Psychic Paper: iOS Sandbox Escape - <AUTHOR> https://siguza.github.io/psychicpaper/ <comment><USER3> This reminds me a lot of one of the original ways to run unsigned code on the Sony PSP.

If you made two directories:

        SomeApp
        SomeApp%

And then launch the folder with the % sign then the code that checks for valid signatures will check in the directory without the %, but the code that actually launches the binary will still run the code in the directory with the %.

So all you need to do is get any binary with a valid sig and put it in the SomeApp folder while putting the code you actually want to run in SomeApp%.

<comment><USER4> Why did this happen? Was "%" significant in some way? i.e. maybe it was passing the path to sprintf?

<comment><USER3> Yep, that's exactly it. And of course a lesson on why you need to understand the progeny of any string you pass as a format argument.

</comment></comment></comment><comment><USER5> A while back I filed a bug on libplist with some examples of the hilarious this-is-not-XML issues in Apple's userland plist parser, which people might find fun here as it is highly related to this issue.

[https://github.com/libimobiledevice/libplist/issues/83](https://github.com/libimobiledevice/libplist/issues/83)

<comment><USER6> Jay, I just wanted to say thanks to all the groundbreaking work you've done in the jailbreaking scene. Ages ago I had an iPad Touch and I had so much fun jailbreaking it and playing around with Cydia tweaks.

</comment></comment><comment><USER7> > I just hate GUIs for development, especially when you Google how to do > something, and the answer is a series of 17 "click here and there"s that are > no longer valid because all the GUI stuff moved somewhere else in the last > update.

It's not just developer tools that suffer from this problem. I opened iMovie recently after not playing with it for almost 10 years, and was so flabbergasted at how everything worked. Took me almost 2 weeks to sync my own song to a series of cut video clips (cut out of larger videos, which was the main problem). Maybe I'm just an idiot, but googling around for solutions ended up with either out-of-date answers or completely unrelated problems.

I just wish that the app would use even one or two conventions from the 40-50 years of GUI research that has been done...

<comment><USER8> I'm convinced that the reason for the constant game of GUI musical chairs - <USER2> which Microsoft is the most guilty - is due to developers attempting to justify their employment.

<comment><USER9> My experience has been the opposite - developers being resistant to frontend changes, which tend to get pushed through by UI/UX people (which is their job), or in more broken organizations, opinionated managers or executives.

</comment></comment></comment><comment><USER10> Maybe we should take this as a lesson that we should use the simplest marshalling format that adequately captures our use cases rather than using a swiss-army knife format like XML.

<comment><USER11> I'm not sure that there were much better choices available at the time. IIRC property lists date back to NextStep.

By the time stuff like JSON started popping up, plists were pervasive all throughout OS X. Typical legacy problem!

<comment><USER12> Property lists in NeXTSTEP didn't use XML but rather a different text-based format.

[https://developer.apple.com/library/archive/documentation/Co...](https://developer.apple.com/library/archive/documentation/Cocoa/Conceptual/PropertyLists/OldStylePlists/OldStylePLists.html)

</comment></comment></comment><comment><USER11> Once binary plists were introduced, it was only a matter of time before it became the macOS equivalent of windows registry.

The fact that Apple is maintaining multiple parsers, and apparently added yet another in response to this bug, just smells bad.

<comment><USER13> I thought the Windows Registry was reviled because it was a single database that held everything from user customization to device driver and boot configuration, in one file. It was contrasted with the Unix/Linux way, which was single-purpose text files, with the system-wide configuration in protected /etc files, and user-specific configuration in ~/. files

Plists are the best of both worlds. They're a file format rather than a system database, so user-specific config goes in ~/Library/, application-specific config goes in the *.app/ bundles, and system-wide config is in /System or /Library. But it's also a unified format, so each program doesn't need to implement its own parser, and users and developers don't have to wonder how application XYZ decided to escape backslashes, in its config file.

How are they "the macOS equivalent of windows registry"? Or is that just a generic techno-slur?

<comment><USER11> I meant it in the sense that it turned into binary blobs that became less accessible for humans to manage, and a place where both Apple and 3rd party vendors started hiding magic stuff stored who-knows-where in a format that isn't easy to grep / find.

</comment></comment></comment><comment><USER14> Reminds me a bit of the CVE about SAML authentication being screwed up by bad XML parsers. Seems like a lot of low hanging fruit there still.

[0] [https://duo.com/blog/duo-finds-saml-vulnerabilities- affectin...](https://duo.com/blog/duo-finds-saml-vulnerabilities-affecting- multiple-implementations)

</comment><comment><USER15> The author mentions that this bug saved him 1000s of hours in development. How is a sandbox escape useful in development? Can someone give me an example?

<comment><USER16> If you're looking for 0day kernel exploits that might be popped from say MobileSafari, having an unrestricted, unsandboxed non-root shell is a much better starting point compared to a regular sandboxed app launched from xcode. Or even just for inspecting the filesystem outside a regular app's restricted container.

</comment></comment><comment><USER17> I'm not in the security community and as an end user there seems to be two lesson there:

-Apple should provide better audit tool so that security consultants don't need to rely on unpublished 0day exploits to find other exploits

-As an exposed user I really don't thank grey hat People that refrain from publishing 0day exploit for two frigging years for personal gain...

<comment><USER18> Apple said that they'd make research devices available to select people, but as far as I can tell nobody seems to have gotten one. (Not to mention that such a policy, even if it actually handed out devices, is fairly exclusionary.)

</comment></comment><comment><USER19> The section of the WHATWG HTML spec about parsing XHTML begins with this note:

 _> An XML parser, for the purposes of this specification, is a construct that follows the rules given in XML to map a string of bytes or characters into a Document object._

 _> Note: At the time of writing, no such rules actually exist._

What do the authors of HTML mean by this? Isn't there a spec for XML? There is -- here's what it has to say about comments ([https://www.w3.org/TR/xml/#sec- comments](https://www.w3.org/TR/xml/#sec-comments)):

        Comment ::= '<!--' ((Char - '-') | ('-' (Char - '-')))* '-->'

The HTML spec, on the other hand, writes out the token state machine explicitly. There are ten states involved with parsing comments; here's one ([https://html.spec.whatwg.org/multipage/parsing.html#comment-...](https://html.spec.whatwg.org/multipage/parsing.html#comment- state)):

        220.127.116.11 Comment state

        Consume the next input character:
         U+003C LESS-THAN SIGN (<)
          Append the current input character to
          the comment token's data. Switch to
          the comment less-than sign state.
         U+002D HYPHEN-MINUS (-)
          Switch to the comment end dash state.
         U+0000 NULL
          This is an unexpected-null-character
          parse error. Append a
          U+FFFD REPLACEMENT CHARACTER
          character to the comment token's data.
         EOF
          This is an eof-in-comment parse error.
          Emit the comment token. Emit an end-
          of-file token.
         Anything else
          Append the current input character to
          the comment token's data.

The spec defines what to do for every character, even characters that should not appear in valid HTML. An HTML parser will behave exactly the same as another HTML parser in all circumstances.

You can see the success of this approach on the real web; inconsistent HTML parsing between browsers is no longer the issue it used to be 15 years ago. It may be more work to write, but I wish HTML's precise, step-by-step format was more common. Writing a spec as a list of rules makes it easier to implement (as a first pass, you can just go line-by-line and translate it to code) and reduces the chance of inconsistencies like the one in the article (and their associated security implications).

<comment><USER20> I am very skeptical. This state-machine approach seems much more like an implementation than a specification. Having a reference implementation could certainly be a good thing, but this doesn't even look like something one could run and test against.

The declarative form of Comment, above, is wonderfully concise and clear when compared to these several lines of imperative, update-this/goto-there style alternative. You can see in your head what it should match without mentally simulating these specific instructions against some imagined parser state.

There certainly can be a host of terrible issues with BNF-style grammars. When they're just used as a notation to write down a bunch of rules, with no regard to actually implementing these rules, the result can be a sprawling and terribly ambiguous mess. For instance, this[1] is an abject disaster, chock full of ambiguity and senseless distinctions.

But if one is prepared to take the effort to really write a machine-readable grammar like this[2], the result is a straightforward, high-level, concise spec that can be compiled into an implementation to boot. What's not to like?

[1] [http://sven.xtreme-eda.com/](http://sven.xtreme-eda.com/) [2] [https://docs.python.org/3/reference/grammar.html](https://docs.python.org/3/reference/grammar.html)

</comment></comment><comment><USER21> That made me shudder go all the people I know who won't update their phones

<comment><USER18> If they know what they're doing, Apple will have either blocked these invalid apps from the App Store or started removing them.

</comment></comment><comment><USER22> XML is hard. Love that the fix is reminiscent of XKCD 927[1]

[1][https://xkcd.com/927/](https://xkcd.com/927/)

<comment><USER23> Idk why your comment is down voted or flagged, the comic is relevant.</comment></comment>


Objective-C is TIOBE Language of the Year Second Time in a Row - <AUTHOR> http://blog.metaobject.com/2013/01/objective-c-wins-tiobe-language-of-year.html

<comment><USER2> I'd love Objective-C if I could do just a little bit more with it. iOS and OSX are great, yes, but I don't just code clients all day. A few more libraries for heavy lifting server side coding would be fantastic.

