Show HN: Rollcall – An easy way to build a status board for your team - <AUTHOR> https://www.gorollcall.com <comment><USER2> This post set off the voting ring detector, but I'm restoring it because we want to see original work on HN.

A voting ring is when people get friends to upvote their post. This is against the rules. We want stories to be on HN because they're good, not because they were promoted.

All: Please don't do this; just take your chances with HN's randomness. If a post is solid and hasn't gotten any attention yet, a couple of reposts is ok. Be careful not to abuse that, though, since accounts that repost too much eventually lose submission privileges. Send any questions to firstname.lastname@example.com.

</comment><comment><USER3> Charge more.

Your most expensive plan is for a team of 40-100 people. For the sake of simplicity, you are talking about a team that is costing a company a minimum of say $1,200,000 a year (assuming $15/hr FTE's) and you are asking them to pay you $300 a year for a tool they are supposed to use throughout the day.

Why have you built such a low value tool?

Take your prices and multiply by 10 and you are probably at a more correct pricing strategy if you are selling to businesses.

<comment><USER4> Agreed. CircleCI does very similar things for status and Rollcall looks like a great way to replace some ad-hoc things we do.

But $15/mo seems insane for a 13 person team. It makes me think you guys won't be around in a few months, and makes me reluctant to commit.

Baremetrics charges $250/mo! You should charge at least $50, but probably $150.

<comment><USER5> Basecamp, which seems to do a whole lot more than this app, charges $20 a month for a 13 person team (limited to 10 active projects). I never looked at the product at any point in it's existence and made me wonder if they were going to go out business at any moment over that kind of pricing.

<comment><USER4> Rollcall was $15 for 40 people.

<comment><USER5> Well, Basecamp's $20 actually allows unlimited users.

</comment></comment></comment></comment></comment><comment><USER6> It looks nice. How is this similar to / different from iDoneThis? visually it seems nicer, but does it have the same email integration and daily updates? (I noticed weekly, is this configurable?)

The only reason I can see for us to NOT use it, is because we already use rollbar[1] (for tracking js errors) and rollout[2] (for feature flags). The name 'Rollcall' will create way too much confusion for us. Sounds silly, I know, but it does have an impact.

[1] [https://rollbar.com/](https://rollbar.com/) [2] [https://github.com/FetLife/rollout](https://github.com/FetLife/rollout)

<comment><AUTHOR> One of our beta testers during our closed beta brought iDoneThis to our attention. It looks like a good product. We don't have the email replies built in yet, but it's something we're looking at based on that early feedback.

and, the naming conundrum - we just stuck with what we called it when it was an internal tool. I can respect the confusion angle, though. Still, you should give it a try :)

</comment></comment><comment><USER7> You need to show a demo or screenshots of the product.

</comment><comment><USER8> It is neat, especially with the integration, but like alot of such services I think it generally assumes you need highly granular information about what someone is working on. [e.g. specific ticket/issue]

Many small operations carve out services and say 'You two work on X, Y, and Z services'. At which point, no one else cares until you hit a point/prod release.

Maybe that is just me tho.

<comment><AUTHOR> Thanks for the feedback. I agree - if you've got one product or one specific thing you're working on, this probably is overkill. In our case, we have several products out in the market, and a small team that manages it all, including maintenance & support.

Thanks for the feedback, though - it would be good to hear if others have similar thoughts.

</comment></comment><comment><USER9> Not trying to be snarky, just genuinely curious: why would I use this?

My team uses an issue tracker right now (YouTrack, from JetBrains) as a central hub for our activity. Telling people what you're working on is as easy as changing the status of a ticket to "In Progress".

Is there something about this system that reduces the friction of that process (simply selecting an item from a dropdown)? It seems like having to actually go type out what you're working on would be more work (not to mention that if someone wants more detail about the ticket you're working on, they have to look it up themselves instead of clicking on it).

</comment><comment><USER10> I wish I could use the cool things I see on HN. If it runs on someone else servers, I can't use it. The woes of working in a heavily regulated industry.

</comment><comment><USER11> I seem to recall this was Twitter's original model, at the very beginning. "Let your team know what you're doing" or something along those lines. Retweets and replies and the whole pile of other things made Twitter into a completely different thing that couldn't be used for that purpose.

I thought it was a cool idea then, and it's cool to see someone re-examining the status-communicating problem today.

</comment><comment> wc- I was disappointed to not see integration with pivotal tracker.

Maybe it would be too duplicative since pivotal is supposed to show what is being worked on at a glance, but this integration was the one thing I was hoping to try out in the free plan after viewing the landing page...

</comment><comment><USER12> Will this integrate with Slack?

<comment><AUTHOR> On the list. We focused on what our beta testers used first. We're trying to roll through more integrations as fast as we can.</comment></comment>


LexVec, a word embedding model written in Go that outperforms word2vec - <AUTHOR> https://github.com/alexandres/lexvec <comment><USER2> As pre-built word vectors go, Conceptnet Numberbatch [1], introduced less flippantly as the ConceptNet Vector Ensemble [2], already outperforms this on all the measures evaluated in its paper: Rare Words, MEN-3000, and WordSim-353.

This fact is hard to publicize because somehow the luminaries of the field decided that they didn't care about these evaluations anymore, back when RW performance was around 0.4. I have had reviewers dismiss it as "incremental improvements" to improve Rare Words from 0.4 to 0.6 and to improve MEN-3000 to be as good as a high estimate of inter-annotator agreement.

It is possible to do much, much better than Google News skip-grams ("word2vec"), and one thing that helps get there is lexical knowledge of the kind that's in ConceptNet.

[1] [https://blog.conceptnet.io/2016/05/25/conceptnet- numberbatch...](https://blog.conceptnet.io/2016/05/25/conceptnet-numberbatch- a-new-name-for-the-best-word-embeddings-you-can-download/)

[2] [https://blog.luminoso.com/2016/04/06/an-introduction-to- the-...](https://blog.luminoso.com/2016/04/06/an-introduction-to-the- conceptnet-vector-ensemble/)

<comment><USER2> That said: LexVec gives quite good results on word-relatedness for using only distributional knowledge, and only from Wikipedia at that. Adding ConceptNet might give something that is more likely to be state-of-the-art.

<comment><USER3> ...And just distributional knowledge makes it easy to train new models on domain-specific corpora, or new languages. Is it possible to do the same with ConceptNet?

I generally find that expert-derived ontologies suffer from bad coverage of low frequency items, rigidly discrete relationships, and are usually limited to a single language. That said, they're vastly better than nothing for a lot of tasks (same goes for WordNet).

<comment><USER2> You can retrain your distributional knowledge _and_ keep your lexical knowledge. Moving to a new domain shouldn't mean you have to forget everything about what words mean and hope you manage to learn it again.

The whole idea of Numberbatch is that a combination of distributional and lexical knowledge is much better than either one alone.

BTW, ConceptNet is only partially expert-derived (much of it is crowd- sourced), aims not to be rigid like WordNet is, and is in a whole lot of languages.

"Retraining" ConceptNet itself is a bit of a chore, but you can do it. That is, you can get the source [1], add or remove sources of data, and rebuild it. Meanwhile, if you wanted to retrain word2vec's Google News skip-gram vectors, you would have to get a machine learning job at Google.

[1] [https://github.com/commonsense/conceptnet5](https://github.com/commonsense/conceptnet5)

</comment></comment></comment></comment><comment><USER4> It feels weird how word embedding models have come to refer to both the underlying model, as well as the implementation. word2vec is the implementation of two models: the continuous bag-of-word and the skipgram models by Mikolov, while LexVec implements a version of the PPMI weighted count matrix as referenced in the README file. But the papers also discuss implementation details of LexVec that has no bearing on the final accuracy. I feel like we should make more effort to keep the models and reference implementations separate.

<comment><USER5> Aren't skip-grams equivalent to NMF of the PPMI matrix?

[https://papers.nips.cc/paper/5477-neural-word-embedding- as-i...](https://papers.nips.cc/paper/5477-neural-word-embedding-as-implicit- matrix-factorization.pdf).

</comment></comment><comment><USER6> If anyone else is wondering what the heck "word embedding" means, it's a natural language processing technique.

Here's a nice blog post about it: [http://sebastianruder.com/word- embeddings-1/](http://sebastianruder.com/word-embeddings-1/)

It can process something like this: king - man + woman = queen

Neat-o.

<comment><USER7> Post starts off kind of dense. Finally we get to the section "Word embedding models" and I say "ah ha! here we'll get a concise definition." Cut to ...

 _Naturally, every feed-forward neural network that takes words from a vocabulary as input and embeds them as vectors into a lower dimensional space, which it then fine-tunes through back-propagation, necessarily yields word embeddings as the weights of the first layer, which is usually referred to as Embedding Layer._

Naturally.

(Thanks, I believe that it is a great blog post, but I might look elsewhere for an intro ... :)

<comment><USER8> Would love such kind of intro too, especially since I'm working on a product that could greatly benefit from NPL and neural networks.

Could a kind person provide a good reference for something we could learn from?

Or (as I fear), are we past this short time in the beginning of a technic/science (I think about computing, here) when you can learn without going through academic studies?

<comment><USER9> This is fairly readable (high-level) post on word embeddings: [http://colah.github.io/posts/2014-07-NLP-RNNs- Representation...](http://colah.github.io/posts/2014-07-NLP-RNNs- Representations/)

<comment><USER10> And this is one that explains everything OP needs to understand the confusing sentence from their intro:

[http://mccormickml.com/2016/04/19/word2vec-tutorial-the- skip...](http://mccormickml.com/2016/04/19/word2vec-tutorial-the-skip-gram- model/)

<comment><USER8> Thanks :) I feel like some key concepts are a bit beyond my reach, but that they are such a small quantity that it can be a good starting point for googling around. Thank for your help!

