Report: Microsoft is scrapping Edge, switching to just another Chrome clone - <AUTHOR> https://arstechnica.com/gadgets/2018/12/report-microsoft-is-scrapping-edge-switching-to-just-another-chrome-clone/ <comment><AUTHOR> This is pretty disheartening news. It just means Google will have more sway when it comes to web standards.

We really need more than just Mozilla. However the standards have gotten quite large.</comment>


Is Silicon Valley Dead? - <AUTHOR> http://davetroy.com/posts/is-silicon-valley-dead

<comment><USER2>
      Everybody says that the big draw to San Francisco
      is the weather. True, it can be pretty nice at
      times. But it can also be pretty miserable.

I tuned out a bit after reading this. San Francisco has terrible weather compared to Silicon Valley, and someone who doesn't know the distinction between the two cannot, in my opinion, be taken seriously when sounding the death knell of the entire region.

      Paul Graham said it best, "Silicon Valley is
      soul-crushing suburban sprawl."

I lived in Silicon Valley for 7 years and didn't find it to be particularly soul-crushing. It's a nice place to spend some time. It's a very nice place to raise a family, if you have one (I don't).

It's great that startups are springing up all over the world, but that doesn't mean Silicon Valley is dead. Silicon Valley doesn't have to lose for others to succeed.

<comment><USER3> oh, yeah. Well I live currently in Mountain View, and I find one of the most boring places in earth (SunnyVale and Cupertino are worse), if you are a single guy.

Just saying. The 20s are ment to have fun, get laid, drink booze, write some code, then go out again. You wont be 20some again, it is a once in a lifetime opportunity to enjoy life (and start something at the same time).

In here you are forced to live a suburbian boring life, even though you don't have kids.

If you are married and have kids, you probably don't have any time anyway, so boring is ok.

Everytime I go to work, I always think: Sigh, this place has such a great weather, but unfortunately it is wasted with this boring sprawling burbs.

<comment><USER4> You'll be shocked when you turn 30 that you can do all of those things in your 30's (and I suspect your 40's, 50's, and on...)

:)

<comment><USER5> thank you!

</comment></comment></comment></comment><comment><USER6> The way this article is written makes it sound like the author has recently bought into the Dave McClure pyramid scheme and he's supposed to tell 10 friends about the new, awesome system Dave has come up with.

Disclaimer: I'm not from the Valley and I haven't ever heard of Dave McClure. He may very well be a reputable fellow in the angel investing world.

<comment><USER7> He uses swear words a lot :)

</comment></comment><comment><USER8> This is just a horrible article where the author has no first hand clue of what he's talking about.

other startup communities can still thrive without the valley dying. If anything that means the valley has succeeded. I want to see the essence of the valley spread elsewhere.

So is there any way to prove that the valley is INDEPENDENTLY dying? Nope, because it's not.

</comment><comment><USER9> I can't figure out if this guy is an ignorant clown, a troll, or both. Ridiculous arguments, like the one where he says startups don't get any special advantage from the weather. Just because you're slaving away in a cubicle, doesn't mean your family won't enjoy the weather... and the great traffic on gorgeous highway 280... and the low crime rate... and the great schools... and Fry's... and San Francisco... etc., etc.

<comment><USER10> I always heard that one of the great advantages of the weather is that when you exit your cubicle it's likely to be good (see rmundo's comment), which is something I can assure you is not true of Boston (year around, at least).

In many parts of the country you have to plan your activities around the weather, at least for parts of the year; I gather that's so much the case for Silicon Valley.

</comment></comment><comment><USER11> "The reality is that the weather makes no f-cking difference if you are slaving away 26 hours per day on your startup;"

No, no, no, no. Good weather days should to be common enough that I won't feel deprived if I'm slaving in my office all day; it will be ready for me when _I'm_ ready to take a break.

</comment><comment><USER12> 3 words

Sand Hill Road.

<comment><USER13> One of the points of the article was that entrepreneurs don't need VC since it's become so much cheaper to do startups. Thus Sand Hill Road isn't as important as it was.

<comment><USER12> No he said its easier to get to market without VC it removes VC's from "early rounds". The need for VC to grow is still going to be needed for the vast majority of new businesses.

"This effectively removes VC's from the equation at these early rounds and turns things over to angel investors"

Even then the point still stands even angel money is still easier to get in Silicon Valley.

<comment><USER4> Those angels and Sand Hill VC's frequently invest outside of the valley tho.

</comment></comment></comment></comment><comment><USER14> It's funny, you read blog posts like this, and then you hear people like Richard Florida talk about how the future is concentration of knowledge, not distribution.

[http://www.theatlantic.com/special-report/the-future-of- the-...](http://www.theatlantic.com/special-report/the-future-of-the- city/archive/2010/05/the-path-to-recovery/56393/)

So who's right?

<comment><USER15> I don't think there is necessarily a contradiction here. The article doesn't say that knowledge is being distributed, rather that the creative entrepreneurial mindset of the Valley is being distributed. I have worked in software startups in the Valley, the UK, France, and Oregon for the past 15 years. I must say I would agree. But I think the author is exaggerating the adverse competitive effect on the Valley the emergence of new tech centers is having. I would like to see him give us some real evidence that the Valey is suffering from it. I doubt it is just yet. There is plenty of growth potential to go around for now...

</comment></comment><comment><USER16> No. First of all, a lot of startups still need to raise money. It may be cheaper now than in 1998 but it's still not cheap to pay 2-6 people for 6-24 months. And getting users and customers does not necessarily equal profitability.

What has actually happened in that there is a mismatch between investors and VC. In '98, many investors were MBAs who were willing to take VC investment on so-so terms because they wanted to eventually become VCs and they valued the connections. In '10, they want to take a lot less money (because they need less) on much better terms, and VC still hasn't adapted to that change.

But I cannot understate the value of having seasoned, risk-accepting, wanting- to-change-the-world investors and entrepreneurs. Silicon Valley has a singular advantage in this regard.

</comment><comment><USER17> All these "is Foo dead?" kind of topics are made to draw more attention than the usual, even though they don't make sense or matter much in the context of _now_

</comment><comment><USER18> No.</comment>


Last Year, the Flu Put Him in a Coma. This Year He's Getting the Shot - <AUTHOR> https://www.npr.org/sections/health-shots/2018/10/14/656290155/last-year-the-flu-put-him-in-a-coma-this-year-hes-getting-the-shot <comment><USER2> A co worker last year ended up in the hospital with the flu. He had been vaccinated. He was told by the staff that vaccinated people appeared to be harder hit, so he is unlikely to get a flu vaccine again. He's no antivaxer. Yet, information on how effective these vaccines are seems hard to get and politically sensitive.

The npr article states that weakened immune systems can put people at risk, yet the 1918 flu most severely affected those with the strongest immune systems. Many of the flu symptoms are due to immune response, and apparently that flu elicited a much stronger response and higher mortality amongst the healthy.</comment>


Ed-Tech Startup Pivoting to Online Homeschooling - <AUTHOR> Not sure that this is the right place to post this but I'm throwing it out there for feedback.
We've made a recent pivot to our education-tech startup by offering our robotics and coding curriculum to parents that are new to homeschooling their kids.
With rampant school closures, a few families have reached out to us asking for hands-on lessons that include materials and live instruction.
Is there anyone else out there with this problem?
Since this is new to us, we're giving away four 1-hr workshops for free for anyone looking to sign up a child (grades 4-12). We're just charging for the kit materials which we'll deliver to you. In return, we'd love your feedback to improve the experience.
Projects focus on beginners and advanced learners with activities ranging from building basic circuits to WiFi robots, synthesizers, and other electronics. Below is a link to receive more info or you can reach out to email@example.com if you have specific questions. Thanks all! :)
https://www.thimble.io/remote-learning-covid19/ <comment><USER2> Your best target audience for live instruction is probably going to be grades 4-6.

Older students will likely prefer to follow a recorded video or read from the tutorial manual.</comment>


Ask HN: How one finds contracting/consulting jobs at BigCo's? - <AUTHOR>

Hello,<p>There are people who do contracting for big companies (NetApp, IBM, Microsoft, etc...). How to find such positions? Part-time is as well rarity among engineering jobs for such companies. <comment><USER2> I've never done this and If you have never done it either maybe subcontracting for a larger consultancy firm might be a good place to start. Will get you in the right neighbourhood so to speak and get you talking to the right people and should be significantly easier providing you're good at what you do.

<comment><USER3> Interesting answer Phil. When you say larger consultancy firms do you mean firms similar to the size of Accenture?

<comment><USER2> Accenture is on the much larger end. I'd probably suggest if you're interested in pursuing a career on your own that you find a smaller boutique consultancy. You'll be closer to deals and have more insight in to how business is generated.

</comment></comment></comment><comment><USER4> I worked at Google as a contractor. I got my position through a consulting company (a small boutique one in this case). I got the impression that the bigger companies used contracting companies just because it was easier to manage. Fewer vendors to manage, bill etc.

<comment><AUTHOR> One thing that puzzles me, those big co's have tons of engineers. One might say that they've commoditized the software development. So how come they're unable to solve some tasks internally? I'm not talking about some very domain specific tasks, where it makes sense to consult/contract some experts/academics, but there are just regular engineers working as a contractors/consultants for them.

<comment><USER4> My department used contractors like myself to support legacy software. I think there are a few reasons for it.

1\. I know that hiring contractors was significantly easier than hiring full- timers. Fewer interviews, less setup time, less coordination with HR or internal recruiters. 2\. The other contractors used were supporting legacy software. 1-6 months onsite of full-time work and then limited remote support afterward.

3\. If you're paying top dollar and working for you has a large amount of prestige then you want to make sure that your engineers are working on the hard problems. Anything that's not related to that can and should be given to contractors.

To make sure this isn't abused, I think Google only keeps contractors on for 1 year with only a few exceptions

</comment></comment></comment><comment><USER5> 1\. Get well acquainted with managers and executives at as many vendors, firms, Fortune 500s and consultancies as possible.

2\. Demonstrate usefulness and a value proposition.

3\. Discreetly ask for work.