<comment><AUTHOR> What sorts of libraries would you want to see? Web framework? ...?</comment></comment>


Ask HN: Should or can a startup be ISO-27001 compliant? - <AUTHOR> <comment><USER2> Yes.</comment>


Ask HN: is Nginx trusted? - <AUTHOR>

Given that it's developed in Russia, does the Russian equivalent of the NSA have code in there? <comment><USER2> No, the Russians have mot backdoored nginx.

<comment><USER3> mot is russian for secretly

<comment><USER2> It's American for "I am typing this on an iPhone keyboard".

<comment><USER4> Which is made in China.

</comment></comment></comment></comment><comment><USER5> The source code is available, so theoretically you could check.

<comment><AUTHOR> That might not be enough...... [http://en.wikipedia.org/wiki/Underhanded_C_Contest](http://en.wikipedia.org/wiki/Underhanded_C_Contest)

</comment></comment><comment><USER6> I think you probably have to worry more about the general security of your servers. Its really quite easy to do something stupid which can leave you exposed.

Im sure the russians have better things to be doing rather than looking at you (no offence).

</comment><comment><USER7> I just use it to proxy my static resources.</comment>


Pick-and-mix to create your own custom (8-bit) computer on a low-cost FPGA board - <AUTHOR> http://searle.hostei.com/grant/Multicomp/

<comment><USER2> "You are seeing this page because website has reached CPU usage limit of the server, and it was temporarily disabled." Welcome to HN!</comment>


SpaceX successfully lands its Falcon 9 rocket at Vandenberg for the first time - <AUTHOR> https://www.theverge.com/2018/10/7/17947518/spacex-falcon-9-rocket-launch-vandenberg-california-landing-watch-live <comment><USER2> The video of the stage maneuvering is great (1 minute):

[https://twitter.com/RogerCraigSmith/status/10491304561578106...](https://twitter.com/RogerCraigSmith/status/1049130456157810689)

Another longer video (8 minutes):

[https://youtu.be/TVHAoxyHO9c](https://youtu.be/TVHAoxyHO9c)

Official livestream with views from the rocket and some views from the ground (at the time the interesting things happen):

[https://youtu.be/vr_C6LQ7mHc?t=1148](https://youtu.be/vr_C6LQ7mHc?t=1148)

What we see is the shutdown of the 9 engines of the first stage, separation of the the first stage from the second stage, ignition of the engine on the second stage, turn of the first stage to point engines-back, ignition of 3 engines on the first stage to boost back toward the launch site, separation of the two halves of the payload fairing from the second stage and them falling, the first stage maneuvering using cold gas thrusters to navigate to the launch site. The first stage eventually lands ~1400 feet (~420 meters) from the launch site. The second stage reaches 600x600km polar orbit [1], separates from the satellite payload and usually for LEO de-orbits to sink in the ocean. There was no attempt to recover the payload fairings this time because of waves, apparently.

1 - [https://twitter.com/planet4589/status/1049167565904388096](https://twitter.com/planet4589/status/1049167565904388096)

<comment><USER3> I do not understand what's happening here but man it looks like an alien spacecraft doing something.

</comment></comment><comment><USER4> I was about 4.5 miles from the launch/landing site for this one. Incredible experience. The "nebula" overhead was one of the more beautiful things I've seen in my life.

<comment><USER5> I'm envious a little bit - the "nebula puffs" were awesome to watch even just on the webcast, I can't imagine how beautiful it must have been seeing them with one's own eyes right above you. :)

<comment><USER6> Then imagine what it was like for me, when I hadn't heard anything about it and just by coincidence happened to be out staring at the night sky when that crazy "nebula" erupted right in front of me. Incredible, glowing, rainbow- colored, great-nebula-in-orion-looking thing exploding outward, churning with stars or spacecraft or somethings shining spotlights here and there through clouds that rippled with shockwaves.

What in the world...?! Jaw dropping.

<comment><USER4> Man, that must've been something! I was fully forewarned that it would be crossing into sunlight and probably would be quite spectacular, and it _still_ took my breath away. Can't imagine what it must've been like to be caught unawares.

</comment></comment></comment></comment><comment><USER7> View from my house: [https://twitter.com/jrhunt/status/1049126465487269890?s=21](https://twitter.com/jrhunt/status/1049126465487269890?s=21)

</comment><comment><USER8> The twitter commenter's pics are incredible. Looks like a flare inside a nebula.

<comment><USER9> I was visiting my in-laws in Arroyo Grande and we watched it; the pictures don't really do it justice. The night was amazingly clear, and it was very bright. It was even possible to see some of the longer firings of the maneuvering jets after the stage separation.

</comment></comment><comment><USER10> The waves caused by the RCS pulses were stunning. Heavenly. It was like a special effect.

</comment><comment><USER11> My son and I saw it when we were leaving Home Depot, and actually looking for parts for our rocket project.

Is there a way to take a tour of, or get onto a base for a launch?

</comment><comment><USER12> Didn't quite get to hear the sonic boom, but did get a muted rumbling from the booster in re-entry. Overall a very enjoyable experience!</comment>


Logitech: "Options" Craft WebSocket server has no authentication - <AUTHOR> https://bugs.chromium.org/p/project-zero/issues/detail?id=1663 <comment><USER2> Does this pattern of vulnerability have a name? Where a piece of software listens on localhost but can be exploited by any webpage?

</comment><comment><USER3> This is ridiculous. This is why I hate installed third party software on my computer.

Thank you. I have blocked all incoming traffic on that port.

<comment><USER2> I'd be much more concerned about traffic from localhost (from malicious web pages)</comment></comment>


Atlantic Records Says Digital Sales Surpass CDs - <AUTHOR> http://www.nytimes.com/2008/11/26/business/media/26music.html?hp <comment><USER2> I didn't know Atlantic still existed.

</comment><comment><USER3> They should have been able to make this announcement 5 years ago.

</comment><comment><USER4> Finally, maybe now the music executive will start to "get it".</comment>


Musk dares county officials to arrest him as he reopens Fremont factory - <AUTHOR> https://arstechnica.com/cars/2020/05/musk-dares-county-officials-to-arrest-him-as-he-re-opens-fremont-factory/ <comment><USER3> This reporting is disingenuous at best. He never "dared" them to arrest him. Can't believe this article is from Ars Technica.

</comment><comment><USER4> who cares. sick of hearing about this primadonna.

</comment><comment><USER5> Viral marketing.

</comment><comment><USER6> _Brave_

<comment><USER7> Brave in his stupidity?

<comment><USER8> No, it's intentional and with a goal. "Brave" in his overt disregard for the lives of others in the name of money. There is, as of yet, no vaccine and there is no cure, and the pandemic curve will restart and kill more people if reopening happens too soon. Lockdowns certainly aren't ideal, but they won't kill nearly as many people as horribly as hunkering-down for as long as possible and when the government should be doing more UBI to help people. Dying alone by drowning on a respirator is a terrible way to go.

<comment><USER9> > in the name of money

You're so sure the reason is money you don't need checking if Musk has other ways to earn them - more reliably at that. Sorry.

Musk does a lot of mistakes, most of them shoot himself in the foot - in a mild way, he's a smart guy. When he does make a big one, he might insist - <USER2> a good deal of billionaires would - but to label Musk a strict money chaser would equal to elevating profit hunting to astronomical heights, both figuratively and literally. You don't go with your last money - even if it's your hundred mils - to the business you know is pretty risky unless you have something else. C'mon.

Where I agree is that it's a highly questionable move, to say mildly.</comment></comment></comment></comment>


Data Visualization with Minecraft - <AUTHOR> https://medium.com/enigma/enigma-hack-week-data-visualization-with-minecraft-7a7d4c8eb5e5 <comment><USER2> haha. this reminds me of DOOM for SysAdmin, but better! [https://www.cs.unm.edu/~dlchao/flake/doom/chi/chi.html](https://www.cs.unm.edu/~dlchao/flake/doom/chi/chi.html)

</comment><comment><USER3> Adds a new dimension to data mining haha</comment>


Russian Presence Near Undersea Cables Concerns U.S - <AUTHOR> http://www.nytimes.com/2015/10/26/world/europe/russian-presence-near-undersea-cables-concerns-us.html?hp&action=click&pgtype=Homepage&module=first-column-region&region=top-news&WT.nav=top-news <comment><USER2> This reads like a bit of Cold War fear-mongering, in that whatever the US has done in the past, when the Red Russkies do the same thing, it's cause for alarm and a 600-ship Navy, plus whatever the Air Force can grab.</comment>


A Former College Lineman Now on the Streets, Looking for Answers, and Help - <AUTHOR> http://www.nytimes.com/2015/03/08/sports/ncaafootball/ryan-hoffman-a-unc-football-player-two-decades-ago-is-now-homeless.html <comment><USER2> It's no surprise we are seeing fewer kids playing at the K-12 level as parents just don't want to take the risk. I don't blame them. Wouldn't want my son doing it either. Who wants to push their child on career path where there are good odds you retire in your 30's with brain damage?

Increasingly I am thinking that football is one of those things that people a hundred years in the future are going to think we were totally crazy for ever popularizing, sort of like how today we think gladiator fights were horribly barbaric. I don't know that better equipment and rule changes can solve everything.

<comment> at-fates-hands >>> I don't know that better equipment and rule changes can solve everything.

Doesn't matter how good the equipment is, it's your body which is handicapped from the outset. It's because your brain floats in the cerebrospinal fluid, there's no way to effectively "anchor" your brain from crashing around in your head during concussions and hard hits.