</comment></comment></comment></comment></comment></comment><comment><USER11> Slightly off-topic, but I thought this would be a good place to ask.

Are there any word embedding tools which take a Lucene/Solr/ES index as input and output a synonyms file which can be used to improve search recall?

<comment><USER12> There's a few projects that use ES/lucene as a backend/datastore once the feature engineering is done, but I don't see models operating on the native indexes directly, maybe the format is too different from one-hot (after turning off stemming/stopwords and other info-losing steps)

[http://lucene.472066.n3.nabble.com/Where-Search-Meets- Machin...](http://lucene.472066.n3.nabble.com/Where-Search-Meets-Machine- Learning-td4203127.html)

[https://news.ycombinator.com/item?id=11876542](https://news.ycombinator.com/item?id=11876542)

</comment></comment><comment><USER13> Has anyone done any work on handing words that have overloading meanings? Something like 'lead' has two really distinct uses. It's really multiple words that happened to be spelt the same.

<comment><USER14> Well, there is Sense2Vec: [https://github.com/spacy- io/sense2vec](https://github.com/spacy-io/sense2vec)

<comment><USER15> Sense2Vec can solve this one, but what if both meaning of the world are of the same pos tag?

</comment></comment></comment><comment><USER16> Reminds me of Chord[1], word2vec written in Chapel

[1] [https://github.com/briangu/chord](https://github.com/briangu/chord)

</comment><comment><USER17> Are there IP considerations? Word2vec is patented.

<comment><USER18> System and method for generating a relationship network - K Franks, CA Myers, RM Podowski - US Patent 7,987,191, 2011 - [http://www.google.com/patents/US7987191](http://www.google.com/patents/US7987191)

<comment><USER3> Would this really be usable in court? It seems super general to me, using a lot of common techniques. Silly question, is it infringement to use any part of the patent?

<comment><USER19> It is only infringement if you do something matching every part of some claim. There may be lots of stuff in the description, and that doesn't matter. That is, if a claim is a system comprising A, B, C, and D, and you do just A, B, and C, then you're fine.

</comment></comment></comment></comment><comment><USER20> Well done, that's probably the _least_ relevant use of "written in go" in a HN headline I've seen. And there's some stiff competition for that title.

</comment><comment><USER21> From the viewpoint of commercial applications I find this profoundly depressing.

When the state of the art for accuracy is 0.6 on some task, you are going to always be a bridesmaid and never a bride, but hey, you can get bragging rights cause you did well on Kaggle.

<comment><USER22> That depends, to be honest. 60% accuracy, depending on the task, is _far_ better than guessing at random. Secondly, depending on the task, human performance may not be that great either. Combined with controls, heuristics and validation, these "weak" models can still be of great use in commercial settings.</comment></comment>


SJW attack survival guide (2015) [pdf] - <AUTHOR> https://www.voxday.net/mart/SJW_Attack_Survival_Guide.pdf <comment><USER2> Just a heads up, posting content from white supremacists is typically a bad look.

[https://en.wikipedia.org/wiki/Vox_Day#White_supremacy](https://en.wikipedia.org/wiki/Vox_Day#White_supremacy)

<comment><USER3> Critique the speech, not the speaker.

<comment><USER2> Okay, the title of the article uses the phrase "SJW" non-ironically, it's stupid speech by a racist speaker.

<comment><USER4> Are you saying that the term "SJW" must be used ironically, or else I am stupid and racist? Is this ironic enough?

</comment></comment></comment></comment><comment><USER4> I don't care if these words were uttered by the Pope or by a vox day. They are still true, and well put.</comment>


Physicists design quantum triggers that can be activated by a photon - <AUTHOR> http://news.harvard.edu/gazette/story/2014/04/flipping-the-switch/ <comment><USER2> "While it's unlikely the switches will become standard equipment for personal computers, Lukin said ..."

I find that a very odd statement. I can see uses for this in personal computing devices. Assuming there are easier ways to set up the circuit, etc.

</comment><comment><USER3>
      "Such systems make it impossible to intercept
      and read messages sent over a network, because
      the very act of measuring a quantum object
      changes it, leaving behind telltale signs of
      the spying.

      'It's unlikely everyone would need this type of
      technology...'"

I wonder if they're saying it would be impractical at a large scale, or that it's not necessary because it's not like _everybody_ is being spied on or anything :)

<comment><USER4> Google vacuum chambers and optical tweezers if you want to see why these switches might be impractical for home users. The ease of scaling they refer to is likely just the number of switches they can fit in one chamber.

On the other hand, you don't need a classical switch in your house to get on the Internet. If quantum repeater networks ever roll out to people's homes (a very long time from now), the switch will only need to be within a hundred kilometers or so of the user. By then, this sort of construction won't be out of the question for telco substations. Still, an entirely solid state solution would obviously be preferred.

<comment><USER5> I'm assuming that the "switches" they're currently experimenting on also probably aren't designed to function as telecommunications switching equipment might. I'd imagine they have all the frills and features of a circuit breaker or a knife switch.

So, in that sense they really are "classic" switches in terms of representing the raw fundamentals of functionality for the purposes of experimentation, but not in the sense of "classical physics" where the off state is caused by introducing a physical air gap to the circuit.</comment></comment></comment>


Rock star philosopher: Roland Barthes - <AUTHOR> https://www.the-tls.co.uk/articles/public/roland-barthes-afterlife/ <comment><USER2> There's an enjoyable irony in publishing Barthes' work after his death.

<comment><USER3> And for those who do not want to guess:

The Death of the Author - Roland Bartes: [https://en.wikipedia.org/wiki/The_Death_of_the_Author](https://en.wikipedia.org/wiki/The_Death_of_the_Author)

</comment></comment><comment><USER4> Image Music Text is a fantastic read. It was one of my required readings at University, but would recommend it to anyone interested in Structuralism. My favorite essay was The Grain of the Voice, it expanded the ways that I thought about how I write music and how a listener interprets it.</comment>


We Love Space Exploration, but Mostly in Our Dreams - <AUTHOR> http://now.space/posts/we-love-space-exploration-but-mostly-in-our-dreams/ <comment><USER2> See also: construal level theory [https://en.m.wikipedia.org/wiki/Construal_level_theory](https://en.m.wikipedia.org/wiki/Construal_level_theory)</comment>


Ask HN: Dipping my toes with artificial intelligence and what to expect? (CS) - <AUTHOR> Recently I got accepted into computer club on my faculty. I got opportunity to choose on which team I would like to be, where we would be working on projects and workshops. Before, I got my interests mainly in OS/Systems programming, I had few smaller projects, solid knowledge of C, Data structures, Memory and Assembly. (started writing my Kernel and hopefully it would grow in some smaller OS). One of the colleagues asked me why wouldn't I join Ai team, and I was like nah it is too high level and full of black magic for me. But, I do not know why, that possibility started to resonate in my head for days. Firstly I had some concerns, besides looking at some stuff and seeing all those black boxes and magic happen in ~100 lines of python code.
- I am not sure how much math is needed. And I ask that because I am not having a lot of math on my faculty. First I was chasing EE degree, finished 2 years and I got to the point where I wasn't enjoying anything except math and programming subjects. So I quit and enrolled to CS where I am now. I got really solid background during EE studies, and when I got to CS I was feeling pretty at home with it. And I do not know what to expect with math in terms of Machine Learning, Deep Learning or Neural Networks. It looks to me like a lot of linear algebra and analysis.
- What would be bigger concern to me is how much of engineering you actually do with Ai? What I liked with OSs is that it felt pretty rad to me in terms of type of work you do. Plus you could easily get interested in DevOps or Distributed Systems, and those doors would be open too. With Ai it looks like piping and manipulating data from one "thing" to another. I won't include myself in those 5% of Computer Scientists that design Algorithms and software that is used to realize all that stuff that you import in few modules and functions in your project.
Thank you on your time, I appreciate any help or advice. <comment><AUTHOR> \- But what really turned me _on_ with Ai is sheer possibility. It is endless. And compared to Operating Systems it looks much more diverse and exotic. There are opportunities to try and learn new languages, especially functional ones, and that is what I am most interested and attracted to.

So I do not know what really to expect. I thought of looking at [sentdex']([https://www.youtube.com/playlist?list=PLQVvvaa0QuDfKTOs3Keq_...](https://www.youtube.com/playlist?list=PLQVvvaa0QuDfKTOs3Keq_kaG2P55YRn5v)) tutorial on ML with Python, since I am already pretty familiar with Python. Is there any book that you could recommend me to read, so I could get the grasp on what are all the possibilities in terms of Ai in Computer Science. It is very wast and young field. And I was not very attracted to it, since for the most time I was leaving that as I thought I was not smart or good enough for those kinds of things.</comment>


Companies Use Borrowed Billions to Buy Back Stock, Not to Invest - <AUTHOR> https://www.bloomberg.com/news/articles/2019-08-08/companies-use-borrowed-billions-to-buy-back-stock-not-to-invest <comment><USER2> SP500 price/sales ratio is at the same level as it was last time during dot- com-bubble. The aftermath between 2000 and 2009 was the all-time worst decade for SP500. Total ROI -9 percent, worse than during the 1930s Great Depression.

Combine debt-for-buybacks with the shadow margins and there is potential for quick crash.

</comment><comment><USER3> similarly with Trump's tax cuts which largely did not end up in pay rises or investment.</comment>


Eleven Years of Ambition and Failure At AOL - <AUTHOR> http://bits.blogs.nytimes.com/2009/07/24/eleven-years-of-ambition-and-failure-at-aol/?hp

<comment><USER2> The history of AOL reads like that of the U.S. auto industry:

• Pick the easy money as fast as you can • Pick old-school corporate leadership and hope it'll work in a new, highly competitive world. • Don't worry about looking at the latest innovative directions - or seeking a CEO who can _create_ new ones for your corporation.