To be even more concise: be an outgoing, valuable individual who is not afraid to ask for work.</comment>


Spotify Is Crazy To Forecast 50 Million U.S. Users In A Year - <AUTHOR> http://www.sfgate.com/cgi-bin/article.cgi?f=/g/a/2011/07/08/businessinsider-spotify-is-on-crack-if-they-really-think-theyll-get-50-million-us-users-in-a-year-2011-7.DTL <comment><USER2> IMHO Spotify stopped being interesting when they had to drop their ad- supported all-you-can-eat free tier. That's what really drove growth in Europe and make it ubiquitous here in Sweden.

Now that that's gone, they're just another dime-a-dozen paid music streaming services that nobody wants to pay for.

edit: For anyone wondering what the big deal with Spotify is, is that it was completely free. Anyone could just download the app, and then listen to any song they wanted to, legally, completely free - there were just short ad breaks every couple of songs. This free legal option meant that there was zero reason to pirate music anymore, so everyone flocked to it.

If you paid €10/mo you got a higher bitrate, no ads, offline playing and access to the iPhone/Android apps. The pay option was attractive if you were going to have a party (ads are a turnoff in situations like that), or when you end up requiring the iPhone app since you don't have any music files to put on your MP3 player anymore since you've just been listening to everything on Spotify...

The record companies really hated giving away music (despite Spotify being a goldmine for them - Spotify is currently the #1 single source of income for record labels in Sweden, making them more money than any single retailer), so they had to kill it a couple months back (rumor has it they had to kill it in order to secure U.S. rights).

Without the completely free tier, they'll have a really hard time getting new users.

<comment><USER3> It never was completely free: there has always been a limit on the number of hours per month you could stream music.

Anyway, your analysis is wrong, because you think your usage predicts everyones usage pattern. It doesn't. I'm a happy paying subscriber and will stay one for a while to come. If I hear one new CD a month, it's already worth it. Even if I don't, I love being able to just legally browse and listen to almost any music I can think of.

<comment><USER4> Are you sure? When I tested it, early on, it was unlimited hours of streaming, with ads now and then.

<comment><USER3> All the time it was available in the Netherlands, the limit was something like 40 hours a month, as far as I recall.

</comment></comment></comment></comment><comment><USER5> So I keep hearing about Spotify, but as an American I've never had a chance to use it.

I use Grooveshark a lot though. What is Spotify offering over Grooveshark?

<comment><USER6> The biggest difference is that Spotify is curated content. On Grooveshark, if you search for an album, you may get three copies, each missing songs and improperly named. Spotify has one real release of the album.

<comment><USER4> In a lot of cases, three albums on Grooveshark beats the hell out of _none_ on Spotify.

<comment><USER7> Spotify is fully legal, Grooveshark is quasi legal and may not see another year.

<comment><USER4> What investment will you lose if they shut down?

</comment></comment></comment></comment></comment><comment><USER4> My one big gripe with Spotify is that they don't serve up a lot of the music I listen to (WARP-label), and it seems that all music before 2005 is either a karaoke or cover track – when I search.

It's just too limiting, for me at least.

<comment><USER8> I'd check again, they have a load of warp now. I also noticed all the Autechre albums are back on again. Things appear to be more like they were in the early days of spotify.

<comment><USER4> Boards of Canada too?

<comment><USER8> Yep. :)

</comment></comment></comment></comment><comment><USER9> So, this may mark me as an old fart, but um, does Spotify play The Beatles? If so, I'll switch from Rhapsody.

But yes, 50M users in a country of 300M does express a certain confidence.

<comment><USER10> Nope, no Beatles yet. Still exclusive (via legal means) to iTunes.

<comment><USER9> Thanks, that's good (sad) to know.

Right now, I use a combination of Rhapsody and Google Music to get The Beatles (from CDs I own and have ripped.)

<comment><USER11> While it's a fundamentally different approach -- Pandora has the Beatles.

I've been a Pandora One subscriber (no ads for $30/year) and I'm quite happy with it. Sometimes I do want _A_ song, but in general, outsourcing my playlist to their algorithms has worked out great.

</comment></comment></comment></comment><comment><USER12> what spotify has over its competitors is distribution through facebook [1]. this single factor makes the rest of their competitors numbers (and quite frankly their own numbers) more or less irrelevant. keep in mind, too, that it says "users" and not "paid subscribers"

[1] [http://blogs.forbes.com/parmyolson/2011/05/25/facebook-to- la...](http://blogs.forbes.com/parmyolson/2011/05/25/facebook-to-launch-music- service-with-spotify/)

</comment><comment><USER13> Yeah, it's crazy to think it will only be 50mm users in the USA, after people have been coveting this for so long, and Spotify has done so well in Europe.

<comment><USER14> If you read the article, it states that in 3 years, Spotify has only managed 10 million users. It's unlikely that they'll gain 50 million users (from one country) in one year, when they barely got 20% of that in three years from an entire continent.

<comment><AUTHOR> I agree completely with your sentiment, but it's important to note that US music consumption makes up, I believe, more than half of the worldwide market. So, in fact, the US is a larger market than all of Europe. That being said, 50 million registered users by some gorilla math, maybe. Real, active engaged, users - no way.

<comment><USER13> Yeah, I'm assuming the crazy math (5-10mm real users, the remainder being alternate accounts, abandonware, etc.) Plus, multiple devices per user, which you could be really crazy and count as unique users -- laptop, home, work, ht/game system, iphone, ipad each.

Plus, USA = "everywhere"; I'd assume if there were service in Europe and the USA, a lot of people in non-USA non-Europe would be VPNed or otherwise appear as US users for these purposes.

<comment><AUTHOR> I more meant anyone on Facebook who listens to a track streamed from Spotify while on Facebook and not having even been to Spotify's site or having downloaded any client, could be called a "user". 50 million people finally seeing real music integration on Facebook listening to a track or two doesn't seem unrealistic, but if that's what they call a user, they're being very generous to themselves.

</comment></comment></comment></comment></comment><comment><USER15> an FT.com article put paid subscribers at 1 million, 15% of their user base. They've just closed $100 million of funding. Based on the FT ratio the projections equate to 7.5 million paid US subscribers. They'll need to retain those customers to make a return and the market is very competitive. More crazy valuations.

</comment><comment><USER16> I saw the CEO speak at SXSW a couple years ago. I still can't figure out what the big deal is.</comment>


Facebook vulnerability 2013 - <AUTHOR> http://khalil-sh.blogspot.com/p/facebook_16.html check this article , and guess what !! facebook pays me nothing .<p>http://khalil-sh.blogspot.com/p/facebook_16.html <comment><USER3> Note to security response teams everywhere: Not all vulnerability reporters speak perfect English, nor are they all experienced in writing up details on how to exploit issues. It is your responsibility to obtain details from reporters, after the initial report, to avoid situations like this. Facebook should give a bug bounty here, due to their lack of due diligence in following up with the initial responses.

<comment><USER4> Yeah, what the hell were they doing responding "This is not a bug." without investigating or asking for more details? What the hell is the point of even responding to possible security alerts from the general public if you're not going to investigate?

<comment><USER5> I am curious to how many trash reports they have to sort through to identify real bug reports. Anyone care to comment?

<comment><USER6> Microsoft sifts through bogus security reports all the time. Raymond Chen posts the best-of-the-worst periodically.

Here are I couple I found:

[http://blogs.msdn.com/b/oldnewthing/archive/2011/12/15/10247...](http://blogs.msdn.com/b/oldnewthing/archive/2011/12/15/10247870.aspx) [http://blogs.msdn.com/b/oldnewthing/archive/2008/03/14/80801...](http://blogs.msdn.com/b/oldnewthing/archive/2008/03/14/8080140.aspx)

<comment><USER7> Yeah, but look at what he says in the first link:

 _Before contacting the submitter, we want to be sure that we weren 't missing something, but after looking at it from every angle, we still couldn't see what the issue was.

...Stumped, we contacted the submitter. "From what we can tell, the call to system takes place before you call the LoadKeyboardLayout function. Can you elaborate on how this constitutes a vulnerability in the LoadKeyboardLayout function?"_

</comment></comment></comment></comment></comment><comment><USER8> After watching the video, it looks like the exploit involves:

1) Getting the target user's userId. This used to be part of a user's profile URL but Facebook allowed people to choose a "vanity URL" quite a while ago, so they're no longer as visible. So, instead, the userId is obtained from a FB Graph API query.

2) The form that makes up the "post to newsfeed" has a bunch of hidden inputs. One of them refers to a "xhpc_targetid" and this is probably where the target userId is injected. It's normally set to the current user's id for a default newsfeed post. These values in the DOM are modified during the exploit using something like Chrome Developer Tools on-the-fly and the form is submitted.

If this is truly the case (and I haven't verified it myself) this means that the server side is not really checking permissions and just blindly trusting the client input. Reminded me of this recent ([http://arstechnica.com/information-technology/2013/08/how- ea...](http://arstechnica.com/information-technology/2013/08/how-easy-is-it- to-hack-javascript-in-a-browser/)) article about trusting client input.

<comment><USER9> _This used to be part of a user 's profile URL but Facebook allowed people to choose a "vanity URL" quite a while ago, so they're no longer as visible._

They're still visible in photo albums and the like. Far from hidden.

<comment><USER10> It's not really obvious though

<comment><USER11> If you're investigating Facebook exploits it's one of the first things you'd have to learn about.

</comment></comment></comment></comment><comment><USER12> The Social Network -

Ad Board Chairwoman: Mr. Zuckerberg, this is an Administrative Board hearing. You're being accused of intentionally breaching security, violating copyrights, violating individual privacy by creating the website, www.facemash.com. You're also charged with being in violation of the University's policy on distribution of digitized images. Before we begin with our questioning you're allowed to make a statement. Would you like to do so?

Mark Zuckerberg: I've... [Mark stands up to make his statement]

Mark Zuckerberg: You know I've already apologized in the Crimson to the ABHW, to Fuerza Latina and to any women at Harvard who may have been insulted as I take it that they were. As for any charges stemming from the breach of security, I believe I deserve some recognition from this Board.

Ad Board Chairwoman: I'm sorry?

Mark Zuckerberg: Yes.

Ad Board Chairwoman: I don't understand.

Mark Zuckerberg: Which part?

Ad Board Chairwoman: You deserve recognition?

Mark Zuckerberg: I believe I pointed out some pretty gaping holes in your system.

\----

The similarity is uncanny.