Anybody playing contact sports is at risk, and even sports you don't think of as contact sports are at risk as well. Baseball's not considered a contact sport, but you see concussions there all the time. The problem in all of these sports is the players are getting bigger and the sport is moving faster. I still remember Wayne Gretzky talking about how we finally decided to retire. He was talking with his father, who asked him if he was going to play one more year. This was his response:

"Dad, I can't compete anymore. The players are getting bigger and faster every year." when Wayne retired, he was 6' and 185lbs. \

The AVERAGE hockey player nowadays is closer to 6'3" and is well over 200lbs. The LA Kings famously had a line where all three of their forwards were 6'3" and weighed 220lbs the year they won the Stanley Cup in 2012.

Take a look at their roster - they only had 4 guys under 6': [http://www.hockey-reference.com/teams/LAK/2012.html](http://www.hockey- reference.com/teams/LAK/2012.html)

<comment><USER3> Gretzky retired in 98-99. It did take 15 years, but NHL hockey implemented rules to make the game less brutal and it seems to be working. Players crashing into each other head first is not an inherent part of the game like it is with American football. Sure concussions occur, but it's got to be a fraction of what happens in football.

[http://www.wsj.com/articles/professional-hockey-has- become-a...](http://www.wsj.com/articles/professional-hockey-has-become-a- gentlemans-game-1425333413)

"Much of the decline can be attributed to fewer players going to the box for the game's more violent infractions. Charging, boarding, roughing and cross- checking are being called at the lowest rates since 2001-02, according to Stats. It seems that the NHL's plan to crack down on violent penalties this season is working."

<comment> at-fates-hands I agree and would also add that the increased speed of the game has lessened the amount of bad injuries. Goons have pretty much been eliminated and there' only room for really skilled guys - which means a lot less hard checking and chippie play.

Although the occasional rivalry game will produce more hitting and hard checking. You can see the Wild v. Avalanche this past week or the Flyers v. Penguins last month which included a ton of PM's and four fights - a rare occurrence these days.

</comment></comment></comment></comment><comment><USER4> We moved to Central Florida in 1977. The Bucs were so new they had yet to win. I would wear my Dave Pear #76 jersey to Junior High.

I couple of years ago my cousin was complaining to my unsympathetic Bucs' fan ears about his team's [Orioles or Senators, I can't remember] losing streak. I googled up Dave Pear to out suffering fan him in prose much like this here.

 _Don 't let your kids play football. Never._

[https://en.m.wikipedia.org/wiki/Dave_Pear](https://en.m.wikipedia.org/wiki/Dave_Pear)

</comment><comment><USER5> Football players = modern gladiators.

One can say other competitive sports are like that too. Maybe the military as well. But American Football is especially bad for a popular sport. It very violent. Permanent brain damage is a common side-effects of playing for years.

Americans love it though. One can make a parallel in general on how our society is inherently more violent than other Western countries. American football is just one of the facets of that.

It is also interesting perhaps how this gets played vis-a-vis the "save the children" rhetoric. We've seen article about free range kids' parents getting harassed by police. How everyone is talking about how special the children are how they should be protected. And then, pretty much the same people, turn around and either send their son to play football or watch and cheer as others run around the field butting into each other head first at full speed.

</comment><comment><USER6> I am totally crushed by this. Last season I felt guilty every time I watched a football game though I enjoyed it anyway. I used the tortured justification that many people suffer tragic, difficult lives of mental illness without the fame and fortune that comes with being a football player. That the suffering is a horrible thing but perhaps increased awareness will lead to rules changes and better player safety (I suspect the complex helmets and padding are actually the cause of brutality and concussions in football because the players use the padding as a weapon and as justification to go to physical extremes they would not dare try without their armor). But the moral weight of teenagers and twenty somethings who will never have the economic advantages that come with a professional career, and who are supposedly in college to begin the productive part of their life where they grow as human beings, are suffering in exactly the same way while the NCAA and its Universities profit from it is too much.

<comment><USER7> _(I suspect the complex helmets and padding are actually the cause of brutality and concussions in football because the players use the padding as a weapon and as justification to go to physical extremes they would not dare try without their armor)_

I suspect that helmets and padding are the reason we don't see more deaths at all levels of play.

<comment><USER8> Watch some Rugby and get back to us on that one. Same basic mechanics (tackling, diving, etc), but done with more caution because they aren't armored tanks.

<comment><USER9> While not as bad as American Football, rugby is still pretty bad - my son plays rugby at U16 level and the level of injuries you see are pretty striking - broken bones aren't exactly uncommon.

Still rugby is a great game and he loves it and I love watching him play.

[Scrums are the really scary bit of rugby as of the risks to players necks - fortunately he is a No 8. not a prop!].

<comment><USER6> The thing is everyone knows these sports are brutal and can lead to broken bones. It's concussions that are of a larger concern.

<comment><USER10> Concussions are of larger concern largely because we've reduced the problem of one particular kind of broken bone (to wit, the skull -- which was a fairly serious problem in football) to a more manageable level with protective gear.

I don't think reducing the impact of concussions by returning to the age of deaths by brain injuries from broken skulls is a way forward.

</comment></comment></comment></comment></comment></comment><comment><USER11> Football is by far my favorite sport. Unfortunately, it's just not worth the long-term injuries it causes to a large percentage of those who play it beyond high school (and some before even that level).

<comment><USER4> Do you play in pads for recreation?

</comment></comment><comment><USER12> Ive seen this suggested before and it seems counterintuitive at first, but get rid of helmets. Get the game back to something resembling rugby. Hard helmets give a false sense of security.

<comment><USER13> this may reduce the long term occurrence of dementia/permanent brain damage, but it will most certainly increase the occurrence of immediate death unless the rules of the game are changed considerably.

</comment></comment><comment><USER14> One thing that I think can help is greater emphasis to get Steriods/HGH/Testosterone out of the game. Grew up in Miami, which is a hotbed for highschool football and I recall that Steriod usage was rampant back in the 80's. Players are bigger, stronger, faster because of the use of these performance enhancing drugs and there is no control whatsoever at the highschool level.

</comment><comment><USER15> Great article. I'd also highly recommend the movie Crash Reel, which is also about TBIs. It should be mandatory viewing for any student who wants to play football, snowboard, bike race, etc.

</comment><comment><USER16> I'd rather have bad knees than a bad brain.

</comment><comment><USER17> "Most never made a dime off the game." The article lost credibility for me there. You may think the majority of NFL players don't get paid enough for what they do, but I'm pretty sure no one is playing for free.

<comment><USER18> " Most of those players are not famous. Most never made a dime off the game. They are relatively anonymous men who played the sport in college and only later, for some reason or another, have found themselves struggling in life."

College players aren't paid. Most college players never make it to a professional paying level.

[https://www.ncaa.org/sites/default/files/Probability-of- goin...](https://www.ncaa.org/sites/default/files/Probability-of-going-pro- methodology_Update2013.pdf)

<comment><USER17> The quote was made in the context of NFL players. (At least that's how I read it)

Still, even though college players aren't paid with money, they still receive compensation (scholarships, financial aid, free tutors, etc). To indicate that they receive no financial compensation is inaccurate, I think.

<comment><USER19> The article wasn't clear, but I think you've misread it:

"Most never made a dime off the game. They are relatively anonymous men who played the sport in college and only later, for some reason or another, have found themselves struggling in life.

Just like their N.F.L. counterparts, Hoffman and those former college players have been left to wonder: Did football do this?"

The author meant to distinguish Hoffman et al frmo NFL players, who are at least famous and well paid for their troubles.

Also, the Hoffman did not say the players never received "financial compensation". Hoffman said they never made a dime off the game, which is profit. (He's also speaking loosely, as the use of the idiomatic phrase suggests)</comment></comment></comment></comment>


The FBI, CIA and NSA say American citizens shouldn't use Huawei phones - <AUTHOR> http://money.cnn.com/2018/02/14/technology/huawei-intelligence-chiefs/index.html <comment><USER2> Maybe it's tinfoil hat time; the more the government says to not use Huawei, offering no proof at all, the more I think they are unable to track and log information like they can on US(ish) phones.

All US phones have components manufactured in China as well as all over the world. It is not a stretch to think the foreign governments couldn't get in the middle and create vulnerabilities or straight up drop attacks on different components they have access to. How is Huawei any different?

Are we supposed to take their complaints seriously when Snowden leaks revealed the NSA hacked Huawei servers to find vulnerabilities they themselves could use to spy on people around the world. /shrug operations Shotgiant doesn't matter? If the NSA hack revealed that Huawei was injecting spyware it's time to release the details of how they found out.

<comment><USER3> This argument would hold more weight if the government was saying not to use any non-US phone. But they're specifically targeting Huawei and ZTE. Notice that there's no recommendation to avoid e.g. Samsung phones.

<comment><USER4> > _" This argument would hold more weight if the government was saying not to > use any non-US phone"_

There's not even such a thing as a "US phone" though, is there? Even phones manufactured by US companies like Apple are made in China with Chinese/Taiwanese sourced parts. Google always outsources its Nexus/Pixel devices to third parties like LG and Motorola. Speaking of Motorola, they are now owned by Chinese manufacturer Lenovo, which has also been in hot water lately over spyware and rootkits in their laptops.

I'm of two minds about the announcement. On the one hand, Huawei and ZTE have both been caught installing backdoors and spyware on their devices in the past[1]. On the other hand, the US three letter agencies have a vested interest in US citizens carrying around easily monitored and tracked devices, and they easily find ways around Constitutional protections against spying within their own borders.