There must be _some_ technological/business assets left in AOL. What about finding some leadership that wants to be _ahead_ of the next wave of digital communication?

<comment><USER3> Justin Frankel actually technically worked for AOL (via Nullsoft) when he wrote Gnutella and WASTE. Probably the best things to come out of AOL (by proxy) in the last decade. (Not that they didn't try to stop it, either).

</comment></comment><comment><USER4> "2004: Embracing broadband"

This was about 7-8 years too late.

</comment><comment><USER5> Wait... so you mean the company whose advertising slogan was "Welcome to the World Wide Wow" didn't succeed?

This story brought me much joy and happiness. Thank you very much for bringing it to my attention.</comment>


Installing and Using PostgreSQL Modules - <AUTHOR> http://www.linuxforu.com/2012/03/installing-using-postgresql-modules-chkpass-fuzzystrmatch-isn-hstore/

<comment><USER2> In PostgreSQL 9.1 the contrib modules were all converted to the new concept of extensions. So instead of having to run a SQL script you can simply run.

CREATE EXTENSION hstore;

The advantages of this new command is that extensions can easily be uninstalled, installed in other schemas, and most of the problems with modules relating to database upgrades are gone.

<comment><USER3> pgnoob here: wouldn't "install extension" have been more accurate? It's probably doing something 'create'-ive under the hood, but to install something with 'create' doesn't seem at all intuitive. If this was something legacy from 30 years ago, I'd understand changing at this point doesn't make much sense, but this seems recent.

<comment><USER2> I believe it was for symmetry with already existing CREATE commands. Especially CREATE LANGUAGE comes to mind. CREATE LANGUAGE is very similar in that what is does is installing a stored procedure programming language into the current database.

Another advantage of using CREATE is that it is an already existing convention in PostgreSQL which means it is obvious that there may be an ALTER EXTENSION and a DROP EXTENSION (both exist). If they had called it INSTALL then it could be either UNINSTALL EXTENSION or REMOVE EXTENSION.

In summary: It is meant to be intuitive to people who are used to SQL databases.

EDIT: And yes, it does "'create'-ive" under the hood. I.e. the various CREATE commands generally insert new rows in the catalog tables (the tables that store the schema definitions and users). pg_extension is the catalog table containing the list of installed extension.

<comment><USER3> Thanks for the explanation.

</comment></comment></comment></comment><comment><USER4> The state of the art of this has advanced significantly with the advent of "extension" support, as seen in CREATE EXTENSION in 9.1+:

      http://www.postgresql.org/docs/9.1/static/sql-createextension.html

The new way is much better than the old way.

</comment><comment><USER5> using postgres 8.4? seriously? as has been said by fdr, the new extension support is far superior!

(there are many other reasons to target newer postgres as well)

</comment><comment><USER6> What modules demonstrate well is PostgreSQL's largely unsung degree of programmability. Most databases tie you to the data types that came out of the box, which leads more complex type modelling to be pushed out into the application code.

But PostgreSQL lets you go in the other direction, pushing type logic closer to the actual data store. This makes data storage smarter and can with a bit of judicious footwork simplify your application code.

<comment><USER7> Indeed. User-defined aggregates[1] are another great tool, and complement user-defined types very nicely.

[1]: <http://www.postgresql.org/docs/9.1/static/xaggr.html></comment></comment>


Psilocybin-assisted group therapy for demoralization in long-term AIDS survivors - <AUTHOR> http://clinicaltrials.ucsf.edu/trial/NCT02950467 <comment><USER2> I firmly believe that a mind-reforming experience like LSD/MDMA/Psilocybin is beneficial to those suffering from debilitating emotional problems. The brain is incredibly plastic, give it a gateway and proper guidance and you can achieve results which border upon near-unreproducibility with any other method.

If it weren't for LSD, I'd have never gotten into lighting research, and the various (read: most common) hobbies associated with it, nor launched a company onto the BBC for no-light fodder production on BBC's Countryfile.

They're all just chemicals, like everything else, including ourselves and the flora which exist within us. Master chemistry and physics, master ourselves.

</comment><comment><USER3> There seems to be a lot of anecdotes about mushrooms helping people get out of a rut. I am glad this is being studied and hope we find some sort of good findings. Too many people suffer from depression.

<comment><USER4> Maps.org has funded a number of studies with promising results. We are beyond anecdote at this point.

Also, we have MDMA in phase 3 clinical trials for PTSD working with the VA. Exciting times!

<comment><USER5> Could you please link to some of the Phase 3 clinical trials, or some info on them? This is one of my favorite fields and I'm so happy to hear about progress!

<comment><USER6> [http://www.maps.org/news/posts/6669-fda-and-maps-agree-on- pr...](http://www.maps.org/news/posts/6669-fda-and-maps-agree-on-protocol-for- phase-3-trials-of-mdma-assisted-psychotherapy-for-ptsd)

</comment></comment></comment></comment><comment><USER7> This word's use was new and a little puzzling for me.

> Demoralization

More or less the sense that you haven't beaten the problem, just accommodated it by means of huge inconvenience (very demanding pill regimen, or chemotherapy)

</comment><comment><USER8> Psilocybin was better than therapy by any measure. It's transformed my life positively.

It's definitely not for everyone! In high dosages it can induce feelings of death. I literally felt like I had died. I had no more ego. I didn't know who I was or where I was. There was only math, logic and reasons. It was as if the veils of reality were lifted to reveal what it was: Math. I saw numbers and formulas everywhere. Then it struck me like a freight train, God IS math, our life is complex system of math, we are living in the body of God.

I've read the pineal gland arises on the 49th day when the baby is inside the womb...how the hell did Tibetan monks know this without science _millenias_ ago? The soul is said to enter the body on the 49th day....it's just...science itself is not enough to explain reality and the universe is what I've come to accept.

I'm hard knock atheist but Psilocybin made me experience spirituality in a highly logical and mathematical manner...it's just frighteningly awesome I am struggling to describe it fully....words can't justify

I realized there was a reason to everything in life. I was here where I was because of reasons which in turn induced actions. I was terribly addicted to substances, locked up in my room.

Just taking Psilocybin a few times induced so much positive changes because it made me experience consciouness on a different world...where I had to physical presence but only my conciousness without ego.

I'm getting goose bumps thinking about the trip. Not so pleasant was seeing eyes, lots of eyes, eyes of providence they call it. I realized those eyes have been watching me all this time and if I didn't turn my life around I would be in hell.

The aftermath of this trip, an overwhelming peace and reduced anxiety, I notice I've become way more social and confident, my posture has improved, I've moved my computer to the living room, I've met new people.

Psilocybin is a drug that will give you answer to all your questions. I reckon religious texts were written while on it.

<comment><USER9> I was a pretty heavy user (1-3 trips a month) for about a year after graduating high school, and I still take it about once a year now. I disagree that it has all the answers, psilocybin does not reveal any great truths or break down the mysteries of the universe. That said I love it and just did a light trip for the eclipse, it can bring calm, peace, love of nature, love of self and others to you, but it is not some magic path to god.

<comment><USER8> Different strokes for different folks but heavy usage leads to reduced effects due to high tolerance. They recommend waiting up to a month if you take large doses. You are right in that it didn't reveal the mysteries of the universe, but my own internal universe. I could explain my anxiety, previous bouts of depression logically once I stopped letting my ego tell me whatever it wants to see....but it certainly felt like...transcendence of sort...I realized this is what Buddhism and Tibetans discovered through deep meditation, they were able to see reality and universe as it is. I'm very interested in these things now whereas before I only had appreciation for it.

</comment></comment></comment><comment><USER10> The way it was worded I read that it was intended to _induce_ demoralization, rather than combat it.

<comment><USER11> That's how I read it, too and was like 'Oh, that doesn't sound like a great research...'

<comment><USER12> I read it that way too. Maybe it should be of instead of for? Not a native speaker, just wondering.

<comment><USER13> This is definitely a confusing sentence, especially for a non English speaker. You can reword the sentence and add something in front (e.g. "The researchers"). "The researchers are using psilocybin assisted group therapy for demoralization in long term AIDS survivors."

AIDS surviors have "demoralization in them". The psilocybin assisted group therapy is being used for that demoralization.

<comment><USER14> > especially for a non English speaker

If you don't speak English, every word will be confusing.</comment></comment></comment></comment></comment>


Chinese companies 'rent' white foreigners - <AUTHOR> http://edition.cnn.com/2010/BUSINESS/06/29/china.rent.white.people/ <comment><USER2> welcome to 2010

<comment><AUTHOR> still valid: [http://www.businessinsider.com/chinas-rent-a-foreigner- indus...](http://www.businessinsider.com/chinas-rent-a-foreigner-industry-is- booming-2015-4?IR=T)</comment></comment>


Based on Arduino device breaks Masterlock for few seconds - <AUTHOR> http://pagego.net/zc2mtqyodmyn

<comment><USER2> The original link is at: [http://samy.pl/combobreaker/](http://samy.pl/combobreaker/)

</comment><comment><USER3> A full explanation of the 3 vulnerabilities he's found is at: [https://www.youtube.com/watch?v=qkolWO6pAL8&feature=youtu.be](https://www.youtube.com/watch?v=qkolWO6pAL8&feature=youtu.be)

</comment><comment><USER4> It only lasts for a few seconds? What happens afterwards?</comment>


11/17 Trademark the word CRUNCHPAD, 11/30 Kill CRUNCHPAD - <AUTHOR>

just got a tip for my crunchpad memorial page (http://crunchpad.com), and apparently TC just trademarked the term on 11/17.
Maybe the whole problem did happen overnight. Why would you trademark a term, if you were going to kill the product 2 weeks later?
2 other interesting facts from the trademark entry: 1. Attorney on record isn't Arrington. 2. Techcrunch isn't really Techcrunch, they are Interserve Inc, with a Delaware registration <comment><USER2> It takes a long time for a trademark to be accepted. Do you know when they _submitted_ the trademark application?</comment>


Reed Hastings: Please Raise My Taxes - <AUTHOR> http://www.nytimes.com/2009/02/06/opinion/06hastings.html <comment><USER3> What's stopping Hastings from paying more now, without any change in the law?

