it's going to do what this program needs to do to improve our economic situation : give the poor disposable income.

The basic problem we have is of a different nature. We do not have any economic reason for 70% of the world population to be alive, and that number is growing fast. In the US that number is currently amazingly low, but it's bound to rise as well.

<comment><USER10> > It would depend on the amount of "bottom feeders". That's a bad way to > define it though, "non-productives" might be better, since it would include > pensioners, children, students (including people who go back to studying if > this program is introduced, but are older than 0-24 years), really ill > people, ... mostly not people I'd define as bottom feeders.

You're absolutely right, thanks for the correction.

</comment></comment></comment></comment></comment></comment></comment><comment><USER11> The problem with cash grants is something that does not show up when there is a Columbia professor watching things. And that is that the money gets stolen.

Many poor countries suffer from corrupt callous and cruel leadership. And this means that the people in power tend to steal from the poor. Thus, if some organization tries to give cash to the poor there is a high likelihood that the money will be stolen and sent to a swiss bank.

It is much more difficult to steal bags of grain with "US AID" printed on them. They are heavy transport is expensive and no-one will pay full price for bags of grains that say US AID on them because they will know it is stolen. If you want to re-bag the grain, it will be a lot of work, and you will have to hire many workers some of which may inform the US embassy. Thus, once the US government dumps a bunch of grain in a poor place, even the evil corrupt warlords tend to leave most of it to the poor because it is too difficult to steal it and sell it.

There is a similar problem with cash crops. Initially when I heard activists complain about cash crops, I said "what is the problem? Farmers should farm cash crops in order to get the maximum amount of money for their land and labor." Well the problem is that if you plant cash crops (such as coffee, cocoa, etc.) you have to sell them to get some money out of them. But the local corrupt official and/or warlord will take control of all the merchants and make sure the farmers receive very little and take most of the money for himself. If, on the other hand the farmers plant ordinary food, it is very difficult for warlord to steal it. He will have to make his troops do actual agriculture work to steal the food, and they hate that.

So this will only work for countries with relatively strong civil society and there are very few of those among the poor countries.

<comment><USER12> Don't you have it exactly backwards?

I've heard (from people like Andrew Mwenda) that say that Western aid to African governments ends up not helping the citizenry and just props up bad governments.

Aid that completely bypasses corrupt governments and goes directly to citizens seems to be less likely to be stolen by middlemen. If you look at Give Directly ([http://www.givedirectly.org/faqs.php](http://www.givedirectly.org/faqs.php)) they send cash directly to a person's cell phone, and their audits have shown very little money being lost to corruption.

<comment><USER13> > Aid that completely bypasses corrupt governments and goes directly to > citizens seems to be less likely to be stolen by middlemen.

Pretty much by definition it is less likely to be stolen _by middlemen_ , since anyone stealing aid that goes directly to individuals without going through middlemen is not a middleman.

Whether it is less likely _to be stolen_ \-- or even whether it is less likely to be stolen _by the government_ \-- is a completely different story.

</comment></comment></comment><comment><USER14> A similar research based on the land lotteries in Georgia in 1832 and in Oklahoma in 1901 showed that outright increases in wealth (i.e., winning the lottery) had little or no effect on generational wealth. There was also another similar research on the land lotteries which showed negative effect on generational wealth.

[http://www.stanford.edu/group/SITE/archive/SITE_2010/segment...](http://www.stanford.edu/group/SITE/archive/SITE_2010/segment_5/segment_5_papers/bleakley.pdf)

</comment><comment><USER15> The only way countries have /ever/ developed is by the production of value, products that a market wants to buy, usually an export market. Handing out free money doesn't help to achieve that goal. It just perpetualtes dependence.

It seems to be the "new hip thing" within the aid-industrial complex, though. I hope it will not do too much damage to these societies, like many of the previous "effective forms of aid" did.

<comment><USER16> I think the argument is that initial capital can jumpstart that production of value. If you spend 10 hours a week maintaining your straw roof, and then someone buys you a metal roof, you can now spend those 10 hours a week on an exportable trade/product.

<comment><USER15> I know that argument, but it is incorrect.

Production needs to be efficient in order to compete. Efficiency needs knowledge. These "groups of poor" lack that knowledge. And the amount of free money is way to low to produce anything with enough surplus value. How many unskilled carpenters, metal workers, and hair stylists do they need? I am currently in Kenya, and the amount of barber shops is amazing.

Production of value is stuff that a country can export, to earn hard currency that can buy knowledge to increase the country's production efficiency. Like Taiwan did, and Korea, and Malaysia, and China, and any country that has ever successfully developed in the past 70 years.

But the aid curse will not allow it, unfortunately.

<comment><USER17> I think both these explanations are missing that there are _many_ factors behind successful economic development, and increasing one factor of production will help if it is the limiting factor, but hurt if it is already abundant.

If you give money to people who already have technical know-how, a willing market, a solid distribution network, and a stable legal system but just lack access to capital, it will usually have very good returns. If you give it to people who have none of these, it will get spent on whatever good happens to be available, usually booze. If you replace the government of a country that has capital, an educated populace, and solid infrastructure but suffers from endemic corruption and lack of solid legal foundations, you will probably also help spur economic development.

What I wish more poverty-alleviation problems did was focus on identifying and eliminating bottlenecks to economic growth. The casual American readership loves to think there's one solution and then loves to argue over what it is, but I don't think it works that way. Poverty is complex; the reason that inner-city Baltimore is poor is very different from the reason Kenya is poor, which is different from why rural China is poor.

</comment></comment></comment></comment><comment><USER18> This is only "surprising" to those who think they know how other people should live. I've always favored this approach (a minimum income, or negative income tax .. whatever you want to call it) as a replacement to all other forms of welfare.

If I am to spend my tax money on those in need, I do not want more than half of it going to upper middle class bureaucrats and middle class administrators.