I honestly don't know who to believe in this situation.

[1] [https://www.fastcompany.com/4025254/new-phone-who-dis- huawei...](https://www.fastcompany.com/4025254/new-phone-who-dis-huawei-zte- respond-to-reports-of-secret-back-door-in-android-devices)

<comment><USER5> "Even phones manufactured by US companies like Apple are made in China with Chinese/Taiwanese sourced parts."

Exactly my thought. US gov't even outsources to private contractors that then subcontract and outsource to China for electronic components including chips that can easily end up in our DOD systems. I wonder if this is more of a money or market thing being pushed by the Existing Oligopoly?

Something doesn't appear to add up completely?

<comment><USER6> What doesn't add up is that, in the real world, you can't protect against every threat model. Its their job to protect the best they can. They can't tell Apple to stop building their phones in China, but they can simply say "Don't buy Huawei".

That's easy. And moreover, its a bigger threat. With a Huawei phone, the Chinese government has control over everything from the processor to the userspace software. With a small piece of silicon in a fab, the threat surface is much smaller; they'd have to sneak it in against Apple's will, past all of Apple's American-loyal QA.

In the software world, we tend to think about security as an absolute, because computer logic is absolute. In the real world, security is probabilities. How can you minimize the chance of breach while minimizing costs.

<comment><USER7> > _What doesn 't add up is that, in the real world, you can't protect against > every threat model. Its their job to protect the best they can. They can't > tell Apple to stop building their phones in China, but they can simply say > "Don't buy Huawei"._

If the 'threat' was real, that makes as much sense as hardening one door in your house, when you have 4 other doors because "you can't protect against every threat model".

<comment><USER6> No. It makes as much sense as securing the 4 doors because that's a relatively cost efficient way to implement basic security. But let's avoid strengthening all the walls with a titanium alloy to protect us when the threat brings a bulldozer to get in. That's expensive.

Asking Apple to manufacturer their phones outside of the US is a highly expensive action.

</comment></comment></comment></comment></comment></comment></comment><comment><USER8> This is not new. I worked for a Comcast subsidiary who owned and operated a multi-state "cable" company who owned all of their end to end transport and had a customer base of around 250k at the time. They installed all fiber and HFC networks in the ground, thus they also owned all the fiber transport gear. We had been in a bake off between Infinera (US based) and Huawei for long-haul transport until a three letter agency paid a visit and made the decision for us.

So... Either one of two things was true: the three letter agency was protecting US consumers or the three letter agency already had Infinera backdoored. My personal opinion in the matter was the former. Why? Because later that same year the data center was shut down one night and off limits for all changes and users. The next day a large, locked and tamper taped mobile rack was in the DC with 100Gb link into core routing. That led me to believe gaining access to siphoning traffic was not really the issue. But I could also be wrong because I wasn't in the know.

This was in 2010-2011, pre-Snowden.

<comment><USER9> A third possibility is that they're using this influence to give an economic advantage to US-based companies, and a disadvantage to foreign (or specifically Chinese) ones.

Could also be all three of course.

<comment><USER10> The economic argument is difficult to make, because it raises costs on American companies who are consumers.

<comment><USER7> Unless of course those consumers have less influence on politicians that huge telcos (and the costs are negligible anyway)

</comment></comment></comment></comment><comment><USER11> _" There is a risk of letting any company "beholden to foreign governments" inside the country's telecommunications infrastructure, he said."_

At it's face value this is indeed true. However, it is interesting there is no mention of Samsung then, right? Why would they be exempt from this recommendation, especially given Samsung phones are hundreds or perhaps thousands of times more prevalent than Huawei and ZTE phones in the US.

Shouldn't the argument from the FBI, CIA, and NSA be that US citizens shouldn't purchase any non-US manufactured phone? I'm skeptical as to the true purpose of the statement. This might possibly indicate that for whatever reason Huawei and ZTE don't play ball with the US when it comes to surveillance and the US intelligence agencies don't like it. If anything, this just raised the probability of me purchasing one of these phones. I'll probably stick with BlackBerry, but I will at least consider these next time I need to buy a new phone.

<comment><USER12> The US has 23,000 soldiers in South Korea.

It may also be relevant that there are no US-manufactured phones. Indeed, even Samsung phones are full of chips from mainland China and Taiwan.

<comment><USER13> Isn't the issue more about design though? It seems to me that it'd be easy enough to take a random sample of chips made by your Chinese manufacturer, cut the top off and verify it matches your design with a microscope. However if the complex product is designed by an adversary it's easier to hide a backdoor, probably also easier to plausibly claim it was an accidental bug.

</comment></comment></comment><comment><USER14> That's really funny, because a couple of years ago, Snowden demonstrated very clearly that American tech companies are _all_ infested by NSA mass surveillance tools or dominated by mass surveillance activities, constantly profiling pretty much all citizens.

<comment><USER15> As far as I'm aware he didn't demonstrate that (say) Apple was infested by NSA mass surveillance tools. And those options that could be used to profile users can be switched off. What am I missing?

<comment><USER16> Rex, the Qualcomm baseband os, is a binary blob that's really annoying to reverse engineer and it shares a bus with the top-level os.

<comment><USER17> No, that's not in fact how basebands work; the baseband is connected to the AP via HSIC, which is an internal USB bus. "Shares a bus with the top-level OS", by the way, is a sequence of words that doesn't really make sense.

<comment><USER16> I checked and you're right! I misunderstood a series of articles from 5 years ago on this subject. Please excuse my confusion :(.

Edit: Also Rex is the kernel and RtOS is the OS.

[http://www.osnews.com/story/27416/The_second_operating_syste...](http://www.osnews.com/story/27416/The_second_operating_system_hiding_in_every_mobile_phone)

</comment></comment></comment></comment></comment><comment><USER18> The headline seems sensationalized. The article doesn't mention a recommendation not to use, it simply was the absence of a recommendation at all.

"...asked the group to raise their hands if they would recommend private American citizens use products or services made by Apple competitor Huawei or smartphone maker ZTE."

The US Government is not in the business of recommending device brands or services to private individuals, and not making a recommendation is not the same as recommending against.

<comment><USER19> Yes. I would say there it is pertinent to consider why the Senator did not word the question as _" Would you recommend private American citizens avoid using products or services..."_.

</comment></comment><comment><USER20> 60 Minutes did a segment on Huawei a couple of years ago where they discussed the extreme concerns intelligence officials had with Telcos using Huawei equipment. At the time it just seemed like a very strange segment, this was of course before the Snowden revelations. I have thought about that segment many times since the Snowden revelations and it starts to make sense why intelligence officials where so concerned.

<comment><USER21> I recall seeing that segment. If I remember correctly it was focused on the Chinese stealing trade secrets and intellectual property from US companies. One example they gave was Cisco source code that was found in Huawei network devices.

</comment></comment><comment><USER22> I'm going to make two assumptions: China is spying on us through these phones, and the US _is not_ spying on the Chinese through US phones.

Now consider what real harm is going to come from US citizens using these phones when don't have any influence on the US government. Are the Chinese going to siphon the data of everyone in the country and use it to plan attacks on the government? Could be. But considering the relationship these two counties have right now, does this seem probable?

We aren't at war with China. But we are slowly giving up market share to foreign companies, which weakens our economy and our negotiating power. Really, the biggest threat to the US from China is not intelligence leaks. It's _customers_. Once we lose the mobile market, everything else people use through the mobile phone may follow. China's startups could position themselves to become the center of the tech world with a captive user base and tailored platform.

It could be that ZTE and Huawei simply can't be bought, and the US gains nothing by allowing China to dump cheap and powerful smartphones on the market. It's one thing to screen phones in the public sector - but nationally? I'm not buying it.

</comment><comment><USER23> > Huawei has not made strides in the U.S. market in large part because of > government concerns that the Chinese government can use its smartphones and > other products for intelligence gathering.

This is a great opportunity for Huawei to be the first major manufacturer to have a totally open-source stack. It would be immediately unimpeachable; a feature that no other smartphone manufacturer has.

<comment><USER24> They'll never get the modem from qualcomm, that thing has it's own os and can download and run anything

<comment><USER25> You do realize that they design and manufacturer their own modems, right?

<comment><USER24> Huawei has a soc? I swear they use mediatek

I stand corrected HiSilicon

<comment><USER26> HiSilicon is wholly owned by Huawei.

</comment></comment></comment></comment></comment><comment><USER27> It's a sad state of affairs when one can't tell whether China really has backdoors on Huawei phones, or USA just wants you to use phones with their own backdoors.

Too much smoke and mirrors.

<comment><USER28> Maybe it's a budget-saving measure. Keeps the TLA's from having to buy all of our information from Facebook and Google.

</comment></comment><comment><USER29> What we need is a phone that neither the Chinese nor American governments can monitor. Failing that, since I live in the USA, perhaps a phone that the Chinese can monitor but the American government cannot (at least until China and USA ink a pact to trade intelligence info).

What irks me is why does the government insist upon having the ability to monitor everyone willy-nilly when it has been shown consistently that by far most of the information gathered is worthless for both espionage and criminal investigations?Why not return to the older court-approval method for warrants (and get rid of FISA courts and the FISA system entirely).

<comment><USER30> What in the world would lead you to believe if the Chinese can monitor your phone, that the US can't? That's so far out there in terms of logic, I can hardly imagine where you're coming from.