I suspect that he could even make "pay more" a condition of employment at NetFlix.

I'll bet good money that Hastings is arranging things so a huge fraction of the money he makes goes to entities that won't pay a dime in taxes when he dies, that he's going to exempt himself from the estate tax.

</comment><comment><USER4> No offence to Reed, but he can pay more taxes without anyone elses permission.

What he realty wants is for YOU to pay more taxes.

All the people who say "raise my taxes" are saying that.

</comment><comment><USER3> I'm surprised that Hastings didn't mention that there's already a "luxury tax" on CEO salaries over $1M.

Ordinarily, salary is a deductible biz expense. However, there's a cap - <USER2> Netflix wants to pay Hastings $2M/year, it can only deduct the first $1M.

This cap doesn't apply to performance-based pay or options.

Curiously, options and the like for CEOs and so on didn't become popular until that cap was imposed.

Oh, and he's wrong about tax rates. CA's top rate is over 9% (it hits that at around $50k) and the fed top rate is almost 40% and there's a phase out of deductibility of state taxes. If he's paying around 30%, he's not working for salary.

</comment><comment><USER5> Reed writes:

      The reality is that the boards of public companies hate
      overpaying for anything, including executives. But
      picking the wrong chief executive is an enormous
      disaster, so boards are willing to pay an arm and a leg
      for already proven talent

So if it currently takes $2 mill / year in an executive's pocket to get him on board, and that means $3 mill / year pretax (because, as Reed points out, the current tax is roughly 33%), then why, with a higher tax rate, is it going to take any less to get the same executive on board?

The only different between a 33% marginal tax rate and a 50% marginal tax rate, of course, is that now the board have the pay the same executive $4 million pretax to get the same after tax dollars in his pocket ... and the bitching and moaning about high executive salaries will ramp up in proportion.

Reed is a pretty smart guy, but this is a pretty stupid editorial.

<comment><USER6> _why, with a higher tax rate, is it going to take any less to get the same executive on board?_

The difference is that with a pay cap, no matter where an executive works, he gets paid the same. He has no incentive to compete against his peers. Within a high tax-bracket (with no pay cap), instead, executives have incentive to compete, because their salaries are able to differ from one-another.

<comment><USER7> The way I understood it, the pay cap is only for companies that take government money. So companies that are already in trouble are going to be the ones that can't attract the new executive talent they need to survive. If a company that takes government money can't turn itself around and still fails, then all the bailout did was postpone the failure - and the government loses its investment - a bad deal all around.

<comment><USER6> _the pay cap is only for companies that take government money._

Yes, it is. Reed Hastings' proposal is, however, not just for companies that take government money.

 _Perhaps a starting place for "tax, not shame" would be creating a top federal marginal tax rate of 50 percent on all income above $1 million per year._

That isn't to imply that there are not healthier alternatives. Andrew W. Mellon advocated a flat income-tax rate of 10%: [http://www.archive.org/stream/taxationthepeopl033026mbp/taxa...](http://www.archive.org/stream/taxationthepeopl033026mbp/taxationthepeopl033026mbp_djvu.txt)

 _the Government received substantially the same revenue from high incomes with a 13% surtax as it received with a 65% surtax. It is not too much to hope that some day we may get back on a tax basis of 10%, the old Hebrew tithe, which was always considered a fairly heavy tax._

</comment></comment></comment></comment><comment><USER8> Easy to say when you already have f*ck you money. Why does he not take it upon themselves to make things better, rather than suggesting that he, along with EVERYONE ELSE, should do it. What's good for you, isn't always good for me. I don't like everything you do. Stay out of my business. Don't tread on me. Sheesh.

</comment><comment><USER9> Or CEOs could be the philanthropists themselves. If you contract out your building cleaning, for example, start there -- start with the people on the bottom who show up to clean your bathrooms or vacuum your carpets. Find them, ask them if they could use a raise. Then find your next lowest-paid employees, maybe the interns or "temp" people or the part-time workers, give them a raise.

"Paying up" in hopes that prosperity will trickle down has proven to not work very well.

<comment><USER10> Or he could his money in a bank, where it would be lent to new business, used to build houses, etc. Or in a new business as stock, or venture capital. Capitalism - what a great idea !

He seems to think government bureaucrats will do a better job investing the money after they take it from him. Which in itself creates an incentive not to earn more money.

</comment></comment><comment><USER11> It's called "paying back your investors."

If I get rich, it won't be because I'm some superman. It'll be because I had good teachers, good public health, a stable banking system, adequate military and police protection, etc.

If I'm making $10 million a year, I'll gladly pay half of that to support the institutions and people who helped me get rich.

During the United States' golden age, 1945-1975, rich people were taxed heavily. Nowadays, when the country is in decline, they're relatively lightly taxed. No coincidence.

Greed is bad. Selfishness is bad. Community is good. Public investment is good.

As for, "Don't let the bureaucrats take your money!", our government can work well. It has worked very well in the past. It just hasn't lately because it's been run according to conservative ideas such as "Don't let the bureaucrats take YOUR money!"

Your money is not all your money, it's partly our money, because we all helped you make it. Pay back your investors.</comment>


What will it take to get people using PGP for email? - <AUTHOR> I work at a large organization (thousands of individuals). I wonder what would happen if on July 1st I adopted a new email policy, that any non-encrypted email sent to me would be automatically deleted (and an automated reply sent to the sender, containing instructions for how to use PGP).
I can't encrypt all email I'm sending out, unless I have the recipient's public key ... and if they don't use PGP then they won't have one ... and I can't exactly do it for them. I suppose I could send them an unencrypted email saying "I have a message for you, please send me your public key so I can encrypt it") but my guess is that they would simply ignore it if it involves more than 3 seconds of extra "work".
My prediction is that probably it would have no effect, people would just behave as before and would start to complain that I don't respond to emails.
So what would it take to get people --- not just at my company, but in the wider world --- to use encryption?
Is there a single organization out there that everyone corresponds with, that could spark the change, if they abruptly (but with warning) adopted an encrypted-only policy? Maybe banks? Or governments (eg to file tax returns you need a public/private key pair)?
Is there some way to gamify this so that there is an incentive for people to encrypt?
What about a white-hat hacking approach whereby people are shown what is world-readable (and by whom) when they send email unencrypted?
Gmail seems like an obvious entry point ... but it would go against their business model (they could no longer mine your emails).
Is there any hope?
I would still like to try my experiment ... but I also want to avoid becoming the tinfoil-hatted long-bearded crank of my organization. <comment><USER3> Here are some problems, from the top of my head, in no particular order:

      - Subjects can't be encrypted.
      - Encrypted mailing lists are complicated. Do you reencrypt in the middle?
        What software do you use? The mailing list manager you use right now probably doesn't support it.
      - Enigmail still doesn't support storing e-mails decrypted*. As a consequence, full-text search doesn't work.
      - There's also S/MIME.
      - Theres no software to manage public/private keys enterprise-wide.
      - Legitimate server-side email retention requirements for enterprises
      - Many people are quite alright with "most other people won't be able my email; maybe governments can".
      - Most emails quite simply aren't that important.
      - How do you deal with lost keys?
      - <USER2>
      - Often, as a sender at a company, you can not afford to inconvenience contacts.
      - No easy way to synchronize keyrings.
      - Server side spam filtering not possible
      - Out-of-office auto-forwarding
      - The other side uses gmail.
      - Your mother keeps asking why you aren't on Whatsapp.
      - The "metadata" (who mail whom? when? how long are the emails?) is quite telling.

Please solve all of these.

Sorry for the unreadable list. Thank pg for the shitty markup format.

</comment><comment><USER4> My highly cynical take: education. It will fucking take education.

All this "oh my god but PGP is _so complicated_ , how can a regular user be expected to use all this?" thing is crap we use to delude ourselves into ignoring the fact that most e-mail users are too ignorant to understand _why_ invasions of their privacy are so dangerous, let alone that it can be done or how.

Seriously, it's not complicated. There are a ton of everyday tasks that are far more complicated than setting up and using Enigmail, and yet average users do them every day. If people can set up a fucking network printer with HP's crapware, they can most certainly use a PGP plug-in for their e-mail client of choice.

PGP does have a lot of problems, from unencrypted subjects to usability problems with mailing lists and stuff. But it's still better than nothing, and if poor usability were such an important factor, Altair 8800 would have been the first and last PC.

But even if all these problems were to be solved, we'd still face the fact that the vast majority of e-mail users don't even know what a mail client is, don't understand just how widely-available the contents of their messages are, and don't really understand the far-reaching implications of them being available pretty much in the open.

And even _after_ that, we'd have to face the even sadder reality that this is but a really tiny win in terms of privacy, because convincing people to use PGP is _nothing_ compared to convincing people to stop using Facebook, Google and webmasters to stop using the tracking shit that fills 90% of the post-web 2.0 pages.

<comment><USER5> Difficulty is problem #0.