<comment><USER19> Exactly, the idea that someone should buy food for their kid rather than a big screen TV is extremely paternalistic.

<comment><USER20> The idea that people _need to be told_ to buy food for their kid rather than a big screen TV is paternalistic, yes.

<comment><USER21> Sadly, some people absolutely need to be told to buy their kid a jacket vs. a large bag of cocaine.

<comment><USER22> I think this is feeding into a prevalent and false narrative that persons in poverty are all drug addicts or welfare queens.

Christian Parenti really sums it up well when he describes American views on poverty in his book, The Soft Cage:

"In a society that denies the true causes of poverty—low wages and structural unemployment—the poor necessarily show up as objects of mystery to be examined, measured, interrogated, and indexed, or as James C. Scott would put it, made "legible." In a society that hides the real mechanics of exploitation and sees all social phenomena through the lens of individualism, it is assumed that the poor—their genetics, their habits, or their culture—must be the true cause of poverty."[1]

Specifically with respect to your point about drugs:

"Reports such as the National Survey of Drug Use and Health suggest drug abuse among welfare recipients is hardly widespread. Many states have tried drug testing for welfare recipients with practically nobody testing positive. In Arizona, for example, in 2012, after three years and 87,000 screenings, one person had failed a drug test. Utah's drug screening program spent $30,000 on testing and only 2.5% of recipients turned out positive for illicit drugs. Florida's program had the same results.

"In all cases, the testing -- which assumes all welfare recipients are druggies -- cost much more than the savings in welfare payments."[2]

We need to stop acting paternalistically toward the poor and, instead, treat them as people who are capable of making their own decisions.

[1] [http://openlibrary.org/books/OL7593829M/The_Soft_Cage](http://openlibrary.org/books/OL7593829M/The_Soft_Cage)

[2] [http://www.cnn.com/2013/09/30/opinion/granderson-michigan- we...](http://www.cnn.com/2013/09/30/opinion/granderson-michigan-welfare- bill/index.html?hpt=hp_bn7)

<comment><USER23> This is silly - the poor are not unemployed, structurally or otherwise. To be unemployed one must be looking for work, which most American poor are not.

[http://www.bls.gov/cps/cpswp2011.pdf](http://www.bls.gov/cps/cpswp2011.pdf)

Your source [2] also disagrees with you. When Florida implemented drug testing, they spent $46k to identify 108 drug users (presumably taking them off the welfare rolls). Unless welfare costs less than $425/person, that's a net savings. Further, according to the article linked to by [2] ([http://usatoday30.usatoday.com/news/opinion/editorials/story...](http://usatoday30.usatoday.com/news/opinion/editorials/story/2012%E2%80%9403%E2%80%9418/drug- testing-welfare-applicants/53620604/1)), the actual number in Florida is closer to 2000 people since 2000 people withdrew their welfare applications when they reached the drug testing stage.

(The comparable number in Utah was $2000/person, if we assume Utah's program had no deterrent effect whatsoever. Arizona's program seems less effective, likely because the drug tests were easy to avoid - just don't tell the welfare clerk you do drugs and you can skip the test.)

<comment><USER24> That pdf says nothing about who is or is not looking for work.

<comment><USER23> Let me quote the first paragraph, which you apparently didn't read:

 _...46.2 million people...lived below the official poverty level...10.4 million individuals were among the "working poor" in 2011... The working poor are persons who spent at least 27 weeks in the labor force (that is,_ working or looking for work _)_

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER25> I've only read the article and not the underlying paper, but it seems to be saying a $400 grant yields an average annual return of 40% - it would seem that would make it viable as a loan scheme rather than a grant scheme (maybe in terms of a loan that automatically gets written off after X years so it's a pseudo-grant).

It's important to note also that they're using the group effect that are also popular among microlenders, in that the grants are made to groups of individuals so you'll have some degrees of the individuals checking up on each other.

</comment><comment><USER26> It's all about state of mind. People who actually want to make a living, start businesses, create wealth, and live responsibly VS those who just want to be parasites. Attitude is what matters...

<comment><USER27> Use of funds makes all the difference.

Sometimes, a person needs a little push - or some initial help to get off the ground.

What are your views on all the entrepreneurs seeking funding - would you consider them parasites?

</comment></comment><comment><USER28> Kiva.org anyone? I"m shocked this hasn't come up in this thread

</comment><comment><USER29> I remember there was an article on HN not so long back about why poor people dont trust banks. Well, without bank accounts how do you process billions of dollars of micro-cash payments ?

Actually, this is the biggest reason for the build out of the Aadhaar project or the Indian biometric ID project. It is less for reasons of trying to track the common citizen (although I dont doubt for a moment, it will come to be used like that), but to ensure credible, direct debit of cash to the poor.

</comment><comment><USER30> I wonder if this could be applied to rich countries: give $500/month to each adult citizen. No questions asked. Unlike many existing programs for the very poor ([http://en.wikipedia.org/wiki/Revenu_minimum_d'insertion](http://en.wikipedia.org/wiki/Revenu_minimum_d'insertion)) it would not dissuade them from working (if you work you just earn more) and would be really easy to administrate (there are no criteria).

<comment><USER31> Wouldn't that just cause inflation?

<comment><USER30> Not if you finance it through taxes and elimination of other programs for the very poor like food stamps.

<comment><USER31> It seems to me that if everyone has an extra $500, the likely result is rent, etc. rises to compensate, and you wind up with essentially the same social situation just with all the prices offset slightly.

If you give everyone $500 and then take $500 back from most people in taxes that just seems like you're shifting around the conditional evaluation of the necessity of aid to the IRS instead. It's still conditional aid, it's just more obscure how it works.

</comment></comment></comment></comment><comment><USER32> I wonder if requiring applicants to "form a group with others in their village and submit a proposal showing how they planned to use the money" had anything to do with their success. It's not like they just dropped money out of a plane. And the fact that these grants were funded by a World Bank loan seems to undercut the headline even more.