This entire thread is overloaded with posts that seem to not understand the US intelligence system, its legal authority, how FISA works, how the court system works, et al.

I keep seeing people say that they might be better off with their information outside of the US, because China or Russia can't arrest them if they reside in the US. If your information is outside the US, transited to a foreign service provider, you just dramatically increased the US Government's authority to target your information.

<comment><USER29> adventured says _> "What in the world would lead you to believe if the Chinese can monitor your phone, that the US can't? That's so far out there in terms of logic, I can hardly imagine where you're coming from."_

Firstly, What makes you think you know and can state here what I believe? You have _no_ idea.

Secondly, I don't believe that. But I _do_ believe that surveillance is a constantly-changing game (like stepping into a river) and a Chinese vendor will be slower to provide updates to USA intelligence agencies than will a domestic vendor. Hell, domestic communications vendors have willingly _followed the instructions_ of the 3-letter agencies. The _time lag_ could allow one to avoid surveillance.

adventured says _> "This entire thread is overloaded with posts that seem to not understand the US intelligence system, its legal authority, how FISA works, how the court system works, et al."_

Best to save your breath and worry about the gaps in your own knowledge.

adventured says _> "I keep seeing people say that they might be better off with their information outside of the US, because China or Russia can't arrest them if they reside in the US. If your information is outside the US, transited to a foreign service provider, you just dramatically increased the US Government's authority to target your information."_

Firstly, that was true for awhile but not now. Foreign or domestic, your data is being collected and is being examined by computers, indexed and stored for future reference. We're already at "Big Brother".

Secondly, I'd like to see the FBI try to bring evidence to a U.S. criminal court that was collected by almost _any_ foreign government's intelligence services. That would be a fast track to dismissal of charges.

</comment></comment></comment><comment><USER31> All three of these orgs have done questionable things to their own citizens - some in recent history - however, they're what Americans have. Not trusting them when they're being so ridiculously direct seems unwise. If I had to choose my lesser evil, I'll go with my government's agencies over the word of a foreign government. I don't think China is fundamentally evil, but I do think that it's viciously competitive and very organized. So for now, I'll take the warnings at face value and avoid Huawei phones.

<comment><USER32> how about ask for proof? let it be debated by elected people first? seems like secret agencies are running things there... if you want to achieve your goal just scream "national security"; nice system.

</comment></comment><comment><USER33> [https://www.pbs.org/newshour/nation/spy-fears-drive-us- offic...](https://www.pbs.org/newshour/nation/spy-fears-drive-us-officials- chinese-owned-hotel) Can't find the article but there was a warning not to discuss trade secrets or use the free wifi in conference rooms at Chinese- owned hotels in the US or Canada (which includes Starwood brands). Before anyone starts talking about "hackers"... why sneak around when you can just own the building.

</comment><comment><USER34> I used to make mobile phones for a European company. High end expensive phones - very few phones produced. I was responsible for gathering telemetry data and was always wondering why some of the first telemetry data we got from phones was from Guam.

<comment><USER35> Maybe because Guam is near the international date line, and telemetry that turns on on a certain day is likely to come from there first?

<comment><USER36> Makes sense.

</comment></comment></comment><comment><USER37> So is it a choice between getting spied on by the Chinese government or my own government?

Which phone does the US government recommend I buy?

<comment><USER36> Buy American.

Buy iPhone.

Made in China*.

<comment><USER30> Hardly any of the iPhone is made in China. Taiwan is not China. The same is true about Samsung phones, they've almost entirely eliminated China from their manufacturing process. Three times as many Samsung phones are made in Vietnam as in China at this point. Before another five or six years out, barely any non-domestic smartphones will be made in China.

</comment></comment></comment><comment><USER38> Huawei is a government sponsored entity. It will be natural for them to spy on our citizens and companies and steal their data for the betterment of China. We just have to be aware of that. Going into conspiracy theories won't help us much, we have to be clear-eyed.

</comment><comment><USER39> What an odd comment thread. In what twisted world are people holding the Chinese government as a bastion of liberty compared to the US?

</comment><comment><USER40> I have a Xiaomi. And given the choice I prefer being spied upon by the chinese... Rather than the Yankees.

</comment><comment><USER41> Without evidence this sounds a lot like fearmongering.

But at the same time the FBI, CIA, and NSA are probably best informed about just how powerful (smart)phone surveillance can be.

I still want to see the evidence though.

</comment><comment><USER42> Here is a video[1] of the part of the testimony being reported here.

It's also worth mentioning that several years ago, the BT in the UK basically installed Huawei equipment all over their core telecom infrastructure.[2]

[1]: [https://www.c-span.org/video/?c4714734/zte- huawei](https://www.c-span.org/video/?c4714734/zte-huawei)

[2]: [http://www.bbc.com/news/uk-22803510](http://www.bbc.com/news/uk-22803510)

</comment><comment><USER43> The takeaway being that the Kirin line of CPUs is proving difficult to create a backdoor for.

</comment><comment><USER44> You guys, I can't tell if it's foreign bots flooding this thread with disinformation, but it's _obvious_ that using a Huawei phone isn't going to keep you off of American intelligence servers. All it's going to do is make it easier to get on Chinese ones too. I'd take these warnings seriously. The Chinese have a long history of stealing IP and disregarding norms.

<comment><USER45> > _All it 's going to do is make it easier to get on Chinese ones too. I'd > take these warnings seriously. The Chinese have a long history of stealing > IP and disregarding norms_

Agreed. To those arguing "the Chinese having all my information is better than the Americans," three points:

1\. As 3pt14159 says [1], just because the Chinese have access to your phone doesn't make it safer against American law enforcement.

2\. Every phone isn't made by American or Chinese firms. Don't force a false dichotomy.

3\. Economic espionage is a scary threat model. Consider what you know that someone else might find valuable. Few people answer "yes" in respect of political information. Many more answer "yes" in respect of commercial information. That is your blackmail value. Choosing to expand your security cross-section to foreign economic espionage _plus_ domestic political espionage, versus simply the latter, is irrational.

[1] [https://news.ycombinator.com/item?id=16381401](https://news.ycombinator.com/item?id=16381401)

<comment><USER46> The argument is not favoring one versus the other.

The argument is that being exposed to _any_ peeping tom is bad, no matter who it is.

If no one can't prove to me that there are no peeping toms at all, then a hotel room with a peep hole is still a shitty hotel. But as second class citizens, for all of us, choosing a room with a peep hole is compulsory. Gee, who's fault is that?

Sorry. If I have to sleep in a room with a peep hole, it really doesn't matter much to me who does the heavy breathing on the other side of the wall. I'm supposed to pretend it's not there anyway, and so I shall.

Can the Chinese arrest me and throw me in jail? No. But, for sure, I could get thrown in jail, based on the contents of an electronic device. Are the people who conspire to imprison me friends? Wait, what are they peeping on us for?

<comment><USER45> > _The argument is that being exposed to any peeping tom is bad, no matter who > it is_

This is not the argument I refute. I specifically state what I am refuting: "the Chinese having all my information is better than the Americans." Two things being bad doesn't make them equally bad.

Buying a Huawei phone to safeguard against the NSA is akin to leaving one's door open so there is no peephole for peeping Tom to look through. Yes, within a narrow construction, one is correct. But practically speaking, now both the peeping Tom and the person who opened the door can see in.

<comment><USER46> I want a room without a peeping tom. If that's not an option, then I sincerely no longer care about my own safety.

</comment></comment></comment></comment></comment><comment><USER47> This argument has strong extra-territorial qualities because they forced the "five eyes" compatriots in AU and NZ to drop Huawei as core technology in domestic and international fibre deployment.

But, there is this other quality. The in-senate presentation mainly focussed on the _governance structures_ behind Huawei. The government is cross because ex PLA members are vested and its not a transparent company structure.

I think the FBI/CIA/NSA reports are deeply troubling for their lack of specificity, in a context of international trade I am not drawn to entirely believe them.

Remember, this is the nexus of people who alleged sound reasons to go to war in Iraq which turned out to be flawed. Sometimes rumour is conflated with fact.

I know people who work in Huawei. I do not believe they are people of bad intent.

</comment><comment><USER48> Do you all think this would apply to the Nexus 6P as well? Google branded but made by Huawei..right?

<comment><USER49> Presumably. I own a 6P and it is an amazing phone. If I had to buy a new phone today it would probably be a Pixel 2. However it seems to be having some issues with a blue screen tint, perhaps due to a poorly manufactured polariser. That just leaves Samsung, which is out of the running due to their poor history for android updates.

I don't really give a shit myself whether China is spying on me, as I myself have nothing to do with China and don't have any secrets worth stealing, but it would probably be best avoiding any Chinese networking hardware if you have any concerns.

<comment><USER50> What if they could remotely blow up your battery?

<comment><USER49> Why would the Chinese government want to remotely blow up my battery? Would the NSA want to remotely blow up my battery?

<comment><USER50> It could be targeted attacks on important targets.... a bit like drone strikes, but much more precise ...

Reminds me a bit of the Slaughterbots: [https://www.youtube.com/watch?v=9CO6M2HsoIA](https://www.youtube.com/watch?v=9CO6M2HsoIA)

</comment></comment></comment></comment></comment><comment><USER51> Between the devil and the deep blue sea; we either let the Chinese spy on us, or the Americans.

</comment><comment><USER52> The US government probably worries that Huawei could remotely blew the phone battery should US ever goes into a trade war with China, which is emergent ...