<comment><USER13> It's funnier when FB points to some fine print and acts like bigger douches then those administrator. I would've half expected FB to have engaged this person in a whole differrent spirit, with all the well publicized "we're cool & paying whitehat hackers" PR & new articles.

<comment><USER12> Exactly. The tables have turned.

</comment></comment></comment><comment><USER14> Jim Denaro, @CipherLaw on Twitter, a lawyer specializing in these issues and someone who has studied bug bounty programs, twerped earlier at me:

 _Paying out a bounty in that situation would be legally risky. Would advise against it._

Facebook's ToS forbid you to compromise other users accounts in any way. Its bug bounty terms require the consent of any accountholder used to search for bugs. It's also bound by California laws regarding breach notifications. And over the long term, it must retain the ability to enforce its own ToS. These are just the objections I can think of.

If you're going to participate in a bug bounty program --- and you should --- don't use non-consenting accounts to do it. This is a simple issue that's been blown out of proportion by message board pathology.

<comment><USER15> Don't pay the bounty for the bug then. Pay it for identifying the weak links in the security-reporting chain. The links that shrugged the bug reporter off, from the start; didn't have, at the very least, some boilerplate to guide the reporter; didn't have avenues or rules for non-English speakers.

For all we know, the reporter might have thought, "This will never work" or is not up to speed on or didn't understand the rules. Facebook certainly didn't help him, at every turn, including the last email "Sorry, l2p."

</comment></comment><comment><USER16> Hey folks - I work on security at Facebook (though not specifically the Whitehat program) and just wanted to let you know we're looking into this right now.

<comment><USER16> OK - so I work on a security team at Facebook and sometimes help with reviewing Whitehat reports. To be clear, we fixed this bug on Thursday. The OP is correct that we should have asked for additional repro instructions after his initial report. Unfortunately, all he submitted was a link to the post he'd already made (on a real account whose consent he did not have - <USER2> our ToS and responsible disclosure policy), saying that "the bug allow facebook users to share links to other facebook users". Had he included the video initially, we would have caught this much more quickly.

For background, as a few other commenters have pointed out, we get hundreds of reports every day. Many of our best reports come from people whose English isn't great - though this can be challenging, it's something we work with just fine and we have paid out over $1 million to hundreds of reporters. However, many of the reports we get are nonsense or misguided, and even those (if you enter a password then view-source, you can access the password! When you submit a password, it's sent in the clear over HTTPS!) provide some modicum of reproduction instructions. We should have pushed back asking for more details here.

However, the more important issue here is with how the bug was demonstrated using the accounts of real people without their permission. Exploiting bugs to impact real users is not acceptable behavior for a white hat. We allow researchers to create test accounts here: [https://www.facebook.com/whitehat/accounts/](https://www.facebook.com/whitehat/accounts/) to help facilitate responsible research and testing. In this case, the researcher used the bug he discovered to post on the timelines of multiple users without their consent.

As you can see at [https://www.facebook.com/whitehat](https://www.facebook.com/whitehat), in order to qualify for a payout you must "make a good faith effort to avoid privacy violations" and "use a test account instead of a real account when investigating bugs. When you are unable to reproduce a bug with a test account, it is acceptable to use a real account, except for automated testing. Do not interact with other accounts without the consent of their owners." Unfortunately, the OP did neither of those things. We welcome and will pay out for future reports from him (and anyone else!) if they're found and demonstrated within these guidelines.

<comment><USER17> _" As you can see at [https://www.facebook.com/whitehat](https://www.facebook.com/whitehat), in order to qualify for a payout you must "make a good faith effort to avoid privacy violations" and "use a test account instead of a real account when investigating bugs."_

I just looked at it, then switched Facebook to Arabic and the TOS is magically still in English (edit - and right aligned really badly as the page evidently expects arabic). If you demand that the TOS is followed by people who do not have English as a first language, try offering a translation.

This guy has done you all a service. The chances are that he may not have been able to clearly read the TOS that you wish him to abide by. He should get paid.

edit - hmm, was about to check the situation with other languages, however now all the buttons are in arabic so I stopped bothering after the fourth random page.

<comment><USER14> They can't pay people to violate their terms of use or to try to violate the privacy of their users. Even if they wanted to, they're probably not allowed to do that.

<comment><USER18> So if a security bug was discovered using methods that are against the TOS then the information about the bug is worthless for them and it's better to sold it elsewhere.

<comment><USER19> An argument could be made it wasn't so much the discovery of the bug but rather the _manner of reporting it_ that was a ToS violation.

<comment><USER20> The payment would ofcourse be for discovering the bug.

</comment></comment></comment></comment></comment></comment></comment><comment><USER21> I'm not sure how Facebook was supposed to know this was a vulnerability. If you look at the actual conversation it looks like Khalil is reporting the ability to post on other people's walls as a vulnerability.

In the first email, Khalil simply says that he can post to Sarah Goodin's facebook wall. He makes no mention of the fact that he and Sarah Goodin aren't friends.

The Facbook engineer replies that he is unable to see anything from the link that Khalil sent. This is because the engineer and Sarah are not friends.

Khalil responds with a screen shot of the post. Again, Khalil makes absolutely no mention that he and Sarah are not friends at all. In fact, at this point it would appear that Khalil is friends with Sarah, as he states that only her friends can see her wall. I guess he is able to see the post he made though.

At this point, Khalil decides that the only course of action is to go post on MZ's wall. How is that sort of escalation appropriate? By paying Khalil at this point, all you are doing is telling people that MZ's account is a an acceptable place to report vulnerabilities, which is a horrible precedent to set.

<comment><USER13> I'm surprised you're not taking him to task for his poor grammar, sentence structure and obvious misspellings. To say "replay" when he means "reply", how the hell did his accent make it into his writing? Quite obviously his reports were ignored.

Most certainly, this chap should have followed proper decorum by consistently petitioning Facebook to pay heed, by filling out the necessary forms and ensuring a stamped, self-addressed envelop was also included should they choose to write to him at a later time.

And then to go and expound his savagery to the Noble CEO's account, an utter insult to civility indeed! (Yes! I'm being sarcastic)

<comment><USER21> I don't know why you are being sarcastic. I don't make one mention of Khalil's grammar. I understand that everyone's first language isn't english, but Khalil isn't even making an effort to be clear or accurately communicate what the problem is.

In the comments of the blog post, Khalil admits that it isn't that he has a poor understanding of the english language, it is just that he doesn't care.

> whatever , i dont care for miss spelling , just the idea , i never correct > an underline red word ;)

So we have a guy that doesn't give a crap about communicating correctly, who then complains when he is not understood.

<comment><USER13> My views below are not directed at you individually.

Through my sarcasm I was trying to convey the often imperialistic (and in my opinion useless douchebaggery) view we tend to take on certain matters and people, which, I believe, hinders communication and progress in general. It's not just a language barrier, it's a cultural barrier. One that exists even between people who speak the same language. (Don't know if the social media movie scene with Zuckerburg being reprimanded by Harvard was based on real events or pure fantasy, but that's a good example)

So he ignored some squiggly red lines, maybe his command of English is marginal. Maybe he's worried about bullets possibly flying over his head in a few minutes or in a situation that many of us in the west couldn't fathom. I've had to communicate in Spanish before and I know I probably slaughtered the grammar, spelling and more, but at that time I was trying to convey an important message. Fortunately the people I was speaking with were very kind and patient. They listened and somehow understood the sentences and symbols I had cobbled together.

We have this whole attitude that if someone doesn't fit our cultural context in language or behavior, their are somehow inferior, is absolute BS. I have seen programmers with a an accent perceived as being "dumb", while in fact they were far better than their peers. I myself have been subjected to this type of bias, when I forgot to follow some proper decorum somewhere, simply because I was broke and had more important things on my mind. This is typical of out-of-touch monolithic institutions and the type of thinking that goes with it. It's outright absurd and funny, just like my sarcastic comment :)

</comment></comment></comment></comment><comment><USER22> Figure out another way to reward this guy (maybe tell him that it's a gesture of goodwill only) and reward him. It doesn't have to be from Facebook, Inc, but he should get something from somewhere.

Otherwise, next time him or any of his friends find a vulnerability, they'd be tempted to share it with the people who _would_ reward them, since they've seen firsthand that their reports to facebook seem to just get ignored. When you consider that his entire region is in turmoil, and that social media is clearly playing an important role in the uprisings across that region [whether you agree with them or not], you'll understand our reasons for insisting that his efforts be rewarded somehow.

Edit 1: Not suggesting that fb intentionally ignores their reports for poor English or any other reason, but that's clearly the impression they're getting.

Edit 2: And while I have no reason to believe that this guy (Khalil) would ever report a vulnerability to some dictator's security forces, others who have seen this story might. And those who have seen this need not be his friends either, since it's on HN, /r/technology, and elsewhere.

Edit 3: As tszming suggested, if you don't want to risk setting a precedent by offering cash, you could perhaps sponsor an all-expenses-paid trip (with no implications of future employment) for him to visit Facebook HQ. Granted I don't know the legal implications of this, but it does give you a chance to buy this guy lunch and tell him in person that you do appreciate his efforts, motivate him to continue reporting any vulnerabilities he finds, and tell him to encourage his friends to do the same. Actions speak louder than words, and there's no question this would have a far bigger impact than the dismissive two-liner he received, even if the intention was the same.

</comment><comment><USER23> So what does this guy gets for reporting one of the most relevant bugs that could have exploited the privacy of a billion people? PEANUTS!

When the top guys behave like this about rules, it clearly shows a lack of conscience. Rules are made to keep 99.9% of mess at bay.

This guy invaded the privacy of say 1-2 people that too to when the relevant authorities didn't respond in the correct manner, and saved the invasion of privacy of millions at least.

And what privacy? only a relevant post (not a spam) on profile of the company's biggest authority.

Yeah someone probably died of laughter from that post/ breach of privacy... So DUMB!

</comment><comment><USER24> So they get the exploit and fix it without paying the person who found it. These kinds of actions lead exploit finders to instead pursue rewards through the black market. Very sad indeed.

</comment><comment><USER25> The OPs English is not excellent (but way better than my Arabic)...but I'd be interested in hearing the FB responder's rationale for dismissing the initial submission. Language barrier aside, the link and the image provided should speak for themselves.