</comment><comment><USER33> Just from the headline, I thought this would be an Onion article..

</comment><comment><USER34> The one-time grant model seems like it could be important; you don't develop the whole cargo cult dependence when it is a one-time windfall only.

<comment><USER35> There's always the risk that one of the recipients will become so successful that they start doing this themselves... ;-)</comment></comment>


Ask HN: If I gave you $20.00 US, What would you buy? - <AUTHOR> If I gave you $20.00 US, What do you buy or subscribe to online? <comment><USER2> I'd just put it in the bank to pay for the last 10 minutes I spent reading this thread and thinking about what I would spend only $20 on.

</comment><comment><USER3> Beer.

[Edit: Sorry, I only read the title. I would probably not buy beer online.... so... I dunno. An ebook?]

</comment><comment><USER4> I'd donate it to Aaron Diaz, in thanks for his work on <http://dresdencodak.com>.

<comment><USER5> Don't miss the art blog he just started, <http://dresdencodak.tumblr.com/> Only 2 days old and already worth the money.

</comment></comment><comment><USER6> I would buy a months worth of VPS over at linode.com, except that I already have one.

So my second choice would be a book on marketing, which I am guessing I would have to get used, which is no problem as they are usually the absolute best bargin.

</comment><comment><USER7> Well, in reality, I would use it to buy food. Money is tight.

If we're talking some sort of online-only credit, I'd actually like to donate more to a number of podcasts I enjoy (escapeartists.net, drabblecast.org, starshipsofa.com). They work on a lot of productions that enrich the life of my mind.

</comment><comment><USER8> 20 lottery tickets.

</comment><comment><USER9> The man in the high castle and Ubik by Philip K. Dick. They're next on my wishlist and I've already spent my book budget for this month.

If that's not an option I'd donate it to the development of Mongrel2.

<comment><USER10> To get an appreciate for Dick's bizarre late stage mysticism, make sure you read Valis too.

</comment></comment><comment><USER11> If it has to be online, I would order some intelligentsia coffee. If not online, I would go to my local cafe and... buy some coffee.

Yes, I am an addict.

</comment><comment><USER12> Bicycle fuel for the commute: a week's worth of healthy lunches. I'm living on high-sodium crap until payday.

</comment><comment><USER13> Just yesterday there was a similar thread on AskReddit: "What is the coolest thing I can buy on the internet for under $20?" ([http://www.reddit.com/r/AskReddit/comments/cqr6x/what_is_the...](http://www.reddit.com/r/AskReddit/comments/cqr6x/what_is_the_coolest_thing_i_can_buy_on_the/))

Personally, my vote goes to the TV-B-Gone. It's a small device that runs through all the common IR codes for turning TVs off when you press a button. ThinkGeek sells them for $20, but the "hacker" version ([http://www.adafruit.com/index.php?main_page=product_info&...](http://www.adafruit.com/index.php?main_page=product_info&cPath=20&products_id=73&zenid=4bfe5b81175bec694252282bf700043a)) runs for 50 cents less ;).

</comment><comment><USER14> Two months of the International Herald Tribune for my Kindle. The subscription cost is half that of the New York Times, but the content is virtually identical, with more of an international focus.

I enjoy reading on my Kindle to reading on the computer. No distractions, and much less eyestrain.

</comment><comment><USER15> Honestly, ice cream and I'd go watch Inception. Been living on a budget so both are out for now, and I have all the programming books I need right now.

</comment><comment><USER16> A programming book from my wishlist: <http://amzn.com/w/HWZ6Z22CY8TU>

</comment><comment><USER17> I would put it towards buying a ZipIt[1], which I would then use for web browsing (elinks), coding (vim) and maybe even DOS gaming (DosBOX). I like that it's hackable, and I like that it's affordable--unlike an iPod Touch or Android device :/

[1] - <http://linux.zipitwireless.com/>

</comment><comment><USER18> Not sure what you are really asking. In practice, stuff that I buy online that does not result in a physical object turning up at my door are (in no particular order):

1\. eBooks

2\. iPhone apps/audiobooks

3\. Freemium subscriptions

4\. "Donate" buttons

Now if you are saying "here's $20, do something with it that you wouldn't do with your own money", I have no idea what I would do with it.

</comment><comment><USER19> A copy of Lomby Zombie - <http://www.wargamedownloads.com/item.php?item=762>

And a Pizza from Papa Johns -<http://www.papajohns.com/index.shtm>

Last buck for the tip (or tax on the pizza)

</comment><comment><USER20> I'm thinking of trying NearlyFreeSpeech.net - I'd been paying about $250/year for shared hosting that was so-so quality, and after I closed down a couple projects I don't have the traffic that I'd need lots of mediocre quality hosting. That's what I'd get online.

Offline, rice and coffee.

<comment><USER21> I created a small website which I hosted on NearlyFreeSpeech.net because of their flexible pricing. I put 15$ in my account and got 14$ after the deduction of $1 as their fees or something.

It's been over 3 months now and I still have $2 in my NFS account while the site has made me over $280 in Google Adsense and $30 in Amazon commissions.

I can't think of any other web host for a simple static HTML pages site.

</comment></comment><comment><USER22> A megaupload / rapidshare premium account or would put it into advertising

<comment><USER23> if you're running a scraper this is probably some pretty super efficient information/$ and I'd probably do the same

otherwise, into my paypal account for etsy/ebay

</comment></comment><comment><USER24> <http://gettingreal.37signals.com/> I feel bad for getting the ebook with a "getting real filetype:pdf" google query just today.

</comment><comment><USER25> Chipotle! - carnitas burrito and some tacos.

That's assuming I read that right: "buy" and "subscribe online" are separate phrases. If I have to buy it online, then a tuner/metronome combo.

</comment><comment><USER26> Likely something from iTunes. Either music or an iPad app.