That's the only sense I can make out of this news. I would dump my Huawei if US government can expense it for me. It's hard to find such a high quality phone. [1]

[1][https://www.amazon.com/Huawei-Amazon-Alexa-Leica- Camera/prod...](https://www.amazon.com/Huawei-Amazon-Alexa-Leica- Camera/product- reviews/B01MYRABC3/ref=cm_cr_dp_d_hist_5?ie=UTF8&filterByStar=five_star&reviewerType=all_reviews#reviews- filter-bar)

</comment><comment><USER53> Don't use those phones because the Chinese government did get information off them?

Odd. Isn't that EXACTLY what the US government was trying to do a few years ago to Apple phones? Get their own personal back door put in?

</comment><comment><USER54> I posted a link to a company making secure laptops and iphones on a previous, similar thread and got down-voted and accused of shilling/trolling.

If you are interested look for : laptops and phones where you are in control and have complete visibility into the operating system, all bundled software, and the deeper levels of your computer.

(The phone has not been released yet.)

</comment><comment><USER55> [https://www.theverge.com/circuitbreaker/2018/2/6/16979110/hu...](https://www.theverge.com/circuitbreaker/2018/2/6/16979110/huawei- honor-9-lite-four-cameras-android-budget-smartphone-europe-release) Meanwhile in western europe? ........

</comment><comment><USER56> If the FBI, CIA and NSA say I shouldn't use Huawei phones then I guess maybe that means I should :)

</comment><comment><USER57> Not only TLAs from the USA.

Australia's ASD would have the same opinion.

And I personally wouldn't get an other Huawei phone after seeing the app shit that had all permissions, was pre-installed, force started and uninstallable.

</comment><comment><USER50> Time to get a Huawei phone and new VPN....

<comment><USER58> ... and then login into Google and Facebook accounts, use Google Maps for navigation, Whatsapp/Snapchat for private messages, Amazon to buy nearly everything, Youtube search for political statement. Bonus points if you run some "free" apps with ads served from all over the world.

If wish it were possible to get off the hook by just changing the phone brand and IP.

</comment></comment><comment><USER59> This would carry more weight if someone funded serious reverse engineering efforts against some of these phones.

</comment><comment><USER60> Its kinda surprising they haven't cited any evidence, I would expect they have numerous examples.

</comment><comment><USER36> Makes sense, it was a big deal to never use Huawei equipment in routing or cell equipment.

</comment><comment><USER61> Extremely easy to have provided proof, none provided, useless fud.

</comment><comment><USER62> Any reason to believe the same wouldn't go for OnePlus?

</comment><comment><USER63> I guess we shouldn't bring up the whole "NSAKEY" thing again.

But if we did I'd have to wonder at least a little bit if those phones not having one is the real motivation behind this "warning".

</comment><comment> dis-sys next time when anyone wants to complain the fact that facebook, google and twitter are all banned in China, think about this news.

</comment><comment><USER64> I worry that it's sort of the same line of thinking that leads folks to skip vaccinations for their children, i.e. "What about the Tuskegee experiments and MKUltra? We can't trust government claims about health risks."

<comment><USER65> There are some vaccines that don't make sense. The flu vaccine does not make sense to get because you still have a chance of contracting that strain after getting it and you're still as likely to get other strains and it makes you go to the doctors during flu season (a not-so-smart time to go). As for this situation, the FCC and NSA should be the ones talking about it. Seeing network communications is easy enough (especially if you have a backdoor). Buying Huawei means you have the possibility of them spying on you and the US. I'm not too thrilled about surrendering random information to the spies...

<comment><USER66> Doctors defer to the experts when they need some javascript written. Maybe do the same when you're so clearly out of your depth?

<comment><USER67> This comment would have been better without the ad hominem.

Perhaps something like: _" maybe it makes sense for the average person to defer to a doctor's opinion with regard to flu vaccine"._</comment></comment></comment></comment>


PyCodeConf, PyOhio, and Airbnb -- "Don't Forget the Humans" - <AUTHOR> http://blag.whit537.org/2011/08/in-conferences-and-customer-service.html

<comment><USER2> I posted this on the OP's blog; but I figure it's worth repeating here as well.

I'm only involved as a speaker; I was invited to speak, and so I am going to speak. Yes, I am the chair of PyCon, but me speaking at a conference is orthogonal to that.

I am not an organizer - but I am interested in seeing how "other conferences" such as pycodeconf run and play out in the community. I also don't drink, so I don't think I'll be attending many, if any of the parties.

The Python community has room in it for many types of conferences - DjangoCon, PyCon, PyOhio, PyTexas, EuroPython, PyCon Ireland, PyCodeConf - frankly, the more the merrier - each one brings its own flavor and color to the community.

Will PyCodeConf succeed? I don't know - but for me, as someone who has never been to an animal like it (unless you count Linux conferences in the dot com) I am very interested to see how it works, and how the community/attendees like it/etc.

As a PSF director; I can state that the PSF is frequently promoting and assisting in financing exactly the types of conference you cite; that's how we, as a board, feel that we can help grow the community we have all grown to know and to love.

So, in essence, I believe there is room for all of these flavors and conference, and they all go into making this fantastic community ([http://jessenoller.com/2011/07/28/thank-you-the- impossibilit...](http://jessenoller.com/2011/07/28/thank-you-the- impossibility-of-its-going-to-be-ok/)) we both love so much.

No one is forgetting the humans, at least not while I'm around.

<comment><AUTHOR> Fuck yeah, jnoller.</comment></comment>


The Pioneer Ov Simplified Speling (1912) - <AUTHOR> http://publicdomainreview.org/collections/the-pioneer-ov-simplified-speling-vol-1-no-1-1912/ <comment><USER2> I run a STEM Lab for 240 3-5 year old child who are 100% below the poverty line. We use a computer program for teaching literacy. (Our Literacy Program is horrible but all the other programs out there are just as bad or worse)

I continually am frustrated at the lies we tell about phonetics and the sounds of letters. Sound out the letters. C and K are the same. X has a word end sound of KS. Z and C have a S sound that they both use. There has to be a logical way to teach sounds to pre-readers that doesn't fumble all over the place.

P.S. If anyone is creating a new Literacy Program for Pre-Schoolers and Kindergarten students I would love to be a part of it. Have worked one on one with hundreds every week.

</comment><comment><USER3> An interesting perspective by Mark Twain (1899): [https://ebooks.adelaide.edu.au/t/twain/mark/what_is_man/chap...](https://ebooks.adelaide.edu.au/t/twain/mark/what_is_man/chapter11.html)

</comment><comment><USER4> I don't think a big bang approach will work, but gradual small changes which don't conflict with local Standard English pronunciations will, and is already happening.

I pronounce "herd", "bird" and "word" with different vowels, which can be reliably predicted from the spelling. I pronounce "good" and "food" with the same vowel. Most spelling reformers merge the first three and distinguish the second two, because _their_ accent does that. A better approach would be to distinguish them all.

A few words with silent letters could be simplified, e.g. "knight" and "night" could both be spelt "nite" and disambiguated in context, as all accents agree they're homophones.

Webster did get a few limited spelling reforms adopted in the USA, however. Other Americanisms are gradually being adopted. Hardly anyone in the USA writes "theatre" nowadays (as in "Firesign Theatre"), and in the UK we no longer write "computer programme". I still hold out with "connexion" (from Latin "connexio") but it's becoming a lost cause. There's been a regression with "-ize" (the spelling favoured by Fowler and the OED), now increasingly spelt "-ise" in the UK, largely I suspect due to Microsoft's spelling checker.

</comment><comment><USER5> Why did English spelling reform never take off?

First off, English has a rather complex phonemic reservoir for the Latin alphabet. We have about 20 vowels and 25 consonant phonemes (exact numbers depend on dialect and how you count them), yet our script allows only 26 one- character targets. 28 if you want to bring back þ and ð. Adding diacritics or new characters runs into the major problem of support, as anyone who's had to take a foreign language like France or Spanish while using en-US keyboards are all too aware. Indeed, þ was dropped from the language in part because of the lack of support in printing type.

A second problem is that phonetic spelling is somewhat vague as to what the goal is. Should you try to give only one spelling to each phoneme, so that you can perfectly spell given pronunciation? Or should you be able to predict the pronunciation given the phoneme? It's also worth pointing out that pluralization and verb inflection rely heavily on simple morphological rules (add -(e)s/-(e)d to the end of the word) which would be complicated by insisting on phonetic purity (note the 'z' sound in words like dogs or says). Demanding only one spelling of phonemes seems a bit harsh, especially if you're going to admit digraphs. I like being able to distinguish words like meet and meat.

Another problem is that there are some phonemes without clear representation. The 'th' digraph (retained in all spelling reforms I've been aware of) actually represents two distinct phonemes (say "Thy thigh" to hear the difference clearly). Of course, there is a very natural pair of letters to represent it, courtesy of Icelandic (þ and ð), but see above (also, people are liable to assume ð is approximately a "d" sound, which isn't right). The "sh" is natural to many people, but its voiced counterpart (ʒ in IPA) has no natural counterpart. The soft g or a j is a dʒ sound; "zh" crops up in some Romanizations of Chinese, but it's not attested in English; and the places where it does come up (e.g., vision) don't lend themselves to a natural borrowing.