PGP is fucking complicated, annoying, and non-user-friendly to use _as a computer literate individual that codes for a living_. How do you expect the chain-email-forwarding-toolbar-installing-click-here-for-free-smileys average person to understand it, with the knowledge that screwups in encryption land have the very real possibility to render all that work useless?

The average person doesn't see the value proposition for going through all that effort. Shouting "GOVERNMENT SCARY" at them isn't going to work.

Solving problem 0 would be a massive net benefit for society. You need a cross platform and cross client tool that looks good, is easy enough for my gran to understand, and that does the encryption right.

There is no such tool that exists today.

The Catch-22 is problem #1, after problem #0.

You can encrypt your own stuff all day long, but you aren't emailing encrypted stuff to anyone until a critical mass of people have also gotten past problem #0 long enough to have avoided saying "fuck it" and have distributed their public keys to everyone they know.

On top of all this, you're pushing encryption as a philosophical measure rather than a practical one. For more on how pure philosophy holds up when practicality intrudes, look at the free software movement.

<comment><USER4> > PGP is fucking complicated, annoying, and non-user-friendly to use as a > computer literate individual that codes for a living.

I really don't think it is. Yes, it took me two days or so of reading stuff and chaining commands when I was using mutt. Enigmail is literally point and click. You follow a wizard with three screens or so to set up and all you need to learn after that is how to do the whole web of trust thing. It takes about as much time as it takes to learn Word's stupid track changes mode.

Don't get me wrong, I'd _love_ to see it even easier to use, but it's in a state where it's pretty much useable without being a hacker.

> Shouting "GOVERNMENT SCARY" at them isn't going to work.

Not only government scary. People don't understand that snooping e-mail isn't done only by the government, it's also done e.g. by, and for the benefit of, media agencies. The combination of Gmail and Google's bubble alone is enough to limit everyday choices for them, like purchasing things, learning about controversial matters and planning a holiday. Even in the post-Snowden world, most people don't understand that there is a huge audience for personal data besides the NSA, and it has an impact on everyday life beyond scary slogans like surveillance state.

> On top of all this, you're pushing encryption as a philosophical measure > rather than a practical one.

The same can be said of many things that otherwise look idealistic. People are also pushing for widely-available education, or research in fundamental topics like particle phsyics, for what look like "philosophical" reasons rather than practical ones. The gap between "philosophical" and "practical" seems to be one of volume: it's "philosophical" when few enough people understand why it's practically necessary. It's a trait of perception, not an inherent trait of the object, which is why I think it's a matter of education. 30 years ago there seemed to be very little practical value in PCs, too, and anyone pushing for widely available computer use was, at the time, as much philosophical as I am about this today :-).

Edit: not that I am denying the gap that exists between implementing purely philosophical principles and implementing purely philosophical principles _in a practical way_. Linux is, in many ways, less "free" in terms of philosophy than GNU Hurd is. I'll gladly buy a gallon of beer for anyone reading and replying to this post from a computer that runs GNU Hurd.

</comment></comment></comment><comment><USER6> As someone who's spent a lot of time and money trying to solve this problem, I will say that the biggest impediment is usability, and the largest technical hurdle on that front is key management (general users will never, ever take the time to understand what they're supposed to do with their keys). Beyond those problems, though, are the other problems mentioned elsewhere on this page; the inherent weaknesses in email that PGP can't circumvent (specifically the meta-data leaks--who is sending messages to whom). I think Adam Langley's Pond[0] is the most interesting candidate for an email replacement, although it's not yet ready for prime-time (and even further from a level of usability that could reach mass appeal).

[0] [https://pond.imperialviolet.org](https://pond.imperialviolet.org)

</comment><comment><USER7> The only way to get people to encrypt their email will be to make them want to encrypt their email enough to overcome whatever hassle it takes to do so.

Most people seem focused on making the second part of that equation (the hassle) small. Which is great. But even if you can somehow get it to 0, that may not be enough to get it over the hill.

That leaves making people want to encrypt their email. And abstract notions like the NSA aren't going to be enough. It needs to be personal and immediate. So: if you really want to encourage secure email, start intercepting clear email and responding to it. The surprise introduction of a third party in the email conversation will cause most people to realize their email is not secure (which almost everyone doesn't know) and create an impetus for action.

Now, this is a pretty nefarious scheme (grey-hat at best) and extremely dangerous due to the inevitable legal freak-out, and I'm not going to be doing it, but if I wanted to encourage the world to move to secure email, it's how I'd do it.

</comment><comment><USER8> I think the sad truth is that not only is encryption inconvenient for most emails from most users. It is just not even necessary. So, you are trying to decrease convenience for...?

It is worse in the web world. I _want_ someone to be able to index my emails. As I do actually search on them rather often.

Unless there is a homomorphic technology I'm not aware of (very possible) to allow searching over encrypted emails, then I don't know how you can get around the fact that there is a third party that has access to the unencrypted. Once that happens, game is over. Right?

<comment><USER9> well, you could keep a copy/index locally and just search through that..

<comment><USER8> Right, a fairly massive decrease in convenience. And renders search for email rather worthless on my phone. (Which, to be fair, is already rather crappy.)

</comment></comment></comment><comment><USER10> Make email work exactly as it does now, but it is encrypted -- then people will use it. If you make it more inconvenient then it is a non-starter as email privacy from Google or the NSA just isn't a concern for 99.9% of people (stat made up).

<comment><USER11> Google is a great example. People were warned about severe privacy risk of using GMail, but Google made it really easy to use, has amazing spam filtering, and gave away 1 GB of storage.

<comment><USER12> I read an article the other day about how jihadist software developers were complaining that higher-up leaders in their terrorist organization refused to switch away from GMail. And this from the very groups that should have known better!

I can only assume that problem has been fixed after Snowden leaked PRISM, but it illustrates the mentality you speak of quite vividly.

</comment></comment></comment><comment><USER13> It seems to me that S/MIME has a better chance for wide adoption due to it being built in to many email clients (Mail on OS X/iOS at least.) However it's still up to the user to get a certificate, which is a barrier. But I'm curious what others think, as I haven't seen S/MIME brought up in the recent encrypted email threads.

<comment><AUTHOR> It's true, S/MIME would seem to be a more convenient method for wide adoption...

<comment><USER3> The problem with S/MIME is that it is strictly hierarchical. That already hasn't worked well for TLS.

The aim of email encryption is in a large part to prevent government-level parties from reading the emails. It doesn't really make sense to then go back to a system controlled by the very same parties.

OpenPGPs web-of-trust model seems more appropriate.

But both approaches share a significant number of problems, so...

</comment></comment></comment><comment><USER14> I think it's a great question.

When I think about why I don't use pgp personally, and why I don't encourage others to use it (besides the fact that no else uses it) it's a functionality issue. I need to be able to access my email via my computer, phone, AND web browser (potentially not on a computer I own/control). My understanding is that is not easy to accomplish - maybe I've been misinformed. Until then, it's hard to start using pgp.

To answer your question, a good place to start might be a company like Good Technology - given their involvement in email solutions for so many large corporate customers.

</comment><comment><USER15> Here's a scheme I've been thinking about. It's an opportunistic PGP setup:

1) Whenever you want to send an email you look up the PGP certificate for the domain (yes domain) you are sending it to in some central keyserver. If you find it pin that certificate for future use and sign and encrypt the email. If you don't find it just send a normal email, possibly still signing it.

2) For a sysadmin to start using the scheme just publish a public PGP key in the central keyserver and when you receive an email that's encrypted with your domain key decrypt it and deliver it to your user.

This buys you a few things. For large hosting providers (say Gmail) you get a little better security than the current SSL between mailservers setup because it's harder to MitM and can be relayed between mailservers without security issues. You also get a PGP signature attesting that the email does indeed come from @gmail.com and isn't spoofed. Individual users that care can then use this scheme to get user-level encryption by having email in their own domain @myname.net. You could even outsource the @myname.net mail server to a normal POP/IMAP provider and publish the PGP key to the central server yourself. The provider then gets the encrypted mail and you decrypt it locally in your mail software.

But maybe relaying doesn't really happen these days and fixing STARTTLS would give you most of this with SSL certificates instead.

<comment><USER6> _Buy maybe... fixing STARTTLS would give you most of this with SSL certificates instead._

Bingo.

<comment><USER15> The only thing TLS in the mail server can't give you is a way to outsource the running of your domain's MX server without trusting that server with your SSL key. If the sending server PGP encrypts instead you can decrypt it later.

That would make running your own mail a little easier. Use any normal SMTP/POP/IMAP email service to handle the network side and then encrypt/decrypt locally. You only have to trust your own mail user agent running on your own hardware. As it stands right now to run my own email (something I've been contemplating) I have to either put my SSL key in a machine I don't control (e.g. Linode VPS) or try to run a mail server on a residential internet connection. Neither seems a good option.

</comment></comment></comment><comment><USER16> I thinnk PGP can't have a widespread adoption on its own. We need to piggy- back it on another network of trust.

Here's a scheme for such an application:

\- By default, if the person you're communicating with is not in the network, you're out of luck. Maybe send a message along these lines: "I'd like to communicate with you but you don't have a secretcommunication key. Could you please create one so we can have some privacy ?"

\- On first launch, you create a PGP pair and send the public key to networks you trust: Facebook, G+, HN, reddit, whatever. By "trust" I mean "you trust the network to give you the correct identity of your contacts": you've befriended that Maria on Facebook, so you can trust it to give you the correct public key that Maria created on her machine

\- When you want to send an email to maria, your application fetches the public key on either network (if it doesn't have it already) and uses it to encrypt your communication. Note that the application MUST NOT sign the identity for you; it should just raise no warning. It MUST always be up to the user to sign these.

In a very broad sense, that's what keybase.io is doing: instead of being yet another provider of trust, it re-uses the trust you have already built in other networks.