</comment><comment><USER27> BP shares for a few months. Then see what I could buy :)

<comment><USER28> The last time BP sold for sub-$20 was in 1994.

</comment></comment><comment><USER29> I'd put it towards a magazine subscription - probably renewing I.D. (<http://www.id-mag.com/>)

</comment><comment><USER30> Bandwidth and some outsourced coding.

Edit: oops, I read it as $2000 not $20. With $20 I would buy both of us a fast food meal, or maybe a few rounds of pool.

</comment><comment><USER31> I would get a Manning ebook: <http://manning.com/>. Probably PostGIS in Action.

</comment><comment><USER32> Double it and donate $40 to Khan's Academy.

</comment><comment><USER33> The Unix Programming Environment (Prentice-Hall Software Series)

The cheapest offer on amazon.com is $20 including shipping costs.

</comment><comment><USER34> I'd give $10 to each of my two daughters.

</comment><comment><USER35> I'd put it towards my business registration costs. Waiting to hear back about my name approval request.

</comment><comment><USER36> Cyberspace: I'd purchase the last 20 songs I bookmarked on Pandora.com.

Meatspace: I'd go play skeeball with my wife.

</comment><comment><USER37> Slightly outdated textbooks, or (if online product/service only) 250 pages of documents from PACER.

</comment><comment><USER38> Chicken McNuggets because someone just made me hungry for them.

oh has to be online? umm... some book.

</comment><comment><USER39> Donate to a couple of Android devs. Cyanogen and probably the dev of LauncherPro.

</comment><comment><USER28> Adword ads.

</comment><comment><USER40> A 'Better Bottle' from Camelbak (they are simply improving the famous wheel)

</comment><comment><USER41> Probably something on Steam.

</comment><comment><USER42> A twelve pack of Blue Moon.

<comment><USER43> Or the Canadian Version, Rickards White. Kinda not as cool as Blue Moon as a brand.

</comment></comment><comment><USER44> 1 YHOO

</comment><comment><USER45> Hosting, github or domain.

</comment><comment><USER46> I'd probably end up buying > $20 worth of stuff on Amazon.

</comment><comment><USER47> I'd get a logo created over at 99 Designs for my side project.

</comment><comment><USER48> They call it "beer money" for a reason - that's what I'd buy.

<comment><USER49> If I gave you $20.00 US, What do you buy or subscribe to _online_?

<comment><USER50> <http://www.aleinthemail.com/index.html>

</comment></comment></comment><comment><USER51> A wordpress theme, or extend my last.fm subscription.

</comment><comment><USER52> Monthly subscriptions to a few video/audio webcasts.

</comment><comment><USER53> Parts for a reprap.

</comment><comment><USER54> Aqua Sphere Kalman swimming goggles (Amber).

</comment><comment><USER55> more friends. ;)

</comment><comment><USER56> A romantic dinner for me and my girlfriend.

</comment><comment><USER57> A domain name and some hosting.

</comment><comment><USER58> A month of private SVN storage

<comment><USER59> Unfuddle has unlimited SVN repos for free.

</comment></comment><comment><USER60> ooh. either winnie the pooh or the jungle book dvd for my daughter :)

</comment><comment><USER61> I'd invest in agriculture

</comment><comment><USER62> Donate to Gigapedia.com

</comment><comment><USER63> Something for the kids.

</comment><comment><USER64> Music from iTunes.

</comment><comment><USER65> sun block, coconuts, and a bit of gasoline

</comment><comment><USER66> I'd send it to the ASPCA. Dogs rule!

</comment><comment><USER67> Beer!</comment>


Peeking Inside DNNs with Information Theory - <AUTHOR> https://medium.com/syncedreview/peeking-inside-dnns-with-information-theory-27ca65063d38 <comment><USER2> The paper in question is a bit controversial, and the debate around it should've been summarized more instead of just presented as Word of God. For example, it's unclear that you really need lossy compression given that there are _fully invertible_ CNNs (ie CNNs you can run backward to get back the original image input).</comment>


Ask HN: I'm interested in moving to Singapore as a dev, I have some questions - <AUTHOR> I'm super interested in relocating to Singapore sometime in the next 1-2 years and I have a few questions:
1. I see a lot of salary info, but could you give me a good idea of the salary I could expected as an early career (2-3 experience) developer?
2.I'm a graduate of a top-tier American CS program and currently working for a Big 5 company -- do these things mean anything there?
3. What would you say is the ROI (both socially and professionally) of learning Mandarin?
4. Are women software developers respected equally there/will I run into any issues?
5. (Expats with kids) -- have your kids had any trouble making friends?
6. What is the work culture like?
Looking for answers from both Singaporeans and current/former expats (except for #5).
Thank you! <comment><USER2> [https://www.hrw.org/world-report/2015/country- chapters/singa...](https://www.hrw.org/world-report/2015/country- chapters/singapore)

I'd be wary about taking my child to live in countries where she will enjoy substantially fewer freedoms - especially when the government hates dissent and solves lots of problems by savagely caning people. Even if you're not the dissenting type it has already poisoned every relationship you and your child could have there.

        They are trained to use their entire body weight as the
        power behind every stroke instead of using only the
        strength from their arms,[20] as well as to induce as
        much pain as possible. They can swing the cane at a
        speed of up to 160 kilometres per hour.

[https://en.wikipedia.org/wiki/Caning_in_Singapore](https://en.wikipedia.org/wiki/Caning_in_Singapore)

<comment><AUTHOR> First of all, my child is only 8 months old, so I don't think he will be getting caned.

Secondly, the reason I am interested in Singapore is that it is a very diverse country, with a lot of different ethnicities and religions living tolerantly side by side. It also has wonderful social programs, friendly people. It's incredibly safe.

Let me put it this way: where I live now in the US, people are protesting because of police brutality, especially against black people. The parks are full of discarded hypodermic needles so I will be scared to let me baby play in them. The streets are full of homeless people, included mentally ill war veterans, who are just left outside to die.