But perhaps the bug-hotline gets so much spam that the OP came off as junk email to the FB dev team? Just skimming over his email, I'm struck by how much poor punctuation and capitalization triggers my mental spam alert (and that's before even reading the actual contents).

</comment><comment> cupcake-unicorn Wow, upvoting this and I really hope it goes viral and FB gets called out for it. Hopefully he can get the bug bounty he deserves. That's incredibly sleazy of FB to treat him this way.

<comment><USER26> I'm surprised at how many people just assume the FB sec team doesn't want to pay and therefore tries to not pay if they can get away with it. Their history of paying out is completely the opposite. I've reported several bugs and they're always extremely helpful. They're not an insurance company that wants to reduce cost by screwing over users and there is no historical evidence of that. They want to pay for bugs and get as many of them as possible. What they don't want is for researchers to mess with other users' data. The guy could have just used two accounts to demo (he managed to create a new account after his own account was blocked). Using Zucks account doesn't make it more convincing from a tech perspective. It only makes the guy taken less serious as most researchers care more about how it works than messing with accounts of famous people. Not the smartest move. I understand the sec team draws a line and doesn't pay researchers that mess with other people's data. That's not sleazy, that's sane otherwise it gets exponentially worse as people try to outdo each other in terms of impact instead of focusing on explaining the technique behind a hack.

<comment><USER27> "Using Zucks account doesn't make it more convincing from a tech perspective." \- In this case, that's obviously false. The guy submitted the bug twice and the final reply was "This is not a bug." After posting to Zuckerberg's account it was subsequently fixed.

I'm sure the FB security team triages a lot of bug reports, and a few get away - hopefully they'll be better about trying to get more info (boiler plate requesting steps to replicate or a video), but beyond that no harm no foul. I can also see that they don't want to encourage researchers messing with real user data. However, if they paid him out and told him in the future, that he should provide more information and not use real accounts (or not get paid out, etc), that'd have the same effect (you know, since it already happened) w/o the bad will generated.

Instead, they didn't pay him, locked his account, and now we're reading that blog post, not only encouraging him and the people like him in the future to not submit these bugs in the future (certainly serious enough that it'd be worth discovering vs being in a 0-day marketplace), but generating way more visibility for no good reason. It's just not smart.

</comment></comment></comment><comment><USER28> Looks like if you edit facebook in firebug while you are posting a link to your newsfeed you can change the source userid which is not validated/checked and gets posted even though you dont have the permission to do it

<comment><USER29> This isn't true.

<comment><USER30> Obviously you cannot do so any longer as the bug has been fixed, but that seems like a good description of the exploit as shown in the video.

</comment></comment></comment><comment><USER10> Have to agree with everyone here. The first email gives enough information to base a case on. Enough to simply do a quick search and verify these people aren't friends. I get less information than this from users for a product we support, it's frustrating, but if you don't investigate each lead as a potential you run the risk of having it snowball.

Shame on Facebook for dismissing this guy's reward due to the lazy actions of one employee. It would have taken one question, or one 5 minute validation of the claims to make this a non issue.

<comment><USER21> How does the first email contain enough information to base a case on? All he says is that he can post links to other people's walls. He makes absolutely no mention of not being the target's friend.

<comment><USER10> Hmm well the implication made sense to me. It would have taken a few seconds to see that these people weren't friends. And all the engineer had to do was ask at least one question to probe for more information instead of a dismissal.

Edit: I'm sure Facebook engineers have something a bit more advanced that this:

[https://www.facebook.com/zuck?and=khalil.shr](https://www.facebook.com/zuck?and=khalil.shr)

This link works if they know each other. Try going to your profile and adding ?and=zuck for instance

</comment></comment></comment><comment><USER31> This obviously is cause of language barrier. It seems bug reporter didn't have any evil intentions but was just trying to get attention of facebook so this can be fixed. so I think he should paid. maybe you can ask for an apology for tampering user data as he was wrong on that part but still he did discover a valid flaw in facebook's iron clad security.

</comment><comment><USER32> I submitted a bug to Facebook's whitehat disclosure 3 or 4 months ago. Got no response whatsoever, except an automated response. The bug still exists. The bug allows users to post as though they are other users on the timeline. I think that is pretty serious, but I guess they do not.

</comment><comment><USER33> I don't think you guys understand. You can't publicly use the exploit and then back away and use the white hat system after the fact. It clearly shows him spamming some profile before even making the first contact.

<comment><USER34> Spamming?

Edit: It was a tame music video. On the spectrum of demonstrating to a test account all the way through to selling his discovered flaw to actual spammers, I rate this at the low end.

<comment><USER33> It is some link to a youtube video, posted to a public user's facebook wall through the exploit. That's what the screenshot shows.

</comment></comment></comment><comment><USER35> The guy gave more info on his education than the exploit he was reporting. How is he surprised that they didn't take him seriously?

<comment><USER36> My guess is he thought starting by explaining that he has a CS education would make them less likely to assume his comment was from an ignorant foreigner.

Unfortunately, that didn't work either.

</comment></comment><comment><USER37> My view: If they fixed the "bug"/security hole, credit should be given.

The TOS stuff i think i a bit shity. Partly cause they made him do it(more than necessary)

</comment><comment><USER38> So Facebook refuses to pay this guy? So now this white hat hacker will next time, sell the hack and make a lot more money... Way to go Facebook, you've fucked up again.

</comment><comment><USER39> What a terrible way to report a vulnerability. In no emails did Khalil clearly demonstrate how to reproduce it despite giving "repro steps" which weren't reproduction steps at all. I understand there is a language barrier but that's just pathetic.

</comment><comment><USER40> Of course in hindsight they should have been more diligent, but how many reports do they receive per day? But I see no excuse for not paying the guy for finding a serious flaw in their system, especially dismissing it on 'TOS' grounds.

</comment><comment><USER41> And they expect people to continue reporting bugs to them? Really?

</comment><comment><USER42> Ugh, they handled his disclosure like such typical dismissive nerds. Disgraceful.

</comment><comment><USER43> In my opinion good faith should be taken into consideration here. It sounds like he didn't understand the TOS as it was not in his native language. This didn't hurt facebook at all and saved them a lot of trouble. I don't get why they don't just pay up and say thank you. As well as giving him a copy of the TOS in Arabic to avoid future misunderstandings.

</comment><comment><USER44> Just as your disclosure emails provide almost no information whatsoever, your blog post was also pretty devoid of useful explanation.

<comment><USER45> > I found an exploit, here's proof, but I'm having difficulty conveying > information due to linguistic barriers.

> Nope that's not a bug.

What did you expect him to do? Learn English on the fly? Conveying specific technical things is a difficult skill to learn even for native English speakers.

Sure his communication isn't the best, but neither is "I can't click that link" nor "This isn't a bug."

<comment><USER46> But it's reasonable to expect him to say _something_ about how it was done. Recording a video is one possible method, and one he's evidently capable of.

Pasting a link to a Facebook profile does not explain the exploit.

</comment></comment></comment><comment><USER47> Long time ago a friend and me once submitted a whitehat bug that allowed the user to send messages to anyone even if they disabled messages from non- friends, i don't think this option still exists but anyways Facebook told us this wasn't a bug, we didn't even argue, suckers! i now wish i did the Same as Khalil and recorded the bug.

<comment><USER26> Well, if you have the email, just reply to it and re-open the conversation and see what happens. If you can explain it correctly, they might be able to research if the bug indeed existed and was fixed. I did a follow up on a bug that I submitted before the whitehat program was in place and that I never got a response on. They looked up the bug, replied to me and paid me. Very diligent.

</comment></comment><comment><USER48> I had helped a friend report a security vulnerability to Facebook. It was similar in the sense that it allowed anyone who knew 2 Facebook usernames (easy to do) to post a private message to someone that would appear to come from a friend. You didn't even need to be authenticated on Facebook to do it and could do post it from any machine on the Internet.

At first Facebook was similarly dismissive that it wasn't a bug. My friend pushed a bit to convince them with additional details and examples of how it could be easily used for exploits. They finally saw the light. The bug was fixed and my friend got paid $1K which wasn't much for the bug's seriousness. In any case it got fixed and my friend got acknowledged so it's OK.

It's a bit of a pity, thought, that they didn't see it to be serious at first. I would have expected any mediocre engineer to skip a hearth beat when learning of such a bug in their system.

</comment><comment><USER49> I find it harsh of Facebook that without technical leverage they do not pay out bounties.

<comment><USER26> They didn't pay because he messed with other peoples' data. That's a clear no- go.

<comment><USER50> He couldn't have proved without doing that .

<comment><USER51> He could have made test accounts with appropriate privacy settings. He could have just told the security team, "Your server does not validate permissions when posting to walls, so if you change this specific HTML form value to anyone else's profile ID, it will post to their wall."

<comment><USER52> It's pretty freaking obvious there was a language barrier problem here. He knew of the whitehat program, but not the ability within it to create test accounts: he asks the security team to set up a test account so he can post to it to show them the problem.

</comment></comment></comment></comment></comment><comment><USER53> Shitty move from facebook, because 1°) this is a major security issue, 2°) could have done a lot of damages, 3°) who coded this in the first place, seriously?

Come on guys, just give him the money.

</comment><comment><USER54> Can you provide details on how the exploit works? Even in Arabic as am pretty sure someone will be able to provide a good enough translation for us.

</comment><comment><USER55> One on of my issues with FB is that its not easy to report a problem or get any kind of support (although its a free service). In one day, I lost over 100 facebook friends with no explanation. Its obviously a little humiliating to have everyone think you defriended them. I hadn't seen the issue before, nor could I report it anywhere..

</comment><comment><USER56> I bet posting on Zuck's wall helped awake the WH team as well .. [http://rt.com/news/facebook-post-exploit-hacker- zuckerberg-6...](http://rt.com/news/facebook-post-exploit-hacker- zuckerberg-621/)

</comment><comment><USER57> If I was this guy, I would rather say screw it than trying to get attention by posting to Mark's wall. Given the recent cases in the USA (e.g. he used wget!!!), Facebook could give a massive slap and sue him. And probably win.

</comment><comment><USER58> Blissful ignorance. Next time guy like this will either do a lot of damage or sell the exploit to those who will pay.

Every security report should be taken seriously regardless it comes from a well known expert or just a guy from Palestine.