The number 1 problem to tackle is make sure anyone who wants to create an account will also create a PGP key.

</comment><comment><USER17> > Gmail seems like an obvious entry point ... but it would go against their > business model (they could no longer mine your emails).

A few ideas why google won't mind encryption that much:

[http://www.reddit.com/r/tech/comments/278cze/google_launches...](http://www.reddit.com/r/tech/comments/278cze/google_launches_chrome_extension_endtoend_for/chyftx9)

> Is there any hope?

TextSecure is already offering a secure communication service(that in my view could be a decent replacement for email). They will also release a browser extension in the future. Those(and the fact google's involved) are good signs for google's encryption project , at least technically.

And assuming the technical infrastructure for easy encryption does exist, i can see some sort of hybrid model[1] becoming popular and/or mandated in some groups, and growing from there.

[1]For example, textSecure/redPhone's model lets you send sms to everybody, but if it detects the other side has encryption , it encrypts it. There's also an easy to use method for out-of-band key verification.

</comment><comment><USER18> When people/media/govt/everyone is/are still arguing whether the surveillance state is merited or not, whether Snowden is a traitor or not, a technical solution is meaningless. The argument over whether it needs a solution needs to be "solved" or at least agreed on enough that their is an "issue" to be "solved" anyway.

</comment><comment><USER19> In a large company, such a change only has a chance if it is mandated from the top and then the mgmt team is very committed to push the change through for as long as it takes. Without both pieces it will get killed by apathy at the middle management layer and below. Without that support the technical solutions will gain no foothold.

</comment><comment><USER20> First, somehow make popular email software developers (Thunderbird, Mail.app, etc.) to include OpenPGP support out-of-the box and make it easy to use. I.e. not a scary-looking interface hidden beneath 4+ clicks deep in settings, but a simple-to-get "security" button and an unobtrusive suggestion to generate or import a keypair on account creation. This is an absolute necessity. For webmail providers ask them to at least provide signature verifications for PGP-signed mail - that should be acceptable even for Gmail-like ad-based mail- sniffing business model.

Then, just start using OpenPGP. For every recepient with a known key encrypt the message, for others - sign it. Users will notice your emails have some fancy security-related icons and curiosity will eventually prevail.

Almost works with S/MIME for me (but since obtaining a certificate is not trivial - only "almost", not really).

<comment><AUTHOR> "Users will notice your emails have some fancy security-related icons and curiosity will eventually prevail."

I wish this were true

<comment><USER21> There's a precedence: browsers and their green URL bar blocks for secured connections.

</comment></comment></comment><comment><USER22> I'm going to suggest a compromise way to get wide scale email encryption rolling out: The key benefits are that (1) the user doesn't have to do anything at all and (2) it prevents mass surveillance and recording of email, but with a downside that it's not authenticated. There's significant benefit even when it's non-authenticated.

These days I get email from the other side of the Earth in several seconds. So adding a few more seconds to delivery shouldn't be a deal breaker on what I'm about to suggest.

Let every email client do opportunistic _non_ -authenticated encryption with every other email client. That way, the user doesn't have to do a damn thing.

Example: Alice wants to send an email to Bob. Before sending the real email, Alice's email program sends an ephemeral public-key to Bob's email program -- hoping that Bob's email will promptly reply with its own ephemeral public-key. If Alice gets a reply within, say, 20 seconds, great. They can now send encrypted but non-authenticated email to each other. If Alice receives no reply or an error message, then her email program sends the email the usual way (as plaintext).

At this point, most readers will yell "man-in-the-middle attack." Bear in mind that this can be built upon and improved. The advantage is that it requires _nothing_ at all from the user; the user might not even realize the email is being encrypted and decrypted. It requires only that the email client developers agree on the handshake mechanism.

But importantly, this thwarts the problem that we're most worried about, which is mass NSA surveillance. Yes, the NSA or others can still do targeted MITM attacks, but they are unlikely to do a MITM on every email exchange. And if they did, it would be detected and _provable_ , and result in a backlash demand for authenticated encryption. Furthermore, clandestine wholesale recording of your emails is useless because the keys are ephemeral.

<comment><USER6> Using Gmail (or any SSL-enabled mail server) already affords you those protections. (I'm not trying to be a naysayer, just that the protections PGP provides specifically go a step beyond what you're describing, which we essentially already have.)

<comment><USER22> > _Using Gmail (or any SSL-enabled mail server) already affords you those > protections._

It absolutely does not.

What I'm suggesting is end-to-end. With Gmail or with SSL-enabled connections, the host (Google in your example) can read your email; the encryption there is only between you and Google.

I'm saying that the key exchange should be from your email client (Thunderbird, Outlook, a browser) to the other person's client. I think it could be made to work even with Gmail if the functionality was built into the browser.

<comment><USER6> I didn't read your parent comment as a suggestion for peer to peer ephemeral exchange. In that case you would be correct, but negotiating server less peer to peer key exchange (especially on mobile devices) isn't currently practical.

EDIT: s/parent comment/your parent comment

</comment></comment></comment></comment><comment><USER23> You could adopt a company policy that mandates PGP for everyone as it's not that difficult to create, distribute and revoke public keys for your employees. Problems arise when you try to apply this process to the larger public, as that means having people self-sign their certificates for their public keys or having one user vouch for another. But that's where security breaks. Even with CAs on the internet you're never 100% sure you're talking to a legit entity; any scenario where CA aren't even present is just a nightmare that doesn't improve security by one bit. It's not just about making sure nobody except the recipient can read emails it's also about making sure that the recipient is legit, and that's the problem.

</comment><comment><USER24> Suppose, hypothetically, that there was some kind of ultra-phishing virus that resulted in a 1/100 chance of _losing money_ as a result of sending unencrypted email ... people still wouldn't use PGP. They'd switch to facebook messenging or SMS or something.

It's just too much hassle. People don't use it unless they absolutely need to. _Signing_ is slightly more common, and might be easier to bootstrap.

Start by signing your mail. We might be able to persuade banks and other phishable businesses (e.g. Paypal) to start signing mail too. That gets the keys in place.

You mention gamification; some sort of automated system that hands out rewards or does something useful if you send it a PGP-signed mail might be a way to do this.

</comment><comment><USER25> The problem will all come down to UX.

* Key generation and exchange is a challenge. Most people I have taught how to use gpg / pgp can't seem to figure out how to publish there keys, send or receive keys.

* Entering your password often is a pain. Most people I have taught have given up using this on a day-to-day basis because its just such a pain.

As an aside, there's the problem of improper use. Right now there are too many choice as to how you can setup pgp leading to the problem of people using it wrong. And don't get me started on private key security. Most people _do NOT want to think about this_. Quite honestly, I agree. Something needs to be done to make it very hard to compromise your own private key.

</comment><comment><USER26> Addresimg the issue of key availability could be perhaps achieved by OS compatibility. Eg. If two Mac users send each other an email to iCloud addresses it can be encrypted by default and have iCloud manage the key exchange. This is just a thought on using the cloud as a part the key management similar to what Exchange does. It does not mean that is not hackable since compromising iCloud would compromise both clients but it could be a good start. Encryption by default among same cloud users.

</comment><comment><USER27> I agree with the points people here have brought up. For my part, I think it would be good to at least have a seamless OpenPGP interface with at least signing enabled for all mails (if encryption not always possible), and I'm working on [https://autonomail.com](https://autonomail.com) to that end. Other folks (like [https://whiteout.io](https://whiteout.io)) are also working on similar solutions.

</comment><comment><USER28> You already identified the "usability" issues. It would need to be a system that required people to just get once a "code" for their computer. And then another systems auto detect if the recipients has also a "coded" machine.

Encryption is just inconvenient for the average user and doesn't provide some immediate benefit ("My bank needs encryption but I don't need to encrypt my funny cat pictures").

</comment><comment><USER29> You can make a seamless experience so that people don't even realize that their email is encrypted, but then the problem becomes: if their computer crashes and they lose their private key, they have now lost access to every previous email ever written. That's just unacceptable. I closely guard several backups of my private key, but most people aren't going to create an enormous single point of failure like that.

<comment><USER20> Backups can be seamless, too.

Just a tiny unobtrusive icon "hey, your key wasn't backed up, want to fix that?" would probably do the trick.

And with a proper passphrase I think one can even backup to the cloud(tm) without much worries.

</comment></comment><comment><USER30> About usability. Well, I'm not an expert but runbox.com (with their roundcube interface) or unseen.is let you use gpg keys in a really easy way. They generate (or you can import) a pair of keys in the browser so they never have access to them. The only catch is that if you erase your cache or their cookies, you lost your keys and have to import them again. By default, runbox sends your public key as an attachment.

</comment><comment><USER21> While I understand Sae5waip's list of put-me-downs, I can't really sympathise with it. A lot of the usability problems boil down to two things, namely

      * UI/UX, along with proper client integration
      * Discoverability and bootstrapping of the web of trust

Make it easy to discover users' PGP/GPG keys, and trivially easy to use them. Integrate GPG-agent or something with similar functionality so users do not have to type their passphrases _all the time_.

Then start with sign-by-default policy for all outgoing mail, and add a simple way to show the distinction in the mail client UI. Remember when browsers started to show the green locks in URL bars? It wasn't a panachea, but it at least made things less awful.

Now... I'm not saying it would be easy, and I certainly don't have enough hubris to claim that I could be able to design a solid, end-user friendly PGP system by myself. But I sure as hell would love to be involved in building one.

I try to imaging what the world would be if Google provided a globally reachable and easily integrated (on client side) PGP key server pool.

EDIT: bulletpoint appearance

</comment><comment><USER31> PGP cannot encrypt the _"subject"_ header or metadata like the "timestamp", "to" and "from" fields.