Sure, Singapore canes people. And I love America, but it is not exactly Disneyland. I would like for myself and my family to experience a different place, warts and all.

<comment><USER2> The whole world is diverse and almost everyone on the planet is friendly, happy etc, humanity is collectively trending towards harmony and happiness by _abandoning_ institutional violence and employing more appropriate solutions for social issues.

The reason you won't see those needles, addicts, mentally ill homeless etc is they get executed.

If you anticipate your son going to school there he will probably be caned.

[https://www.reddit.com/r/singapore](https://www.reddit.com/r/singapore) might be a good resource to explore. Note the hilarious post about the impact on eg, Pokemon Go.

<comment><AUTHOR> >"He will probably be caned"

[citation needed] because it looks like they only cane about 2500 people a year, and can't cane people under 16 unless they get tried as adults.

I feel like you are exaggerating -- like saying that because the US has capital punishment, and sometimes people get convicted wrongly, moving here will mean that you will get executed.

<comment><USER2> That's the prison system. Caning is also a heavily supported and pervasive component of their education system.

[http://www.corpun.com/counsgs.htm](http://www.corpun.com/counsgs.htm)

I get the disbelief - I can't imagine anyone caning my daughter either. Here in Costa Rica nobody is legally allowed to hit her. As a child in Australia lots of teachers and principals were legally enabled to hurt me. Some parts of the world lag way behind in basic human decency and rights and cling to violent solutions even when today we know they're ineffective - my state ditched such punishment before I was a teenager. If you moved to parts of the Middle East you could take your boy to public beheadings ... by governments, not just ISIS.</comment></comment></comment></comment></comment>


Drop Caps and Design Systems - <AUTHOR> https://product.voxmedia.com/2019/6/17/18524029/the-ballad-of-drop-caps-and-design-systems <comment><USER2> Very interesting read, aside from the issue at hand, I was really drawn to how they pulled off this kind of change in a giant org with many heads. Routinely, the root issue is easily addressable, however, it's a different story when it's something that's cross org. Usually you hit a wall and can't move forward without a consensus and some kind of org wide champion.

At the end of the day the process this team followed has all the hallmarks of a great culture (-- perhaps another article?). I'm curious what kind of management by-in was required, or if this was strictly driven by engineering and design.

God -- It really shows I've been in an enterprise for far too long. :,)

</comment><comment><USER3> Breaks normal in-browser search, at least for me. Since dropcap is an established layout element, maybe it should be a style property instead, so that the browser can render it correctly and also allow for search.

<comment><USER4> I don't think it needs a new style. [Edit: I'm wrong, see reply below]. There is a CSS pseudo-element ::first-letter, which you can format and align as you wish. In the article they try to use this, but run afoul of the fact that different rendering engines disagree on how exactly it should be converted into a (CSS) box. In my experience you can get a lot further without having to use spans, but I also couldn't make it perfect.

I suspect it's just ultra low priority for folks making rendering engines. It doesn't make a lot of sense for web typography, and to me looks just downright daft if you're not going to pull in and accentuate the start of the first line, or if you're going to separate your paragraphs with blank lines. My personal feelings only of course, but it feels like a bastardisation between different eras of typography.

<comment><USER5> :first-letter doesn't actually suffice to make good initial letters, either as implemented or as spec'd.

The initial-letters CSS property (maybe to be renamed?) is the future solution to this, and that should work fine with search. See [https://drafts.csswg.org/css-inline/#initial-letter- styling](https://drafts.csswg.org/css-inline/#initial-letter-styling)

<comment><USER4> Can you say more what you mean by 'doesn't suffice'? There are certainly some forms of typographic initial I know it can't do. But if it worked consistently, it would be sufficient to achieve the effect that the article is attempting, wouldn't it?

Thanks for the link. I had no idea it was an active proposal.

<comment><USER5> Without knowledge of the fonts used, you can't get both ascender line and baseline aligned with respective lines of content, which is the traditional way of doing drop caps.

Sure, with web fonts and assumptions that the font always successfully loads and covers all graphemes in the text you can hardcode lengths to achieve proper alignment, but that's still a bit fragile.

<comment><USER6> The implementation in the article still used hard-coded lengths, perhaps this could have been fixed without the extra markup after all.

</comment></comment></comment></comment></comment></comment><comment><USER7> I'm a fan of drop caps as a visual element -- they, along with a bolded lede line, very much help draw the eye to section starts, in a way which is very nondistraction (IMO).

A recent example, adding drop caps (and a number of other styling changes) to unv.is:

[https://mastodon.cloud/@dredmorbius/102329333215634483](https://mastodon.cloud/@dredmorbius/102329333215634483)

Because I'm restyling a page, that's restricted to CSS-only methods, which for that site works marvelously. And on the principle of divorcing content and presentation, it appeals strongly.

But on Wikipedia/Mediawiki, attempting to add drop-caps + bold lede-line results in a very annoying sift of the text offset by the drop cap *merely by defining a selector for ::first-line (Firefox/OSX):

[https://mastodon.cloud/@dredmorbius/102329661015728246](https://mastodon.cloud/@dredmorbius/102329661015728246)

Somewhat maddenning.</comment>


My application ran away and called home from Redmond - <AUTHOR> https://medium.com/sensorfu/how-my-application-ran-away-and-called-home-from-redmond-de7af081100d <comment><USER2> I think the key quote here is

"This opens interesting data leak vector for attacker and also includes some privacy concerns. It is quite common that even in isolated environments, many of the Microsoft IP address ranges are whitelisted to make sure systems will stay up to date. This enables adversary to leak data via Microsoft services which is extremely juicy covert channel."

As a user, you can just disable automatic sample submission. In fact I'm pretty sure you can set it during installation, as I've never had to go through the settings to disable it, but it's still disabled on all my installations.

But the question is, from an adversary perspective, does your victim have it disabled?