Which brings us to the biggest problem of spelling reforms: they target the wrong thing. When showing off these reforms, there's often big hoopla about things like "-tion is pronounced /shun/ and that makes no sense!" whereas the s/tion/ʃun/ pronunciation rule is one of the most productive and least exceptional in the English language (cation is the only word that comes to mind as an exception, and even then it's not really an exception because the word is derived from cat·ion, so the -tion isn't really a group). The real travesty of English spelling is that we borrow words from foreign languages and reuse the same spelling _and_ pronunciation. Words like gyros ("yee-rohs") or quinoa ("keen-wah") are absolute travesties and really should be changed in either spelling or pronunciation. But insisting that we must change "advise" to "advaiz" and "advice" to "advais" seems overly pedantic when they're perfectly predictable with standard phonetic English rules.

That's one final thing to bring up: English is already quite phonetic. [http://www.zompist.com/spell.html](http://www.zompist.com/spell.html) gives a list of ~60 substitution rules to convert English spelling to pronunciation that covers ~80-90% of words. The main real travesties (in non-imported words) are a few vowel digraphs like -ea-, which has several pronunciations with no real rule to pick which one applies.

<comment><USER6> Nitpick, the pluralization phoneme in English is /z/, not /s/. To see this, note that we can have an [s] sound following a voiced sound at the end of a word, (eg. floss vs flaws), but never have a [z] sound following an unvoiced sound at the end of a word.

More relevantly, the difference between phonemic and phonetic representations can normally be derived from the phonetic context. For example, in the -s example mentioned above, English has a general rule that a /z/ sound following an unvoiced sound at the end of a word becomes [s]. Further, these rules come naturally to (native) speakers, so it is likely that we would not need to teach them much when we teach reading.

>meet and meat.

While this is a nice property, it seems like we only have it for some homophones by chance, not anything productive. Further, there is no productive way of knowing which writing is which meaning.

> The 'th' digraph (retained in all spelling reforms I've been aware of) > actually represents two distinct phonemes.

This is a valid critism of existing attempts, but is probably a reflection of their pragmatic nature. If the ambiguity doesn't end up being a problem, then it is not worth introducing a new digraph to fix it. Most of the fixes in spelling reforms have been focused on removing oddities from the spelling system, instead of adding them to better accommodate the spoken system. Incidently, if we were to fix this, I would recomand adding the "dh" digraph for ð (as d is the voiced counterpart of t).

> dʒ sound is not attested in English

Judge

>the places where it does come up (e.g., vision)

How do you pronounce "vision". I only recal hearing it with the "ʒ" fricative, the "dʒ" affricative sounds weird.

The bigger problem with spelling reform is is simple momentum. Adults already know the current spelling at a fairly deep level, so retraining them would be a massive effort for a payoff that they themselves would likely never see.

Additionally, spelling reform would not be a one-time thing. As the language continues to drift, we will likely need a new set of reforms every few generations.</comment></comment>


How MembershipReboot stores passwords (2014) - <AUTHOR> http://brockallen.com/2014/02/09/how-membershipreboot-stores-passwords-properly/ <comment><USER2> This isn't that innovative, it's exactly what Django does by default.

By the way, this:

> And finally, MembershipReboot allows an application to require the user > change their password periodically. This way user's password can get updated > with the current iteration count.

is pretty horrible. Don't force the user to change their password. If you need to upgrade the iterations, just do it seamlessly the next time they authenticate.

</comment><comment><USER3> I stopped reading here:

> To help determine the right iterations for your hardware I have an utility > here.

Everyone with just the slightest idea of how hashing and password cracking works should know that there is no such thing as "right number of iterations for your hardware" because the attacker would obviously have different hardware.

</comment><comment><USER4> He doesn't store passwords - which would be a terrible idea.

</comment><comment><USER5> How is this different from bcrypt?</comment>


Texting, social networking, media use linked to poor academic performance - <AUTHOR> http://www.sciencedaily.com/releases/2013/04/130411131755.htm#.UWfbpUxtXsk.twitter <comment><USER2> Quoting:

        According to a new study, freshmen women spend
        nearly half their day -- 12 hours -- engaged in
        some form of media use, particularly texting,
        music, the Internet and social networking.

How do you spend nearly 12 hours a day on media use?</comment>


Hayabusa-2: Japan Spacecraft Touches Down on Asteroid - <AUTHOR> https://www.bbc.co.uk/news/science-environment-47293317 <comment><USER2> If you haven't already, take a look at their awesome dashboard [http://haya2now.jp/en.html](http://haya2now.jp/en.html) linked a couple of months ago [https://news.ycombinator.com/item?id=18046274](https://news.ycombinator.com/item?id=18046274)

<comment><USER3> Brings to mind the user interface for Metal Gear Solid 5: The Phantom Pain.

<comment><USER4> Yeah, it's kinda nostalgic in that it reminds me of those hacker-ish designs of late '90-'00s. Cohesive, readable, not too much whitespace.

<comment><USER5> Wow, I looked at it and was just about to come back here and bash non- functional science fiction design, but it's actually completely usable and every element is displaying relevant data.

</comment></comment></comment></comment><comment><USER6> Space resource usage could first happen with asteroids, not on the Moon or Mars. Propellants mined from asteroids can be transferred anywhere with very low delta V and low thrust. It just takes time.

<comment><USER7> It sounds cool sure, but what resources do we even want from asteroids? We have plenty rocks and ice on earth and even something like iron ore is just 0,08$ per kilo. Getting that kilo to LEO is 2200$ and getting cheaper every year. We have all the resources and infrastructure we need right here on earth while absolutely no one has any idea how to manufacture things in space.

<comment><USER8> A lot of heavy rare earth metals can only be found in very limited concentrations in the earth's crust, with the largest concentrations all being from asteroid impacts. As a consequence, these metals are incredibly valuable. A single high-concentration asteroid, could provide more of these metals than has been mined in the history of the earth, in high concentrations, and may be able to make a host of applications economically viable, which previously weren't.

<comment><USER9> but it would be, by far, the most expensive mining operation in the history of mining operations

<comment><USER10> Yes, but if several thousand tons of iridium, platinum, or various rare-earth metals could be captured & towed to Earth orbit, the payoff could be astronomical.

<comment><USER11> Suddenly there would be so much of a supply that the sale won't be profitable any longer. That's probably the reason why no one is extracting rhodium from nuclear waste, where it is a common fission product.

<comment><USER10> That's why I suggested orbit, where the supply could be parceled out (or its true extent even kept secret) so as not to crash the market.

<comment><USER11> The demand is mostly in chemical industry and very inelastic. No one is going to put another plant on line because platinum group metals are cheap (but plants may be pulled off line because the economy is in the dumps, as happened in 2008 and 2017). Even small increases in supply will lead to great drops in price. You can only hope that a plentiful supply would encourage new uses.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER12> Is space exploration / commercialization speeding up? It is now that almost every day we hear some new awesome space mission.

<comment><USER13> In the case of commercialization, should we worried about a failure-to-launch scenario? We supposedly only have enough fuel to get a volume of about Mount Everest into space. Given the economics of climate change being so fucked up and a tragedy of the commons, could we doom our species to spending the rest of eternity on this decaying rock if we allow market forces to shit away all the fuel required to make us interplanetary?

<comment><USER14> I'm not convinced we do have a limited earth fuel budget as you say. There's lots of options for rocket fuel and many of them are highly abundant or can be synthesised.

For example, hydrogen and oxygen are the 1st and 3rd most abundant elements in the universe, so liquid oxygen and liquid hydrogen fuel is always going to be an option

<comment><USER13> Thanks!

</comment></comment></comment></comment><comment><USER15> Gotta love them Japanese...

 _Hey let 's go visit an asteroid.

Might as well stick a rover on it.

Why send one rover when you can send four!

Hey guys, let's bring back a chunk of it.

You know what'd be great? Explosives! Let's blow off a deeper chunk and bring that back too._

So many moving parts to this mission.

</comment><comment><USER16> Why does space advancements made by non-US agencies only receive after-the- fact notice in the US media? I would like to know about these before, and in much more detail!

<comment><USER17> I think they have to be more proactive in engaging journalists. NASA is really good at doing this.

And in general US media is very centered on the US. The outside world doesn't exist much to them if there is no connection to the US.

</comment></comment><comment><USER18> What an interesting project. Congrats to the team for what they've accomplished so far.

</comment><comment><USER19> Couldn't find this in the article: How is it expected to reach the Earth in 2020 when it took 3.5 years to get to the asteroid? Will it begin its return when the asteroid is closer to the Earth?

<comment><USER20> I couldn't either, but on the Wikipedia page[1] for Hayabusa-2, there is a gif of the flight path. Maybe it took 3.5 years to achieve proper alignment/speed to land on the asteroid, but due to the larger size of earth and the position of Hayabusa-2 when it begins its return, it will be much more straightforward?

[1] [https://en.wikipedia.org/wiki/Hayabusa2](https://en.wikipedia.org/wiki/Hayabusa2)

<comment><USER21> Getting into an orbit next to some other small object is kind of hard. In the GIF you can see Hayabusa-2 making multiple orbits below the asteroid's orbit to catch up (lower orbits are faster) before it raises its orbit to the height of the asteroid. Once it reached the asteroid it had to do another correction to the orbit to make sure they stay together.