</comment><comment><USER59> To all the commenters that think Facebook should pay this guy: he became "the guy who hacked Mark Zuckerberg ON Facebook" overnight. I guess that this will probably open some doors for him, and if not, he's still become famous. :)

Maybe Mark should just hire the guy to replace the initial bug responder.

</comment><comment><USER60> taking into account fogginess of emails of the researcher and amount of emails FB whitehat receives daily... I am not surprised they said it's not a bug.

PROTIP: Reports should have PoC and be concise. No information about your bachelor degree should be attached.

</comment><comment><USER61> Lets hope that OP doesn't have anymore security vulnerabilities in hand because if he do, FB will pay the price of not paying him for the first time :)

</comment><comment><USER62> Well the good news is that in the end he'll probably get something because of all the ruckus we've made! So good job peeps!

</comment><comment><USER63> That is discouraging further reports... You should get paid Khalil. Hope it all works out.

</comment><comment><USER64> Did someone post this to Reddit yet? This guy should get the bounty.

<comment><USER65> Yes, and they have a wildly different opinion than HN:

[http://www.reddit.com/r/netsec/comments/1kkvei/user_reports_...](http://www.reddit.com/r/netsec/comments/1kkvei/user_reports_security_bug_to_facebook_after_user/)

<comment><USER64> Well, since you seem to have a top comment there - you don't see an error in the way the initial security responses were? Why didn't they guide him into providing the information they needed, to ask him specifically? Or point him out to the whitehat program, etc? They have no responsibility there - is that what you're implying?

</comment></comment></comment><comment><USER66> So, how much money did he miss out on?

</comment><comment><USER67> that's what happens when mr zuckerberg don't listen :P

</comment><comment><USER68> or hire the guy. "Job : unemployee :/"

</comment><comment><USER69> ابضاي يا ابن بلدي

</comment><comment><USER70> Unfortunate situation, but I suspect that the overwhelming majority of HN would have dismissed this out of hand (though it is perfect hindsight to now say they should have worked harder, etc). It reads like minimal-effort ramblings.</comment>


Silicon Valley's Next Big Office Idea: Work from Anywhere - <AUTHOR> https://www.wsj.com/articles/silicon-valleys-next-big-office-idea-work-from-anywhere-11589740234 <comment><AUTHOR> [http://archive.is/JYnuY](http://archive.is/JYnuY)</comment>


Run, if you hear FP is declarative programming - <AUTHOR> https://medium.com/@ankur_dhama/adbe92eb0093

<comment><USER2> Well, that's a good point. I always saw declarative programming as something where one writes what to get out of program and does not write how to get it.

Functional programming still includes the way of how to get the result, it's just about composing dynamically created functions, tail recursion and immutability. I constantly find it hard to accept that FP is of similar class as logic programming, while FP is to me closer to imperative programming than Prolog or SQL.

(I like functional programming very much; I just don't get it why it should be called "declarative".)</comment>


New TX law will allow police to sell confiscated guns - <AUTHOR> http://www.kvue.com/news/New-law-aims-to-allow-law-enforcement-agencies-to-sell-confiscated-guns-221557061.html

<comment><AUTHOR> H.B. No. 1421:

[http://www.capitol.state.tx.us/tlodocs/83R/billtext/pdf/HB01...](http://www.capitol.state.tx.us/tlodocs/83R/billtext/pdf/HB01421F.pdf#navpanes=0)</comment>


History of Cartography: Volumes One, Two, and Three - <AUTHOR> http://www.press.uchicago.edu/books/HOC/index.html <comment><USER2> I was going to complain that the images in the pdfs are really bad quality, but then again, so they are in many art history books, and given the name it is pretty easy to just google higher resolution images of the map.

The chapter about map projections in the renaissance is pretty awesome btw: [http://www.press.uchicago.edu/books/HOC/HOC_V3_Pt1/HOC_VOLUM...](http://www.press.uchicago.edu/books/HOC/HOC_V3_Pt1/HOC_VOLUME3_Part1_chapter10.pdf) and for example this 1515 beauty by German artist Albrecht Dürer and the Austrian scientist Johannes Stabius: [http://www.buzemann.de/luther/Stabius.jpg](http://www.buzemann.de/luther/Stabius.jpg)

People love to talk about how quickly the information society has changed the world, but if you look at the renaissance it's just mindblowing how much happened there in such a short time span as well.

</comment><comment><USER3> Amazing for U of Chicago to make this available. The pdfs represent over $1,600 of physical books which are still available for purchase. Vol 6 is available as an ebook as well.

</comment><comment><USER4> These books were _deeply_ influential to me while I was a student. They provide such a clear demonstration of how our image of the world is malleable. It's fantastic that they're now even more accessible.

</comment><comment><USER5> Looking at this I immediately thought of Jorge Luis Borges. Slightly relevant. A one paragraph short story of his.

On Exactitude in Science - Jorge Luis Borges

"... In that Empire, the Art of Cartography attained such Perfection that the map of a single Province occupied the entirety of a City, and the map of the Empire, the entirety of a Province. In time, those Unconscionable Maps no longer satisfied, and the Cartographers Guilds struck a Map of the Empire whose size was that of the Empire, and which coincided point for point with it. The following Generations, who were not so fond of the Study of Cartography as their Forebears had been, saw that that vast map was Useless, and not without some Pitilessness was it, that they delivered it up to the Inclemencies of Sun and Winters. In the Deserts of the West, still today, there are Tattered Ruins of that Map, inhabited by Animals and Beggars; in all the Land there is no other Relic of the Disciplines of Geography.

-purportedly from Suárez Miranda, Travels of Prudent Men, Book Four, Ch. XLV, Lérida, 1658"

</comment><comment><USER6> Amazing. Kudos to the University. Relevant? :D [https://en.wikipedia.org/wiki/Map%E2%80%93territory_relation](https://en.wikipedia.org/wiki/Map%E2%80%93territory_relation)</comment>


Neckbeard Republic - bite-sized python screencasts - <AUTHOR> https://www.neckbeardrepublic.com/?

<comment><USER2> I wish this project had a different name; just another way to tell women that they don't belong as programmers.

<comment><USER3> Women form into geek groups all the time... geek girls this, linuxchix that, and nobody objects. In fact, studies have shown women have an in-group bias where women like women more than men like men, so it's inevitable they will stick together: <http://www.ncbi.nlm.nih.gov/pubmed/15491274>

But as soon as a guy sets up a podcast with a self-deprecating title that references his own gender, it's a signal that women don't belong? C'mon.

All the numbers I've seen show that, contrary to commercial IT, the ratio of female to male participation in volunteer-based open source is minuscule. As in, the norm is 1-5%, and it maybe goes up to 10% after years of advocacy, in a successful project, e.g.: <http://www.networkworld.com/community/node/58218>

Arguably the most successful open source project, i.e. Linux, is run by a self-admitted asshole who chews out contributors in ways that would rally a never-seen before army of White Knights if it were ever directed at a woman. Linux is successful either despite or because of it, and nobody particularly seems to mind.

After a decade of goading women into joining open source, very little has actually changed. Most of the women I know in open source got involved through their job rather than a hobby, and I think this reflects the growing importance of open source over commercial software more than anything else.

The horribly sexist incidents in the community ("perform like a pr0n star") were always the exception, not the norm. The only thing that's changed is that now there is a hypersensitivity over anything that might be deemed offensive, as opposed to a "boys will be boys" shrug, and the loudmouths are favored over the people who just want to get things done.

Focusing on gendered references like beards is missing the point entirely. I think the only way women will ever make up a significant chunk of open source contributors is if hobbyist open source stops being relevant. Most technically-inclined women simply don't seem to be interested in working by themselves for the heck of it, they care much more about doing it in a safe and friendly group setting, for a well-defined external purpose. Hence, a huge chunk of programming culture will be male dominated, and it's pointless to be ashamed of that. Even though women are welcome to join the party, it was mostly men that built the internet.

</comment></comment><comment><USER4> I've really enjoyed the PyCoders Weekly newsletter curated by Mahdi, so I'm looking forward to trying this out.

<comment><USER5> thanks!!</comment></comment>


Another Dead Whale Is Reminder Of Plastic Problem - <AUTHOR> https://www.forbes.com/sites/trevornace/2018/04/09/yet-another-dead-whale-is-grave-reminder-of-our-massive-plastic-problem/#2d0eda806cd2 <comment><USER2> Where does all this come from?

I'm admittedly not the biggest saint on the sustainable living front, but I also don't see how all of this is getting into the oceans? AFAIK, any plastic that comes into my house either ends up in the recycling (where it's presumably recycled or sent to the landfill if it can't be recycled), ends up in the trash (where it's buried in a landfill) or (in the case of plastic grocery bags) gets explicitly taken back to a grocery store for recycling. Exactly 0% ends up in an ocean.

It's easy to blame others for this sort of stuff (and, as I already said, I admit I could do more on this stuff). But I can't help but think that first world countries with relatively advanced recycling/trash systems aren't contributing much to this and can't do much about it by implementing additional regulations...

Am I wrong about that?

<comment><USER3> No, you aren't wrong.

"Almost all plastic in the ocean comes from just 10 rivers" [0] \- The source is Deutsche Welle, which appears to be Germany's equivalent of the BBC. [1]

"It turns out that about 90 percent of all the plastic that reaches the world's oceans gets flushed through just 10 rivers: The Yangtze, the Indus, Yellow River, Hai River, the Nile, the Ganges, Pearl River, Amur River, the Niger, and the Mekong (in that order).

These rivers have a few key things in common. All of them run through areas where a lot of people live — hundreds of millions of people in some cases. But what's more important is that these areas don't have adequate waste collection or recycling infrastructure. There is also little public awareness that plastic trash is a problem at all, so a lot of garbage, gets thrown into the river and conveniently disappears downstream."

Someone linked a great map of these 10 rivers in a past thread, but I can't seem to find it.

[0] [http://www.dw.com/en/almost-all-plastic-in-the-ocean- comes-f...](http://www.dw.com/en/almost-all-plastic-in-the-ocean-comes-from- just-10-rivers/a-41581484) [1] [https://en.wikipedia.org/wiki/Deutsche_Welle](https://en.wikipedia.org/wiki/Deutsche_Welle)

<comment><USER4> I wonder how practical it would be to have some sort of plastic filter / water processing plant where these rivers dump into the ocean. It would be in all of our best interest to fund something like that, but I wonder if you could do it without a negative ecological impact, i.e. blocking wildlife from traversing the river to and from the ocean.