Most likely they won't, so you can use Microsoft as a mule to exfiltrate data from otherwise firewalled victims.

<comment><USER3> > you can use Microsoft as a mule to exfiltrate data from otherwise firewalled > victims

This is actually a smart idea. Make your spyware collect & encrypt data into a (new and unknown) binary and execute it, relying on the fact that Microsoft will exfiltrate it for you. When that binary itself is run (within MS' premises) it will then reach out to you with its embedded data.

<comment><USER4> Yet another reason I'm reluctant to upgrade to Windows 10. Too many buttons and toggles to turn off to arrive at a PC that functions the way I expect it to, and an update mechanism that's likely turning new ones on faster than I can spot them.

<comment><USER5> This is a Windows Defender thing, not a Windows 10 thing.

Windows Defender on Windows 7 also submits previously unobserved binaries to Microsoft for the same reason.

Go ahead, blame Win10, though. A non-zero number of people will take your comment to heart and believe that you knew what you were talking about with their entire soul, without seeing my comment.

I am so tired of seeing communal ignorance on this topic. People believe whatever bullshit they want, if it fits the narrative they are trying to sell.

<comment><USER6> >This is a Windows Defender thing, not a Windows 10 thing.

So Windows Defender isn't bundled as a part of Windows 10?

<comment><USER7> > So Windows Defender isn't bundled as a part of Windows 10?

It was also bundled as part of Windows 8.1, Windows 8, Windows 7, and Windows Vista on top of being available as a free download for Windows XP (and even 2000 during the beta phase).

The current form, after the Microsoft Security Essentials package was merged in, didn't come about until Windows 8 but Windows Defender as a product dates back to Microsoft's purchase of GIANT Software.

Either way you call it, XP or 8, saying Defender is a Windows 10 thing is like saying Firefox is an Ubuntu 19.04 thing. Sure, Ubuntu 19.04 does bundle Firefox, but so did many versions prior.

\---

It's also worth noting that almost every antimalware product has an option to submit unknown binaries for analysis, and almost every one of those either enables it by default or very strongly suggests that you do so during setup to the point that I'd imagine most installations that aren't managed under corporate policy are submitting samples.

</comment></comment></comment></comment></comment></comment><comment><USER8> From a copyright law perspective, this seems wild. Microsoft is downloading and running binaries from entities that may have never given Microsoft license to do so, including Microsoft's competitors. All based on a permission setting configured by an unrelated third party (the user).

<comment><USER9> > never given Microsoft license to do so

It's possible that they don't need it. There are fair use exemptions for reverse engineering and automated analysis. These may be the legal basis on which anti-malware research can be conducted.

<comment><USER10> Indeed, there have to be exceptions like this. Otherwise malware authors could sue AV companies for infringement, which don't seem to fit the intention of IP law.

<comment><USER11> > Otherwise malware authors could sue AV companies for infringement, which > don't seem to fit the intention of IP law.

'You may sue the AV company for $1 million; users who suffered from your malware will civilly sue for $100 billion, and the government will charge you with crimes and put you away for a decade. Your move.'

<comment><USER12> A tangent:

There's this fascinating (to me, anyway) line between "viruses" (including worms, Trojans, and similar malware) that antivirus programs will tackle, and adware/spyware that they usually don't.

The difference between the two is whether it not there's a corporation publicly taking credit for the program and suing antivirus companies for defamation over calling it a "virus".

Adware/spyware is limited in distribution methods and payload types by the letter of the law, but otherwise the two classes are functionally identical.

</comment></comment></comment></comment></comment><comment><USER13> If this is Microsoft's idea of performing a security function, I have to assume that submitted executables are also going into a giant database/archive that can be turned over to the three-letter agencies with a single National Security Letter, complete with any secrets embedded therein.

Like Bo Burnham says, I guess I should lower my expectations a lot.

<comment><USER14> It's already happening.[0]

Marketplace Hansa was running Bitdefender, which pwned them to Europol.

> Europol has been supporting the investigation of criminal marketplaces on > the Dark Web for a number of years. With the help of Bitdefender, an > internet security company advising Europol's European Cybercrime Centre > (EC3), Europol provided Dutch authorities with an investigation lead into > Hansa in 2016. Subsequent enquiries located the Hansa market infrastructure > in the Netherlands, with follow-up investigations by the Dutch police > leading to the arrest of its two administrators in Germany and the seizure > of servers in the Netherlands, Germany and Lithuania. Europol and partner > agencies in those countries supported the Dutch National Police to take over > the Hansa marketplace on 20 June 2017 under Dutch judicial authorisation, > facilitating the covert monitoring of criminal activities on the platform > until it was shut down today, 20 July 2017. In the past few weeks, the Dutch > Police collected valuable information on high value targets and delivery > addresses for a large number of orders. Some 10 000 foreign addresses of > Hansa market buyers were passed on to Europol.

0) [https://www.europol.europa.eu/newsroom/news/massive-blow- to-...](https://www.europol.europa.eu/newsroom/news/massive-blow-to-criminal- dark-web-activities-after-globally-coordinated-operation)

</comment></comment><comment><USER15> That's frankly alarming. They should be doing nothing but static analysis on those binaries and if they must execute them, then certainly not giving them any network access. That's without even touching on any IP law concerns and how an end user can be unwillingly complicit in such things...

<comment><USER16> Malware will pull updates and commands from the internet, if they didn't allow network access it would be near useless of a service. Attackers can make the binary pre-update look as innocent as they want.

</comment></comment><comment><USER17> Cool, is kind of like STUN but for networks with almost no connectivity.

Create a binary that sends info when started, submit it and wait for it to send the info from Redmond to your server.

Too bad there is no return channel or you could make IP over windows update.

<comment><USER18> Can you return a bit by deciding whether the executable gets flagged as malicious in response to the network activity? Can you set up a timing difference to send more than one bit per executable?