[https://www.gnu.org/philosophy/no-word- attachments.html](https://www.gnu.org/philosophy/no-word-attachments.html)

</comment><comment><USER32> As an interim solution you can setup a secure contact form on your company website like [https://encrypt.herokuapp.com/](https://encrypt.herokuapp.com/) \- it encrypts the message before sending it to you.

</comment><comment><USER33> From the perspective of this sysadmin: get Microsoft to build PGP into Exchange, and integrate the functionality into Outlook. It would be the tipping point you seek, perhaps the only one that exists.

</comment><comment><USER34> We have had a similar discussion in the past: [https://news.ycombinator.com/item?id=6663098](https://news.ycombinator.com/item?id=6663098)

</comment><comment><USER35> IMO, the issue is that real security is inconvenient, and my email is just not that secret.

</comment><comment><USER36> Absolutely streamlined interface where they have to do pretty much nothing for it to work.

</comment><comment><USER37> What it would take is to not have to know that you're doing it.</comment>


Digitized minutes of Royal Society meetings taken between 1686 and 1711 - <AUTHOR> http://blogs.royalsociety.org/history-of-science/2019/01/15/meeting-sloane/ <comment><USER2> This is great news. I'm a historian and have gone to the Royal Society archives to read these draft minutes in the past (I was looking for references to experiments involving psychoactive drugs on one research trip, and on another I was researching the Royal Society's run-in with the infamous impostor George Psalmanazar).

Happy to answer questions about the meeting minutes or their historical significance if anyone is interested. Hans Sloane is pretty fascinating in his own right and was recently the subject of a biography: [http://www.hup.harvard.edu/catalog.php?isbn=9780674737334](http://www.hup.harvard.edu/catalog.php?isbn=9780674737334)

<comment><USER3> Does any of the meeting minutes contain a reference to [https://en.wikipedia.org/wiki/Gottfried_Wilhelm_Leibniz](https://en.wikipedia.org/wiki/Gottfried_Wilhelm_Leibniz) that you know of ?

<comment><USER4> First page of the 1707-1711 editions, I found this sentence, sure there's likely more ...

"A proposall was read by Dr. Papin concerning

a new invented [deleted] to be row'd with oars mov'd

by heat. The farther consideration of It was also referred to ye. next meeting.

A letter was read from Mr. Leibnitz concerning

Mr. Papin & this new boat."

<comment><USER5> Some context around Papin and his boat from wikipedia[1] for those interested:

> In 1705 he developed a second steam engine with the help of Gottfried > Leibniz, based on an invention by Thomas Savery, but this used steam > pressure rather than atmospheric pressure. Details of the engine were > published in 1707.

> Papin returned to London in 1707, leaving his wife in Germany. Several of > his papers were put before the Royal Society between 1707 and 1712 without > acknowledging or paying him, about which he complained bitterly. Papin's > ideas included a description of his 1690 atmospheric steam engine, similar > to that built and put into use by Thomas Newcomen in 1712, thought to be the > year of Papin's death.

[1] [https://en.wikipedia.org/wiki/Denis_Papin](https://en.wikipedia.org/wiki/Denis_Papin)

</comment></comment></comment></comment><comment><USER6> This is absolutely fascinating. There is a handy transliteration available by clicking on the sheet of paper icon. Some bloke called Mr Hook gets around a bit in the 1680s at least:

 _Mr Hook gave an account of the book recommended to him affirming that the Author had well determined the problem of the pressure of a body upon an enclined plain; the second part about the separation of the gall in the Liver to which he could not so readily asset Mr Hook affirmed that the manner of evacuating Damps at Leige is after the manner of the engine for consuming smoke_ (17 Nov 1686) At that time (~November 1686) body preservation is a pretty hot topic, interspersed with say _Mr Hook Shewed to the Satisfaction of the Company the Shells in & on the Nautilus_

This is a window on the past that is absolutely priceless. The minutes are terse and have the feel of being hastily scribbled at times but that adds to their charm. You keep on finding gems:

 _the Magnitudes et cet of London and Paris;_ \- so et cet is perhaps the original abbreviation of et cetera, before the modern etc. etc is very much a feature in modern English usage and to see it in use back in the 1680s shows a pretty deep continuity within some aspects of English (yes, I know it is really Latin).

Smashing.

<comment><USER7> I bet that was Robert Hooke[1]. They were less exacting about spelling back then.

1\. [https://en.wikipedia.org/wiki/Robert_Hooke#Royal_Society](https://en.wikipedia.org/wiki/Robert_Hooke#Royal_Society)

</comment></comment><comment><USER8> Is there a version that lets you look at the pages without forcing you to use that disastrously slow Turning the Pages application? The page turning animates like a tortoise crawling through molasses under a strobe light.

<comment><USER9> For me the page turning itself doesn't seem to be slow but choosing this gimmicky mechanism as a delivery vehicle for this kind of content is, well, a silly choice.

I can't zoom in enough and when I do zoom in I can't pan around when the page doesn't fit my browser window. Both left and right click turn the page.

Aaaargh...!

Whom ever is behind this, can we just have images please? Thank you.

</comment></comment><comment><USER10> Is it only me? I think I lost the ability to read cursive handwriting. I tried reading a few pages, and it is really hard for me to follow what is written.

<comment><USER11> The handwriting is pretty sloppy on at least the first few pages from what I see. A lot of the letters become so small that they're little more than bumps on a line. Being in cursive certainly doesn't help either. Some of the words use alternate spellings which makes them a little more difficult to recognize.

But really, cursive is optimized for reducing the possibility of failure (inkblots) on primitive quill pens, not for readability. Even the best most precise cursive tends to be more difficult to read than modestly competent print.

<comment><USER12> > Even the best most precise cursive tends to be more difficult to read than > modestly competent print.

That's purely a practice effect, like the fake finding that lowercase text is easier to read than all-caps text. (People you pull off the street do indeed read lowercase text faster. After a minor amount of practice, this advantage disappears.)

There are a lot of cases here where a series of letters appears to have been reduced to just a wave pattern. But the biggest problems I have at first glance are

\- You can't zoom in far enough

\- Some letters are written in an unexpected (consistent, but not modern) way. Look at how e is always written like you'd expect a cursive o or a σ to look. This difficulty will be easily overcome if you spend any time reading the text, but as of now I have a lot more trouble identifying what letters have been written than identifying what word a sequence of known letters is supposed to represent.

On the other hand, a lot of it looks perfectly fine. "This occasioned much discourse of the cause of Fountaines, and Dr Robinson was of opinion that (stormes?) occasiond by a subterraneall heat, either of fire or" (eighth bullet point at the beginning of 1686).

</comment></comment></comment><comment><USER13> For those that are interested in what else the Royal Society archives hold, I wholly recommend the Objectivity YouTube Channel ([https://www.youtube.com/channel/UCtwKon9qMt5YLVgQt1tvJKg](https://www.youtube.com/channel/UCtwKon9qMt5YLVgQt1tvJKg)) created by Brady Haran (of Periodic Videos, Numberphile, Computerphile, etc.)

<comment><USER14> I second that recommendation. I've watched a number of Objectivity videos and the content is amazing and fascinating for those interested in the history of science and people at the Royal Society (and occasionally other scientifically historical places).

</comment></comment><comment><USER15> It looks like even the brightest scientific minds of the past forgot to increment the year after January 1. Even as late as March and April in some years.

<comment><USER16> Might be using the 'official' 25th March date for new year? [1]

The will probably be a 'readme' somewhere on the site about old style dates.

[1] [https://en.wikipedia.org/wiki/Gregorian_calendar#Beginning_o...](https://en.wikipedia.org/wiki/Gregorian_calendar#Beginning_of_the_year)

<comment><USER17> > In common usage, 1 January was regarded as New Year's Day and celebrated as > such,[40] but from the 12th century until 1751 the legal year in England > began on 25 March (Lady Day).[41] So, for example, the Parliamentary record > lists the execution of Charles I on 30 January as occurring in 1648 (as the > year did not end until 24 March),[42] although later histories adjust the > start of the year to 1 January and record the execution as occurring in > 1649.[43]

Super interesting, thanks!

</comment></comment></comment><comment><USER18> The book, "The Fellowship", references these meeting minutes, along with other research from this period in time: [https://www.amazon.com/Fellowship-Gilbert- Newton-Scientific-...](https://www.amazon.com/Fellowship-Gilbert-Newton- Scientific-Revolution/dp/1590200268)

<comment><USER19> Neal Stephenson's Baroque Cycle also covers the Royal Society at this time in history.

</comment></comment><comment><USER20> Unfortunately not early enough to have covered Margaret 'Mad Madge' Cavendish's [[https://en.wikipedia.org/wiki/Margaret_Cavendish,_Duchess_of...](https://en.wikipedia.org/wiki/Margaret_Cavendish,_Duchess_of_Newcastle- upon-Tyne)] attendance in 1667.</comment>


Google is starting to reveal the secrets of its experimental Fuchsia OS - <AUTHOR> https://www.theverge.com/2019/5/9/18563521/google-fuchsia-os-android-chrome-hiroshi-lockheimer-secrets-revealed <comment><USER2> I can't help but think this is another attempt to lock down people and devices into a Google-controlled platform where they can be spied on and sold to the highest bidder.

Does it seem suspicious to anyone that Google is pushing Fuchsia just as truly open Android phones like Puri.sm and /e/ are coming to market?