<comment><USER5> You might be interested in Baltimore Harbor's Water Wheel

[https://www.youtube.com/watch?v=v5l7s6wC50g](https://www.youtube.com/watch?v=v5l7s6wC50g)

It uses the water flow, solar, some pontoons and a clever design to fill up a dumpster with debris. This seems like the real issue: someone still needs to take it from the dumpster, but at that point it's a manageable problem.

</comment></comment></comment></comment><comment><USER6> The other day I noticed someone had deposited a disposable coffee cup in the compost bin. The top was a plastic lid. This plastic lid will wind up in an industrial composter, and degrade into a few largish chunks of plastic. This compost (with the plastic remains) will then be dumped on a farm field somewhere. It will then rain, and those plastic fragments will then wind up washing in to the ocean. The point of this story: if you genuinely care about having clean water and a clean food chain, put the right materials in the right waste bins.

Details: [https://www.npr.org/sections/thesalt/2018/04/06/600174922/an...](https://www.npr.org/sections/thesalt/2018/04/06/600174922/another- place-plastics-are-turning-up-organic-fertilizer-from-food-waste)

<comment><USER7> Any system that can be so easily defeated by user mistakes is a terrible system.

That's self evident in a software development context, but I feel like people lose track of that in the real world.

Asking people to correctly sort their trash in to more and more specific categories manually seems like a system set up to fail. People aren't necessarily that trainable or malleable or conscientious.

Yelling at people to be more careful is only going to get us so far. We need robust systems that can tolerate at least a certain threshold of abuse by the user. The ideal system would require no thought on the part of the user, it would be impossible to break it through misuse.

<comment><USER8> The system _does_ work in civilized societies, though. Getting a couple hundred euro fine for improper sorting fixes the issue really fast.

</comment></comment></comment><comment><USER9> I was vacationing in Thailand a year ago, and was snorkeling in this beautiful, emerald green lagoon in koh phi phi. I suddenly felt something brush up against me from behind... and it was a small pile of floating plastic trash. Really upset me that someone would disrespect such a uniquely beautiful place. Other tour boats were just dumping their plastic waste in the ocean, because it was easy, the ocean is big, and there were no repercussions to them.

It's just a small example of a much larger problem... that very few people think about what happens to their plastic waste, or the amount of it that they throw away each year. It doesn't decompose, so we're filling huge landfills with it, and at least some of it ends up in the ocean (through bad actors, natural disasters, or polluting water that feeds into the ocean). Eventually we'll do something about the problem, but by that point we'll have an ocean full of 200 year old plastic. It seems like global tragedy of the commons problems are among the hardest to solve.

</comment><comment><USER10> I find the closing remarks around the banning of single-use plastic bags troubling - surely there are much more beneficial areas to target to reduce our overall use of plastic? Within each of these plastic bags full of supermarket groceries is likely anywhere from 5-20 other items caked in plastic packaging. How much of an impact is banning single use plastic bags, even globally, going to make really? Not saying that I'm against the banning of them, but shouldn't bans be extending much further across other products. The single-use plastic bag seems like such a low-hanging fruit, easy-win, that in my mind will make a negligible difference

<comment><USER11> There probably are beneficial areas to reduce grocery plastic, but some of that plastic packaging is how/why food stays fresh on shelves longer. Cutting that back means increasing preservatives, throwing stuff out more often, shopping more often, etc.

Getting rid of plastic bags and other low hanging fruit (like straws) might not make a huge difference. On the other hand part of the battle is changing human behavior so starting with low hanging fruit is a good way to get people used to looking for plastic alternatives.

<comment><USER12> They could always start with the non food related products. Why does every piece of tech seem to come in a ton of plastic packaging anyway? Not so much the computers, but mice, printers, cartridges, etc...

Reduce or ban plastic from being used to package tech products, toys, media and random non food consumables and you'd probably cut down on a lot of plastic usage now.

<comment><USER13> To make it harder to shoplift.

It's the reason DVD cases are shrinkwrapped, otherwise people will just empty the cases.

<comment><USER12> Yeah, I know that logic. But I think the same still applies; the environmental impact matters more than a company's bottom line does, and I feel governments should start taking that into account.

</comment></comment></comment></comment></comment><comment><USER14> That picture is horrifying, as are the ones in the article's first link [https://www.forbes.com/sites/trevornace/2017/10/27/idyllic-c...](https://www.forbes.com/sites/trevornace/2017/10/27/idyllic- caribbean-island-covered-in-a-tide-of-plastic-trash-along- coastline/#763919522524).

I hope all of our needless plastic bottles, food packaging, and trinkets bring us joy greater than the centuries of destruction they bring.

Oh wait, they're mostly needless since humans lived without plastic for hundreds of thousands of years.

Regulation and pollution taxes can help, but right here right now we can each cut our plastic consumption by 90% without changing our lives at all beyond saving money.

EDIT: Thanks barrad0s for pointing out the picture is a "representation," which I find counterproductive, though it doesn't change the situation or images in the other link.

<comment><USER15> That's not a real picture. Kinda screws up the article a bit in my opinion, no need for that. Says right below the pic "A Greenpeace Philippines representation of a dead whale from ingestion of plastic. The representation is increasingly becoming a reality."

<comment><USER16> Ignore the Greenpeace rubbish. There's a picture in the video of what was actually extracted from the whale.

</comment></comment></comment><comment><USER17> The Dutch Ocean Cleanup project planned to start cleaning up plastic mid 2018 [1]. I really hope they can make this happen.

[1] [https://www.theoceancleanup.com/milestones/](https://www.theoceancleanup.com/milestones/)

</comment><comment><USER18> Seeing this made me sick: the things we do to the environment and to the animals that live in it sucks sometimes. My family has moved to reusable plastic grocery bags and we try to recycle everything. Living in Germany they take trash and recycling very seriously

<comment><USER19> " _and to the animals that live in it sucks sometimes_ "

We humans are also animals that live in it. I think a first step towards fixing the problem is remembering that there is no meaningful "us versus them" issue regarding the environment.

<comment><USER20> I don't disagree with you but, generally, we have a very hard time with "us versus them" even within our own species to have little/no hope that we could remember such a thing when we look at other species.

</comment></comment></comment><comment><USER21> All of these issues can be solved with pretty straightforward economics. If only there was an impartial, non-corrupt entity that could price externalities, which would then propagate to consumer product prices and therefore minimize this kind of thing.

</comment><comment><USER22> Same goes for the birds: [https://vimeo.com/218502282](https://vimeo.com/218502282)

</comment><comment><USER23> I can say by direct experience that often is just like that, yes. I found manure sacks, newspapers, lots of plastic bags and net chunks in knots. Sometimes it was a little, other a lot.

Is unclear to me on the other hand, if plastic was the cause of death or just a desperately starving animal trying to survive. The sample in the video is very peculiar (not what they found. Is what is missing there). We talk about 26Kg of plastic, that could look like a lot, but was found inside a 6 ton animal with a huge, huge gut. This is a terminal animal. Deaf by sonar or last storms could easily be the real killer here.

</comment><comment><USER24> There is an interesting documentary regarding the plastic problem in oceans, called [A Plastic Ocean]([https://www.youtube.com/watch?v=6zrn4-FfbXw](https://www.youtube.com/watch?v=6zrn4-FfbXw))

</comment><comment><USER25> I've never understood why we don't gasify our waste plastic and woody material and use it as a fuel source. PVC withstanding (as it create toxic Chloride gases), the stuff has value for a large power plant.

</comment><comment><USER26> Isn't most of this coming from China and if so how much impact can European laws really have on the problem?

<comment><USER27> There's a fine line between ignorance and racism and presenting a fact as a question isn't particularly clever.

If you don't know, ask (or better yet, research and educate the rest of us), but don't ask and imply (with no source).

The idea that laws affecting 770 million of the most affluent consumers won't have an impact is laughable. The view of "why should we do things if _they_ aren't", is sad.

<comment><USER28> How it is racism to find out - either by question or by statement - the actual source of the plastic? Is attributing any issues to anybody other than "770 million of the most affluent consumers" racist? This is completely insane. One can not solve a problem while ignoring the factual sources of it and being driven by ideology instead of reality.

<comment><USER27> It's a leading question which is based on what? Either provide a source, or at least avoid singling a group out. If you say "China produces most of the plastic waste" without any background, that's just prejudice. We constantly see this ( blaming specific groups for all the pollution, or crime, or job stealing, or...).

Changing that to "Doesn't China produce most of the plastic waste?" is not better.

To add actual information to this, it looks like China is a major polluter, but that until the recent Chinese ban (discussed on HN) Europe (and America) was exporting a lot of garbage to China. According to [1] Europe exported 1.6 million tons of plastic to China in 2016

[1] [https://www.politico.eu/article/europe-recycling-china- trash...](https://www.politico.eu/article/europe-recycling-china-trash-ban- forces-europe-to-confront-its-waste-problem/)

<comment><USER28> > It's a leading question which is based on what?

On facts. If you read the comments, there are multiple sources for this claim. Even if the particular commenter did not have the source link handy, this is discussed a lot and they might have heard about it or read about it in relevant places and remembered the fact. Even if they didn't, assuming that the country with world's biggest population, one of the world's biggest manufacturing bases and known for not-exactly-excellent attitudes toward environmental issues may be a major source of waste is not an unreasonable assumption. It could be wrong (which it isn't, but it could theoretically be), but jumping from that assumption directly to "racism" accusation is plain insane and can only be aimed at preventing proper factual discussion instead of facilitating it. I think you should apologize for mentioning "racism", especially that you yourself admit China _is_ a major polluter (not that it would be racist even if it weren't but even more in this case).

</comment></comment></comment></comment></comment><comment><USER29> Is there a cheaper biodegradable alternative to plastic?

<comment><USER30> In many cases, "nothing" is the better alternative.

I was somewhat surprised when I was in the UK (IIRC) and saw apples where sold in packs of six, on a tray of Styrofoam with plastic foil all around.

While in my country it's common to pack fresh vegetables and fruits into plastic bags, those are a fraction of the weight and many people choose not to use them.