</comment></comment><comment><USER19> Could you do ssh -R and get shell on the testing machine in Redmond? Could make a nice tunnel for getting US netflix.

<comment><USER20> You could use it for crypto mining.

<comment><USER21> Assuming they only run it once, in one sandbox, that would probably not be particularly profitable.

<comment><USER22> Especially if there's a time limit on execution.

How many bitcoins can you mine in 30 seconds with a silly-low CPU cap?

<comment><USER23> _How many bitcoins can you mine in 30 seconds with a silly-low CPU cap?_

Somewhere in the region of $5e-9 worth of bitcoins.

</comment></comment></comment></comment></comment><comment><USER24> Advanced Threat Protection in Office 365 does this as well. It's a security feature that scans all linked files and attachments sent through Outlook.

A while back in my company we were deploying a client management tool (think TeamViewer but with more background management and software deployment capabilities). It needed to be very easy to install, so we just had a link to an EXE file that needed to be opened by our on-site IT departments. No extra steps were required.

Imagine our surprise when we suddenly saw machines popping up that were totally unfamiliar. These were machines connecting from a Microsoft IP, and all had random (but similarly formatted) usernames. They also provided random mouse inputs. We could even take control of these machines (!) but apparently they were short lived VMs that only existed for a few minutes before being recycled.

I contacted Microsoft support because at first we thought this may be a manual process (because of the mouse inputs and the user names), and we didn't want Microsoft employees seeing user data. Afterwards I also commented to the support person that someone may use these temporary machines as an attack vector (to use as an anonymous source, or in a DDoS attack), but the ticket was closed and if I recall correctly this was deemed "working as designed".

<comment> saiya-jin Anytime somebody here would like to claim that 'new' Microsoft is so much better and moral than 'old' one, I want to punch them in the face and start rant about Windows 10. Never met a single person, IT or not, who would not complain about it after moving from Windows 7.

Now I don't have to, I can just point to this thread and this comment.

This is pure arrogance - they know they have whole corporate world stuck with Office, even immediate move to Open source would take 20 years due to mostly Excel tight integration/expertise. We would all benefit from a good competition in this area...

</comment></comment><comment><USER25> _" Microsoft Windows 10 sends all new unique binaries for further analysis to Microsoft by default."_

Even if you're developing? Even if you're developing proprietary applications not for public use?

 _All your code are belong to us._

<comment><USER26> I mean it's either send all or send none, there is not really an inbetween way to do this method.

</comment></comment><comment><USER27> One of the main reasons we don't want anything to do with most recent Microsoft software at my office is concern that unspecified data we're working with -- which might include information obtained under NDAs, clients' trade secrets, sometimes personal data, etc. -- might get sent up to the mothership when one of the telemetry systems phones home.

People look at me as if we're crazy for worrying about this possibility, even though Microsoft of 2019 is notoriously vague about how any of this works and we could be flagrantly violating multiple laws and contractual obligations if it happened.

<comment><USER22> This. If they were at least up-front and said what it collects, how, when, and how to turn it off (or better yet, followed privacy best practice and turned it into informed opt-in), I'd be more eager to upgrade.

With that said -- there's still room for due diligence. I've built systems which handle personal data, and we pretty much started with Debian minimal and worked from there. To make damn sure, we stuck them behind a whitelisted firewall. They had access only to things we allowed them to see, and only in the direction we allowed.

</comment></comment><comment><USER28> > Microsoft Windows 10 sends all new unique binaries for further analysis to > Microsoft by default.

Interestingly, Apple's now doing sort of the opposite of this. Instead of having the _end-user_ 's computer upload all executables to Apple for analysis, Apple requires the _developer_ send them over and have them "notarized" before they run.

</comment><comment><USER29> Reminds me of the story about the NSA contractor who had pirated Office on their laptop, and when Kaspersky AV predictably collected a sample of the virus-infected keygen to its servers, the US tried to spin it as "Russian data exfiltration".

<comment><USER30> My recollection was that he had samples of NSA malware on his computer, that Kaspersky detected this, and that shortly afterwards he was directly targeted by Russian state hackers.

It was not so much that Kaspersky was acting as malware, but that they were sending tips to the FSB.

</comment></comment><comment><USER31> > Microsoft Windows 10 sends all new unique binaries for further analysis to > Microsoft by default. They run the executable in an environment where > network connectivity is available.

how did the author reach to this conclusion ? is it documented somewhere ?

<comment><USER32> He includes this screenshot[0], addressing the "send" part. The "run" part seems evident from the network traffic coming from MSFT.

[0] [https://miro.medium.com/max/334/0*g_3L3SxR4IYoBAxD](https://miro.medium.com/max/334/0*g_3L3SxR4IYoBAxD)

</comment></comment><comment><USER33> >Microsoft Windows 10 sends all new unique binaries for further analysis to Microsoft by default.

Wait, what? Let's say you write code that you compile using MSVC or MinGW or whatever to an .exe file.

Surely there is no way this gets automatically sent to MS?

<comment><USER34> That is exactly what happens. And it happens with any new executable. I noticed it when i was trying out how well rust works on windows.

<comment><USER35> I couldn't even get Rust to install on Windows!

<comment><USER34> rustup is your friend. install that, and then rust with rustup.

Edit: forgot link: [https://rustup.rs/](https://rustup.rs/)

</comment></comment></comment></comment><comment><USER36> > They run the executable in an environment where network connectivity is > available.

Why does MS _run_ unknown executables? On the other hand, should be a nice DDoS provider for blackhats...

<comment><USER37> Perhaps it's not running the EXE but instead identifying URLs in the code, cURLing them to see what it gets, and doing so to verify what they get isn't malware?

<comment><USER38> The software in question (called Beacon) is designed to call home. The binary has built-in cryptographic keys and it sends traffic encrypted. The receiving end, called Home, receives these packets, decrypts it and verifies the sender and after that gives an alert.