<comment><USER3> Ugh...the conspiracy talk is baseless

<comment><USER4> Android is open source but without Gapps you can't use 90% of the mainstream apps or certain features (Google Play Services, Frameworks or whatever it's called now). That's why Android without Google is a complete pain, and why microG exists. We're already locked in.</comment></comment></comment>


5 Most Essential Vim Commands for Beginners - <AUTHOR> https://bojanvidanovic.com/posts/5-most-essential-vim-commands-for-beginners/ <comment> Pick-A-Hill2019 Ok, I'll bite. While searching for witty duplicate comments along the lines of #1 alias vi='nano', #2 alias vim='nano' I came across this [https://devrant.com/rants/545014/alias-vi-nano-alias-vim- nan...](https://devrant.com/rants/545014/alias-vi-nano-alias-vim-nano) which just made me laugh & nicely sums up the Spaces vs. Tabs debate</comment>


Better Than Free - <AUTHOR> http://www.kk.org/thetechnium/archives/2008/01/better_than_fre.php <comment><USER2> This exposition is an interesting cluster of approaches to a situation many startups are facing: "When copies are free, you need to sell things which can not be copied."

Definitely worth mining for strategies that apply to your startup.</comment>


Is documentation essential or not, and what should we know about this topic? - <AUTHOR> https://larsroettig.dev/how-to-write-proper-software-documentation/ <comment><AUTHOR> Why is Software Documentation underestimated? In my experience, most developers underestimated the value of proper software documentation. Back in the time as a junior developer, I also took every opportunity to avoid documentation. So the documentation for certain features was the code and me.

Read more:</comment>


The best ping story I've ever heard - <AUTHOR> http://www.askapache.com/hacking/ping-unix-darpa-muuss.html#ping_story_Ive_heard

<comment><USER3> I once recovered a stolen car with ping.

It was 2002 (2003?), and we had just launched Zipcar in New York. Being a naive start-up we had perhaps not the most stringent security measures in place to prevent fraud and theft. Sure enough, a couple of weeks in and one of our cars went missing. Calls to the member went unreturned, and it became clear that the member was not who they claimed to be and had no intention of returning the car.

At the time Zipcar was using the mobile analog CDPD network for vehicle communications, which had a top speed of something like 19.2k/s and cost us around $1/month per KB of data. However, it also had a limited number of data channels, and since it used the old AMPS network broadcast in the 800 - <USER2> MHz range. I happened to have an amateur radio license and a radio that was able to receive in that band.

Since we were still in contact with the missing car we knew it hadn't been chopped (yet) and I figured we might be able to use some sort of radio direction finding technique to locate the car. My friend and fellow engineer Carl was able to reprogram the firmware of our embedded electronics to tell us which cell tower the car was in contact with, and with that we could look up the FCC id in their database to find the tower's street address.

So my boss Roy and I hopped into his car and drove to Long Island. We drove up to the tower, and I leaned out the window of his minivan with a yagi antenna and my radio (set to scan the 40 or so CDPD channels.) We asked Carl (back in Boston) to start pinging the car. To the radio this sounded like a half-second burst of static, but since it was very regular it was also very easy to identify. Sure enough, after driving around for a few minutes we picked up the signal. _pffft_ _pffft_ _pffft_

We drove around the tower in a wide circle until the signal was the strongest, got out to scan the area, then used the new bearing to reduce the circle. Eventually we ended up in the parking lot of the Long Island railroad. There in the back corner was our car, luckily unscathed and none the worse for wear.

Ping rocks.

<comment><USER4> Did you guys get the Cops involved?

<comment><USER3> Yeah. Once we found the car we couldn't move it or even open it since it had been reported stolen a few days before. My memory is foggy but I recall it taking a couple hours for an officer to show up, and they were really confused that we had found our own car.

</comment></comment></comment><comment><USER5> This is a good one too, although not strictly ping related.

[http://www.ibiblio.org/harris/500milemail.html](http://www.ibiblio.org/harris/500milemail.html)

<comment><USER6> There's also this legendary Amazon review, which _is_ strictly ping-related: [http://www.amazon.com/review/R2VDKZ4X1F992Q](http://www.amazon.com/review/R2VDKZ4X1F992Q)

<comment><USER7> Good grief, I'd forgotten about that one. Hard to believe it's still up almost 15 years later. A true classic of the Amazon review genre. Who would have thought they would become a cultural repository?

</comment></comment></comment><comment><USER8> [http://bash.org/?5273](http://bash.org/?5273)

Surely most people reading this will know the quote linked without having to even click it.

<comment><USER9> It's not as fun as it was >10 years ago. Tablets and smartphones ruined it..

<comment><USER10> Why did they ruin it? It's due to smartphones that I've had a similar experience on at least one occasion. I couldn't find my phone, but I noticed it was connected to the home Wi-Fi network and, since it was a jailbroken iPhone, I could SSH into it. (It went to sleep aggressively, of course, but I woke it up by dialing the number or something.) While the iPhone has a built- in feature to remotely play a tone on the speaker, I couldn't seem to hear it from anywhere in the house. So I tried using a command-line tool (might have written it actually, don't remember) to activate the cameras and take a picture with each; unfortunately the result was just two dark blurs. Eventually I found it buried in a couch, the soft fabric muffling the speaker...

If I were more sophisticated, I could have measured Wi-Fi RSSIs from it, or tried to bring Bluetooth devices into range. Lots of ways to try to find things nowadays, but none perfect!

</comment></comment></comment><comment><USER11> IN particular, that story is about 10Base2, where the topology is not hub-and- spoke but a single cable that snakes from NIC to NIC, with BNC twist-lock connectors and a T-junction at each stop. (And a required termination resistor at the end to stop reflection...)

</comment><comment><USER12> The linked page appears to be a spammy copy of the original here: [http://ftp.arl.army.mil/~mike/ping.html](http://ftp.arl.army.mil/~mike/ping.html)

It doesn't correctly credit the real author of ping: [http://en.wikipedia.org/wiki/Mike_Muuss](http://en.wikipedia.org/wiki/Mike_Muuss)

<comment><USER13> Thank you firstname.lastname@example.com for seeing that Mike Muuss's pages have been preserved, going on 15 years now.

Interesting note I hadn't read before: "This Web server was one of the first 50 Web servers on the InterNet, making it a pioneer in its own right."

</comment></comment><comment><USER14> Do someone know how to run a command for every line emitted in a unix pipe? I tried the oneliner in the linked story using Mac OS X's `say`, but it doesn't work with pipes.

<comment><USER15> ping goodhost | sed -l 's/.*/ping/' | while read line; do echo $line | say; done

<comment><USER16> Bit of a tangent, but using the voice "Tom" on OS X, saying "ping" says "pling" instead. Fine with other voices but rather curious.

</comment></comment></comment><comment><USER17> After a cross country move to a remote coastal town, my wife and I were left at our destination with only a small portion of our possessions. The rest of our stuff was making its way there with the hired movers.

I got into a strange situation where I needed my Mac Mini for something, but it was still trying to connect to an old wired connection instead of the new wireless one. I didn't have any of my cables or display adapters -- just a keyboard.

Long story short: the Mac Mini has an internal speaker, and OS X comes with a vocoder shell program. I managed to boot into the OS and launch terminal, and blindly typed commands into it, piping the output to the vocoder app until I got things working.

</comment><comment><USER18> Ping fans, be sure to check out bing! Fun stuff and 97.2% accurate (not really)! :)

> Bing is a point-to-point bandwidth measurement tool (hence the 'b'), based > on ping. Bing determines the real (raw, as opposed to available or average) > throughput on a link by measuring ICMP echo requests roundtrip times for > different packet sizes for each end of the link.

[http://fgouget.free.fr/bing/bing_src- readme.shtml](http://fgouget.free.fr/bing/bing_src-readme.shtml)

<comment><USER19> This looks pretty ancient (source files dated 1997), and won't compile here. Any maintained version?

<comment><USER20> I'm a fan of nttcp, although it's not based on ping.

[http://linux.die.net/man/1/nttcp](http://linux.die.net/man/1/nttcp)

</comment></comment></comment><comment><USER21> Is it just my network administrator or do others drop outgoing Ping messages at the corporate firewall? This has cost me and others more time than I would like to admit for some vague "security" reason that he won't or can't explain.

<comment><USER11> Start with a default-deny policy, the only sensible course. (Google "IP over ICMP".) Note that some sysadmins need to verify external connectivity, so allow ICMP echo reply messages to those IPs (or subnets, more likely).

Result: if your machine isn't in one of those blessed ranges, you never get a response to a ping to an outside address. Most users don't complain, because they don't even know what a ping is.

So, it's not just your company, but it's not general practice everywhere.

<comment><USER19> Blocking ICMP is a questionable practice in my opinion. It generally just complicates troubleshooting for a marginable gain in "security" and some applications even require it for PMTU discovery.

If you're really worried about user tunneling out through various tricks, you'd probably have to block the whole internet and apply a whitelist of trusted destination hosts.

As a heavy ping user, this blockage always bothered me, so I started working on a similar tool to get around this:

[https://github.com/silverwind/tcpie](https://github.com/silverwind/tcpie)

</comment></comment></comment><comment><USER22> We once had an Ericsson MSC that only replied to _uneven_ ICMP packets due to some bug.

Made it look like there was 50% packet loss on an otherwise perfectly good Cat 5 cable...

(edit: ICMP instead of IP)

<comment><USER23> Checksum issue?

<comment><USER22> IIRC, there was nothing on the logs and they eventually shipped a fix. I was there when it happened and was called over to have a look.

</comment></comment></comment><comment><USER24> And now, 2015, in my corporate networks ICMP messages are filtered by firewall (they say that's due to security reasons). Is this the beginning of the end of ping?

<comment><USER25> ping will be the last thing to die before they turn the internet off.

</comment></comment><comment><USER26> now I'm really tempted to add some voice notification function to pingd [[https://github.com/pinggg/pingd](https://github.com/pinggg/pingd)]</comment>