Same applies to packaging across the board: bags containing smaller bags containing individually-wrapped sweets are insane. Frozen pizzas packed in two layers of foil plus a cardboard box? The US is actually better in that regard, largely dispensing with the cardboard.

</comment></comment><comment><USER31> The alternative to plastic in many or even most cases are items that generate more carbon to produce, and much more to ship.

</comment><comment> Paul-ish How much of the plastic is from consumers, and how much is from industrial and commercial sources?

<comment><USER32> Almost all of it is single-use plastic containers for food.

Goodie bags and bottles. That's what killed Earth. Great ain't it?

<comment> Paul-ish Do you have a source?

</comment></comment></comment><comment><USER33> Its insane to me that back in the 80's a plastic trash "island" was discovered somewhere between the size of Texas and Russia (depending on estimate). All these years later and there has been almost nothing done to combat the problem.

California is still the only state to completely ban single use plastic bags.

Is the convenience of a super market giving you multiple plastic bags every time you enter worth the damage we are doing to the planet?

<comment><USER34> Chicago banned single use plastic bags a few years ago. While some stores switched to paper, most just began to use thicker plastic bags and called them "reusable bags". I think the ban lasted about 18 months and when it was found that plastic bag use hadn't dropped at all, the city instituted a bag tax of $0.07 per bag used. I think that actually worked to reduce bag usage.

<comment><USER35> California has both a single-use ban _and_ a minimum per bag charge (which isn't strictly a bag _tax_ but should have the same direct effect on consumer behavior, even if it has a different direct effect on retailer behavior.)</comment></comment></comment>


Ask HN: Can you recommend a service to divide a list of users into subgroups? - <AUTHOR> I have found services that can randomly divide a list into sublists of some size.
But I want to do it by some criteria. For example gender, location (timezone), etc. <comment><USER2> Does it have to be a 'service" or would a simple script work for you?

<comment><AUTHOR> A simple script could work too.</comment></comment>


Microsoft's Not Bluffing —  Look, it might be the biggest poker bluff …    - <AUTHOR> http://www.nytimes.com/2008/06/14/technology/14email.html?_r=1&partnerhttp://kara.allthingsd.com/20080613/microsofts-not-bluffing/=rssnyt&emc=rss&oref=slogin

<comment><USER2> At the risk of sounding like an idiot... was this the link you meant to send?

<http://kara.allthingsd.com/20080613/microsofts-not-bluffing/>

Because the one you're linking to is about the creators of email trying to fix it.

</comment><comment><USER3> I can't believe that it takes dedicated research and insight to determine that this is a problem. It's not caused by e-mail and instant messaging, it's caused by undisciplined workers. Today's work environment is catering to this culture - the wages in an average office job assume that you waste at least 30% of your time and do a halfway unfocused job the rest of the time.

Anyone who has ever worked or studied has seen this problem first-hand. I doubt it started with computers..you can find all kinds of ways to put off hard work if you want to. Smoking breaks, talking to co-workers, just pretending to be working etc. In college, half the students put off reading until the last week before the final exam and complain that _studying is so hard_. I'd go so far as to say that this just as big a problem for ambitious employees as it is for the economy at large. I am fully capable of being focused at least 80% of the time, but that doesn't mean that I'll get paid 20-30% more. In a big company, I have no motivation to do a good job. The system embraces mediocrity.

This is less of a problem in small companies where every employee is a partner. In these companies, wages are sometimes _considerably_ greater (there are 10-man consulting companies in Norway where wages of $200,000 including stock are close to the median). And none of this, of course, applies to a startup. It's just a pain that these kinds of gigs require disproportionally more effort than a regular office job. There should be a middle ground somewhere.</comment>


US Senators Sent Letters to Executives of Stripe, Mastercard, Visa – Libra - <AUTHOR> https://twitter.com/gaborgurbacs/status/1183109812495814656 <comment><USER2> The only issue I have with the letter is the spurious inclusion of CP. It has little to do with the substance of the matter. But overall this is a pretty fair letter. As a fact, FB has shifted the focus from themselves as a platform provider onto potential association members. That literally means that regulators, have no choice but to focus their efforts on those member companies. Sure you can take it as a threat, but it really is just a very sobering fact.

I think it also shows how little faith these companies have in this tech that they have all just bowed out at the fist sign of (very obviously coming) government push back. If they thought this was really fleshed out and had the kind of earning potential that FB has implied they'd all be doing their best to play both sides for as long as possible.

<comment><USER3> You don't see a problem with them threatening even their non-Libra business lines with "additional scrutiny"? The letter directly threatens malicious investigation.

<comment><USER4> >The letter directly threatens malicious investigation

Interesting word choice there. I saw nothing malicious in the statement that moving forward would result in elevated regulatory pressure. That is a regulator's job. If Libra took off, but could not be monitored through the existing regulatory infrastructure, then those organizations must do more to make up the lost ground to meet their mandate.

So malice doesn't really come into it.

<comment><USER3> Regulators should not pressure a companies unrelated business lines to effect change elsewhere. If the company is doing something illegal then target that specific activity.

<comment><USER4> The implication in the letter is "if you go forward with Libra, then scrutiny will increase." Which again, makes sense, because previous safeguards (KYC and AML) would have to be updated to reflect the realities represented by financial transactions in Libra.

The financial system is regulated through high barrier entrance controls, and various levels of traffic pattern analysis through AML laws. Libra threatens to blow a hole in that for some period of time while the tools and processes are updated. Therefore... More scrutiny.

It isn't a conspiracy. It's just how things work in strictly regulated industries. Although usually, it isn't such a big deal that Congresspeople get directly involved through constituent outcry, and it is left to the Executive agencies to do the back and forth with the industry to ensure things go without a hitch.</comment></comment></comment></comment></comment>


Ask HN: Anyone from Apple here? It's impossible to enroll the dev program - <AUTHOR>
 I tried multiple times and it's the same problem: "we have been unable to obtain payment for your recent Apple Developer purchase."
I used the same card that I use to to buy apps from the app store - and I tried with other cards too but with no success.
And I'm not the only one... https://developer.apple.com/forums/thread/126314?page=25
The bank says that they didn't get any payment requests, so the problem seems to be at Apple. <comment><USER2> A bit if a tangent, but a company I worked with recently had an issue enrolling in the Enterprise dev program.

It's a large company with thousands of employees, so definitely enterprise scale. They heard nothing for _months_ after applying, and weren't able to find any way to chase the application. Eventually Apple got back to them to say the company didn't meet the Enterprise program requirements. The company asked which requirement they didn't meet, because it was plain that they _did_ in fact meet all the requirements - Apple wouldn't say! They said their decision was final, and they wouldn't say _why_.

Absolutely crazy.

<comment><USER3> That's when you register a new company to act as an in-between...

<comment><USER2> Having to register a new company to try to enroll seems a tad excessive, and certainly shouldn't be necessary.

<comment><USER4> Registering a new company only for that purpose makes no sense, but using an existing one could be useful, if you take into account a few issues (like the name - but this is more significant with B2C, it won't matter much for the Enterprise program.)

</comment></comment></comment></comment><comment><USER5> Yes!!! I thought I was going crazy. My registration got stuck at the payment screen even though I can buy other content from iTunes. I've contacted Apple support more than a dozen times in a span of two weeks. I was given conflicting information by different representatives. For example one told me to create a new Apple ID and register again. Then when that failed I was told it was because I had two accounts that tried to register with the same drivers' license. At some point I think I triggered some anti-fraud mechanism because I can't even get past the license agreement screen anymore and they told me basically that they'll "review" the case and get back to me. Haven't heard back in 3 weeks since.

</comment><comment><USER6> You are not the only one, it tooks me weeks to get an account setup, I kept getting the same error message as you even after trying multiple good credit cards.

After contacting support several times, we were finally able to get me signed up by enrolling via the iOS developer app.

It was a very painful, time wasting process!

</comment><comment><USER7> I'd be surprised if anyone from Apple would reply here. The problem seems to be with the payment processing, so a quick call to their support would yield faster resolution. Sometimes they have asked my card details over the phone to renew my membership, so you could request a callback.

</comment><comment><USER8> What did Apple say when you contacted them? The dev phone support with real people has always been quite good for me, or the general Apple online support system or their Twitter support system? As those methods would probably be the most helpful since they would be able to see what's going on with your particular account.

</comment><comment><USER9> This ended up happening to me recently (about a month ago), too. I ended up having to enroll via the app on iOS versus through the website on desktop. I was in contact w/ the support folks and they were fairly helpful. Could be worth reaching out.

</comment><comment><USER10> Are you from Europe? Maybe they want to get away from Wirecard after their meltdown [1] and their new provider is not that good.

Just speculating, not that I know anything.

[1] [https://techcrunch.com/2020/06/25/house-of-wirecard- insolven...](https://techcrunch.com/2020/06/25/house-of-wirecard-insolvency/)

<comment><USER11> Can't read the article, but if they recently switched payment processors for Europe for the dev program maybe they switched to Digital River?

They're famous for having extremely paranoid anti fraud checks to the point that I don't even attempt to pay for something through them any more. (e.g.: the card that i use for the app store, amazon, steam etc wasn't good enough for guild wars 2).

</comment></comment><comment><USER12> Have you tried contacting Apple customer service?

<comment><USER13> In the linked thread multiple people have tried contacting customer support. Apparently this is one of the responses:

> Hello __*,

> This is Paul from Apple Developer Program Support. It was nice to speak with > you today. I have researched the issue for you.

> For one or more reasons, your enrollment in the Apple Developer Program > could not be completed. We are unable to continue with your enrollment at > this time.

> Best regards,

> Paul

> Apple Inc.

<comment><USER14> That's so insanely devoid of any information it should be framed and exhibited somewhere.

<comment><USER15> Hm, juxtapose a bunch of such responses with something in the spirit of Pollock's 'burnt spaghetti' but in cyberpunkish tones—and you could have a pretty topical display for these days. If not very subtle.

</comment></comment></comment></comment><comment><USER16> Yep, it's a pain; took me weeks to jump through the hoops to enroll.

I really recommend calling them.

[https://developer.apple.com/contact/#!/topic/select](https://developer.apple.com/contact/#!/topic/select)

Membership and Account --> Program Purchase and Renewal

Choose the phone option.