The exe must have been running to be able to generate the proper encrypted payload and send it to right place. In this case ports 20 and 1025 over TCP.

Disclaimer: I am one of the people who wrote the software.

</comment></comment></comment><comment><USER39> I was interested in this Beacon software, but then I found you had to contact them for pricing and I gave up on the idea.

Lesson: clear pricing keeps people like me in the game

<comment><USER40> I've found a lot more software startups and SaaS companies using this method lately.

When I actually am interested enough to talk to their salespeople (and they're straightforward enough with me) they've told me it helps them target whales more easily.

They can charge a lot more to a huge Enterprise and adjust lower for SMBs.

<comment><USER22> Of course the fun part of that is when the sales staff mistake a minnow for a whale.

Case in point, a large FTSE, NYSE, NASDAQ listed company with largely siloed internal departments, all with their own budgets. Your yearly budget might be $20,000 -- but they see the Inc. or Plc. with a turnover in the hundreds of millions and quote accordingly...

That situation makes for some fun sales calls.

</comment></comment></comment><comment><USER41> It would be a fun experiment to create a network probe executable that exfiltrates results back to you, and then push it to Microsoft in this way. I wonder how secure their test environment could be if it has Internet access...

<comment><USER26> I'd imagine the app is run in a DMZ and the internet FW blocks typical malware behavior once detected. After all the whole point of running it is to find if the executable is going to do these types of things so they'd be prepared.

</comment></comment><comment><USER42> > _Microsoft Windows 10 sends all new unique binaries for further analysis to > Microsoft by default._

That's not only a privacy concern; it's blatant copyright infringement.

</comment><comment><USER26> I'm surprised the number of people on HN that assume Microsoft's security group involved in actively trying to find malware by running unknown programs has absolutely 0 precautions that one of the programs they run would be malicious.

<comment><USER43> Microsoft does not exactly have the best track record with this.

[https://bugs.chromium.org/p/project- zero/issues/detail?id=12...](https://bugs.chromium.org/p/project- zero/issues/detail?id=1252&desc=5)

<comment><USER26> In what way is "had a RCE CVE" a track record that "Microsoft's security group involved in actively trying to find malware by running unknown programs has absolutely 0 precautions that one of the programs they run would be malicious."

I'm not talking about invulnerable software I'm talking about the comments assuming Microsoft doesn't expect __malware testing servers__ to run scanning or DDOS malware.

</comment></comment></comment><comment><USER44> It looks like you can manually upload submissions here:

[https://www.microsoft.com/en- us/wdsi/filesubmission](https://www.microsoft.com/en-us/wdsi/filesubmission)

This may be outdated, but you can also configure Defender to always prompt before sending:

[https://docs.microsoft.com/en-us/windows/security/threat- pro...](https://docs.microsoft.com/en-us/windows/security/threat- protection/windows-defender-antivirus/windows-defender-antivirus-on-windows- server-2016)

It would be interesting to set it to always prompt and see what triggers it. There must be some level of fingerprinting done on the client (hash of the binary? network activity, etc.) that can be used to compare against known threats.

</comment><comment><USER45> This shouldn't be hard to test.

Just create a native executable in your language of choice that connects to a hardcoded address of a server you have access to and try executing it on a windows machine with sample submission enabled.

</comment><comment><USER46> Also seems like a viable vector to DOS something - if Microsoft runs this on some sort of cloud infra with a fat pipe

<comment><USER47> I think that's less likely, if MS gets a thousand identical copies of a binary, they probably aren't going to bother test-analyzing more than one. There also might be some rate-limiting on what they'll do from a particular machine.

So your attack might require first controlling a swam of Windows 10 machines, in which case you might as well do it directly :P

<comment><USER48> Who said anything about identical binaries? It's trivial to make two completely differently obfuscated binaries that do the same thing. If it were possible to determine behavior by static analysis, they wouldn't need to run it...

</comment></comment></comment><comment><USER49> Ok, so if I compile an executable that pops up a screen with a picture I drew + lots of personal and medical information about me, and phones me whenever it's executed, and then just leave it on my machine only for it to phone home from Redmond, can I sue them for copyright, GDPR, HIPAA violations and whatnot? How good is their "new unique binaries" detection? Could I do the same with just a bunch of files wrapped in a good ol' self-extracting archive?

Seriously, what in hell? Like always, blatant violations of users in the name of "security".

<comment><USER50> I'm not sure how you would invoke HIPAA with no medical professionals involved. It doesn't just magically apply because you wrote down your own medical information.

<comment><USER27> You could replace HIPAA with GDPR again, since almost any medical information about an identifiable individual will constitute sensitive personal data that requires the stronger protections under that law.

<comment><USER51> Microsoft might claim it's a Legitimate Interest (recital 49 might be useful here, though I'm not sure it applies).

<comment><USER27> I suppose it could _claim_ that, but I suspect it would be a tough sell with the regulators if Microsoft is uploading large amounts of data the user probably didn't even know about _and_ some of that data turned out to include sensitive personal data.

<comment><USER52> Are many folks compiling sensitive personal data into binaries?

<comment><USER27> Presumably most people don't compile that sort of data into executables, but the situation seems to be unclear about whether other types of file might also be uploaded through similar mechanisms, and there also seems to be something going on involving MS executing the files and allowing remote connectivity, so the issue still seems relevant.

</comment></comment></comment></comment></comment></comment></comment><comment><USER53> It's not just executables. I once caught Microsoft Defender sending copies of sensitives files like places.sqlite out of my Firefox profile directory to Redmond. Needless to say, I disabled that feature permanently via local policy.

</comment><comment><USER54> I'm amazed they run these with internet access. I understand though that without it a malicious program may not run the same.

It probably also allows them to do some spying on networks used by malware.

</comment><comment><USER55> They probably limit the execution resources available or you would have yourself a free albeit unpredictable cloud execution platform for all your memory/CPU intensive processes.</comment>