</comment><comment><USER17> Yes, I had similar experience. It's because apple system, the manager told me. They suggested to transfer (wire) the money so they could do manually. I refused, so it took me like 2-3 weeks to wait the system resolved.

After that, I applied again with other company, It's fast enough only took 3 days

</comment><comment><USER18> I just dealt with a similar issue. It took about a week with multiple back and forths, and then they just said "Try again, it should work". And it did. I bet after WWDC they get a much larger volume of registrations that they really inspect carefully.

</comment><comment><USER19> I've been there and here is what worked for me. I've created a new test account on my machine using an alias for my gmail address. From that account with that email alias I was able to register into the dev program.

</comment><comment><USER20> Back in my day all you had to do was to send Apple a fax. Good ol' days.

</comment><comment><USER21> I had a recent similar problem. Multiple levels of support were clueless. Ended up being due to an iCloud outage that resolved itself.

Horrific developer experience over there at Apple.

</comment><comment><USER22> I've been wondering about this! I tried multiple cards and even a privacy.com card and they all appeared to go through but never charged my card.

</comment><comment><USER23> I've seen the same issue in the last 2 weeks pop up multiple times in the iOS dev slack channel and a few relevant subreddits.

</comment><comment><USER24> Why would you want to jailbreak? Asking apple for a dev account and side loading every few days is so easy!

</comment><comment><USER25> You've got to use an Apple Card. Don't you understand?

</sarcasm></comment>


How does Apple locate users where they are for iTunes Store - <AUTHOR>

Is this done purely via banking information on the iTunes account?
And/or does Apple use IP look up to locate you?
What happens when a users is outside of the 44 countries designated in the iTunes store. <comment><USER2> Pretty sure it's credit card info since that's the most accurate option available. If you're outside those countries you're probably unable to use the iTunes store.

I think they use IP geolocation until you're authenticated - that's been my experience traveling a lot and being a whore for new laptops and/or clean installs of Windows every now and then.</comment>


What You Learned About How Planes Fly Was Probably Wrong - <AUTHOR> http://danielmiessler.com/blog/why-planes-fly-what-they-taught-you-in-school-was-wrong

<comment><USER2> It's true that the usual explanation with the Bernoulli effect is wrong, but the idea that the Coanda effect is important for normal flight is also wrong. The relationship between wing camber, angle of attack, and lift is a little more complicated than the post, or the presentation it references, implies. See <http://av8n.com/how/htm/airfoils.html#sec-other-fallacies> for more details.

A few planes have been built with the Coanda effect in mind (<http://en.wikipedia.org/wiki/Boeing_YC-14>), but in general it isn't very important.

<comment><USER3> For anyone interested in this I recommend the really great "What makes airplanes fly" by Peter P Wegener.

[http://www.amazon.com/What-Makes-Airplanes-Peter- Wegener/dp/...](http://www.amazon.com/What-Makes-Airplanes-Peter- Wegener/dp/0387947841)

This book was part of a course he taught for non aerospace engineers. His explanations of tough topics like boundary layer theory and airfoils are clear

<comment><USER4> Kind of expensive for anything short of consuming interest, though.

<comment><USER3> Here's more info on the author

<http://opa.yale.edu/news/article.aspx?id=6066>

Apparently he worked on the V2 rocket. But there are lots of scientists that can write technical books targeted to experts. This book is worth it because this guy is devoted a lot of his teaching career to explaining difficult topics to non-experts. I think he did a marvelous job, of mixing technical material and history. I think this book was part of a course he taught at yale univ.

It is an expensive book, but I'll go in and say it's worth it. Check your univ library.

</comment></comment></comment></comment><comment><USER5> I built a fair sized (5m, 16') windmill and this was one of the most surprising things I learned while designing the blades.

Windmill blades and airplane wings have a lot in common.

I wrote some python software for it to model the curvature and get an idea of how to get the maximum effect out of a blade cut from a given blank.

The neat thing was that without the software being interactive we'd have never clued in to some of the possibilities.

In case anybody is interested here is a snapshot of the python program:

[http://pics.ww.com/v/jacques/renewables/windmill/snapshot3.p...](http://pics.ww.com/v/jacques/renewables/windmill/snapshot3.png.html)

<comment><USER6> do you have pictures of the windmill?

<comment><USER5> sure: <http://pics.ww.com/v/jacques/renewables/windmill/>

That documents the whole building from start to finish, including the 3d computer controlled router/plasmacutter we built in order to fabricate all the parts.

The whole thing including making the tools took about a year and half.

A single picture of the completed machine is here:

[http://pics.ww.com/v/jacques/renewables/windmill/firstrun.jp...](http://pics.ww.com/v/jacques/renewables/windmill/firstrun.jpg.html)

It's a variable pitch 3 blader with a 'drum' type rotor that holds 18 2x1x.5" neos. Total power about 2000 Watts, design power was 2.5 KW so not perfect but still pretty good.

</comment></comment></comment><comment><USER7> A better more scientific and mathematically detailed explanation can be found if you google "how wings work" - [http://www.iop.org/EJ/article/0031-9120/38/6/001/pe3_6_001.p...](http://www.iop.org/EJ/article/0031-9120/38/6/001/pe3_6_001.pdf)

Thank you to the OP for pointing out the flaw in the popular explanation !

<comment><AUTHOR> Yes, I linked to a similar post at the bottom of mine--as well as a few other resources. Many get put off by a four-page explanation, however, and move on to other things. I like to try and give the full punch in a single page and then provide resources to go into more detail if so desired.

</comment></comment><comment><USER8> I thought everyone knew this j/k. Really when I studied the Bernoulli principle in highschool it didn't make a lot of sense to me at the time. If the curvature of a wing was so important then how did objects with no curvature at all gain any lift? For example gliders.

Bernoulli lift only really comes into effect once you have level flight. Then the curvature alone can provide enough lift to support the weight of the plane without inducing drag. The Koanda effect is where ailerons and flaps come into play. The produce additional lift but also contribute more drag. As the angle of attack increases laminar flow drops. Using the authors example, placing a glass in a stream of water redirects the flow, but you'll notice there is a bit that sort of fans out. That is the equivalent of spoiled air. Too much of it and you've lost all laminar airflow, bye bye lift.

Anyways, I'm getting out of my area of expertise. It's been ages since I studied aerospace and my AIAA bible is in my parents' garage.

<comment><USER9> Bernoulli's principle also doesn't explain how planes can fly upside-down.

</comment></comment><comment><USER10> Wow. I had completely forgotten how cool it was playing with a hand outside the car window as a kid. It really was an aha moment.

A bit dangerous, I know.

</comment><comment><USER11> From the article:

> Ask yourself why planes can hang tons of massive crap (engines, bombs, etc.) > off of the bottom of their wings if the bottom of the wing is so important > for flight

I guess that since the top of the wing generates the fast flowing air which then generates the low pressure that generates the lift, by slowing the air on the bottom of the wing with bombs and engines is only going to increase this pressure differential and hence increase the lift (at the expense of drag).

The definitely don't seem to hang anything off the top of the wing.

<comment><USER8> Structurally, it's easier for something to hang (well in places that have gravity as a constant) than it is to prop up. You could mount something above the wings but than you would need additional hardpoints to keep it from falling over and smashing into the wing. If it's hanging you only need one hardpoint.

</comment></comment><comment><USER12> Another perspective how wings are vacuum lifted: vacuum air flow has a low mass, but very high velocity. I work with vacuum packaging equipment and we often see a few 90 turns in the hoses hits the flow like a brick wall at each turn. The speed of the vacuum near 1 torr carries tremendous energy and is enough to rip silicone caulking from inside the joints. Air at double the atmospheric pressure won't see the high velocities to do any damage. I can imagine the high speed downward air flow giving tremendous push.

</comment><comment><USER13> The reason I didn't believe the curved-upper-surface explanation as a kid was that meant that the volume of low-pressure air would have to be similar to the volume of a blimp for it to be useful for lifting the plane, even if it were as efficient as hydrogen; the wings would have to be many times the size of the fuselage.

</comment><comment><USER14> Geek Cruise lecture "Why Airplanes Fly - A Modern Myth" (audio only, 3 parts):

[http://podcast.geekcruises.com/index.php?search_string=airpl...](http://podcast.geekcruises.com/index.php?search_string=airplane&Submit=Search&search=1)

</comment><comment><USER15> I say they fly because the shape of the wing makes them fly. If you built an airplane with a wing shape that didn't fly, it wouldn't sell. Therefore, it's really a case of natural selection.</comment>


Why AES-GCM Sucks - <AUTHOR> https://soatok.blog/2020/05/13/why-aes-gcm-sucks/ <comment><AUTHOR> HT to Filippo ([https://twitter.com/FiloSottile/status/1260598284395126786](https://twitter.com/FiloSottile/status/1260598284395126786)). Another submission 10 hours ago didn't catch ([https://news.ycombinator.com/item?id=23165258](https://news.ycombinator.com/item?id=23165258)).

Too bad, because the blog post illustrates some limitations with the construction that are interesting to know, like the problem with using the same authentication key for every key instead of key/nonce pair, or the fact that AES-GCM is not "message committing" \- a TIL for me.

It's also very pragmatic in the end: "Don't throw AES-GCM out just because of my opinions. It's very likely the best option you have."

</comment><comment><USER2> Doesn't ChaChaPoly have a similar sudden death property on nonce reuse? If I reuse a nonce, I can know the Poly1305 key which then allows me to forge endless messages with the same nonce, right?

If the implementation doesn't detect this somehow, I can inject traffic forever, right?

<comment><AUTHOR> (beware, I'm a dog)

Misusing those primitives can kill all guarantees, of course, the amount of kill dependent on the amount of misuse. Using non random keys will kill even more.

It's about ease of correct implementation, use, and what kind of degradation happens if a side-channel leaks a specific item:

It seems that w/AES (within the AES-GCM construction) can leak a key that is useful against all other uses of the original AES key that was used to derive the authentication key.

ChaPoly uses a construction where all crypto operations for a message exchange use a key which if leaked, cannot be reused to attack so many other message exchanges as well, because it incorporates both main key and nonce in the derivation.

<comment><USER2> Ahh I see the difference... total forgery capability vs. forgery capability only with the same nonce (which can be detected).</comment></comment></comment>