In comparison, meeting something massive like a planet is very single: go into any orbit that nearly hits the planet, and when you are there slow down enough to let charit gravity pull you into an orbit around that planet.

tl;dr: more gravity makes rondevous easier and quicker

</comment></comment></comment><comment><USER22> just fyi:

>>Due to its high density, shaped charge and explosively formed penetrator liners have been constructed from tantalum. Tantalum greatly increases the armor penetration capabilities of a shaped charge due to its high density and high melting point.

( [https://en.wikipedia.org/wiki/Tantalum](https://en.wikipedia.org/wiki/Tantalum) )

</comment><comment><USER23> This is a very cool thing ! I did not even know that Japan had a space program.

I guess they are not advertising as much as NASA does.

<comment><USER24> I am flabbergasted that you were not aware of JAXA.

How is this possible. What are people been taught?

[https://en.wikipedia.org/wiki/JAXA](https://en.wikipedia.org/wiki/JAXA)

<comment><USER25> > How is this possible. What are people been taught?

For each and every think you know, there was a time where you didn't know it.

<comment><USER26> It would be interesting, if you could give a proof by induction!

</comment></comment></comment></comment><comment><USER27> Some poor alien is going to come across this rock in a few million years and think it's been weaponized.

<comment><USER28> Chances are that a highly developed alien race won't be as bloodthirsty and barbaric as the human race, so "weapon" might not be their first thought.

If you're space faring on a _large_ scale you probably had to leave conflict and infighting to lesser races, just so you could focus energies on making that leap.

IMHO.

<comment><USER29> What are you talking about? Infighting among humans has always been one of the main drivers of innovation. Do you know who invested rockets, and why? The Germans did during WW2.

<comment><USER28> War and conflict is a driver for _mankind_. You could say it is our way of "gamifying" technological advancement, because it is _our_ strongest drive.

That's just another argument that humans are truly a race of barbarians.

<comment><USER30> > That's just another argument that humans are truly a race of barbarians.

relative to what? we don't know how violent alien species are. they could be very peaceful in comparison, but it is just as likely that they are more violent than we are.</comment></comment></comment></comment></comment>


Main ingredients for turning around a doomed IT project - <AUTHOR> https://firstname.lastname@example.com/the-3-main-ingredients-for-turning-around-a-doomed-it-project-13728224f1ee <comment><USER2> Normally, a "doomed" IT project is canceled (maybe partly, in the form of a cheaper redesign/scope reduction) or allowed to be late; how can it be "turned around" when the damage is done? A team doesn't become more capable or more efficient by trying hard and recovering motivation, learning takes time.

Discussing "mission", ownership and (most worrying) values in this context is very strange; it's probably advice for nontechnical (i.e. incompetent) managers that don't have, and never had, any chance to understand and address the actual problems.

<comment><USER3> What he seems to be talking about are failing projects. Even thought he talks about doomed projects on both medium posts (that he posted both in a matter of minutes to HN) he is referencing to failing projects that have something against them (money, disfunctional team, time, ...)

Many of his conclusions are questionable and seem more or less only plausible because everyone likes a dramatic story/underdog winning. E.g. in his "I'm passionate about doomed IT projects" article he says

> Extremely unified and high performing teams. > These are people that I would > truly cherish the opportunity to work with again. I know that they are rock > solid and that if we ever worked together again, we would make an extremely > effective team right off the bat.

Those are the same people that fucked the project up to begin with and yay they changed and the project was saved and maybe they redeemed themself in the process, but I would rather work with people that I could trust from the beginning and not becajse they changed when their ass was on the line. I have quite a few people I like to work with and some I met in a project that felt like "we against the world" but with them it never felt like we were failing and nobody would call the project dommed, because we routinely achieve the results we more or less expected. If we would fuck up this hard that our project was deemed as doomed than I would have a hard time getting sleep at night.

Anyway his article is "only" about changing the mindset and talking to the team, but really nothing about how to organize. And yes of course a project is doomed if nobody on the team wants to work on it, bad-mouths it and actively tries to fuck you over.

Ps excuse my language, but the "article" left a bad taste in my mouth because it seems more "inspirational" then anything else from a person that just wants exposure. I could be wrong... I don't think I'm

<comment><USER2> "I had to learn, out of sheer necessity, the tools to create unity and direction for teams. This is a skill that is so powerful and fascinating it eclipses all my technical skills."

"No matter what has happened in the past, now is the time to own up to mistakes, and set new standards for going forward."

The familiar delusional narrative that it's _their_ fault is easy to see.

In addition, passion about turning around failing projects seems intrinsically psychotic; it's a job, not a struggle for one's life.

<comment><AUTHOR> Hey HelloNurse, thanks for the feedback. I understand that you think Im sensationalising, that advice is taken to heart and will not be repeated in my future writing.

Ill elaborate on your points.

"I had to learn, out of sheer necessity, the tools to create unity and direction for teams. This is a skill that is so powerful and fascinating it eclipses all my technical skills."

I say this because I'm a programmer, not a team building dude.

But I was put in a project to turn it around, an important detail I did not put in the article. The project was over time and over time and over budget and most of the original team was removed and me and the team I refer to was put in.

There was a total breakdown of communication and no work productive work was getting done.

Nobody knew what to do. Thats why I contacted a guy I know which does business coaching and he taught me the three overarching things I mention in article 2 and the tools to build teams that I will be elaborating on in future posts.

"No matter what has happened in the past, now is the time to own up to mistakes, and set new standards for going forward."

I have seen plenty of unethical behaviour in my career. When your ass is on the line and your loosing money every hour, its easy to take the easy way out and take shortcuts. This is something that will permeate the project culture, and needs to stop. My sleep is more important than the project. Does this make it clearer what I meant?

"In addition, passion about turning around failing projects seems intrinsically psychotic; it's a job, not a struggle for one's life."

Here Im absolutely of guilty sensationalising. I was trying to get people to click and it worked, at the time of writing this comment it has almost 1k reads on medium which is way more than I was expecting.

But it's a lie, Im not passionate about doomed projects, I'm passionate about highly successful projects. I just happened to learn the tools for how to create goal oriented teams from doomed projects.

Thanks again for taking the time to write a comment, I'm very new at this so I need the candid feedback (everyone I showed to beforehand just said it was awesome so they were clearly just humouring me :D ).

Cheers, Adam

<comment><USER4> > I was trying to get people to click and it worked (...) But it's a lie

Can't wait for your post about how you grew out of being a liar and how being truthful is a skill "so powerful and fascinating it eclipses all my" blabla

<comment><AUTHOR> OK, let me balance that.

It's not a lie because Im very grateful that I went through this because it taught me something valuable. But Im obviously not passionate about failed projects because the goal is good projects.

Now, if you are just going to try to catch me out and not try to understand that I am trying to communicate something real I am not going to waste my time replying.

I respect your feedback, please try to respect that Im trying to learn.

<comment><USER4> No. Don't hide behind words like "respect" and "learn". In your own words, you were not "trying to learn". What you were trying to do was:

"I was trying to get people to click and it worked, at the time of writing this comment it has almost 1k reads on medium which is way more than I was expecting."</comment></comment></comment></comment></comment></comment></comment>


NSA Contracts Israeli Company for Wiretapping  - <AUTHOR> http://www.wired.com/threatlevel/2012/04/shady-companies-nsa/

<comment><USER2> _According to a former Verizon employee briefed on the program, Verint, owned by Comverse Technology, taps the communication lines at Verizon, which I first reported in my book The Shadow Factory in 2008. Verint did not return a call seeking comment, while Verizon said it does not comment on such matters.

At AT&T the wiretapping rooms are powered by software and hardware from Narus, now owned by Boeing, a discovery made by AT&T whistleblower Mark Klein in 2004. Narus did not return a call seeking comment._

Pardon my ignorance, but why is the connection to Israel bad?

<comment><AUTHOR> Not sure there is a bad connection.

The fact that we're outsourcing our invasion of privacy to a foreign corporation is already hard to digest for many people.

<comment><USER3> Please keep in mind even if (in this case) Verint's solution (software and hardware) may be tapping/intercepting data, whether they are allowed to view the data is a different matter.

In most of those cases, 3rd party solutions are deployed (install, configured, integrated) and supported by the vendors, but they typically don't have direct access to the intercepted data.

Of course, that's not to say that these 3rd parties couldn't get access to intercepted data if they really wanted to. But I want to point out that carrier policies (usually) dictate a strict separation of concerns specifically designed to protect privacy so that such data only available to carrier security teams and law enforcement personnel.

<comment><USER4> ...right because Intelligence Agencies have no experience at building complex back doors into products...yeah, that never happens...

</comment></comment></comment></comment><comment><USER5> Also note that Google has a secret working relationship with the NSA so thoeretically your search data is also being 'outsourced' to Israel.

[http://www.pcworld.com/article/217550/google_comes_under_fir...](http://www.pcworld.com/article/217550/google_comes_under_fire_for_secret_relationship_with_nsa.html)

</comment><comment><USER6> Is this so they can say _they_ did it, not us?

<comment><USER7> Bingo. The NSA, really the USG writ large, only 'respects' the constitution to politically cover their asses and to claim they're bound by some sort of rules (no matter how broken those rules actually are). By now, it should be sparkling clear that these organizations have no respect for the ideals that the constitution attempted to enshrine, namely personal freedom and a government subservient to the people, and they should be continually called out as the illegitimate charlatans they are. I can't claim to have a specific way of ousting these parasites, but I can assert that any such way doesn't involve constitutional fundamentalism, D/R consent voting, incremental hopechange, believing authoritarian propaganda, narrowing the blame to a few 'bad apples', flag waving, or pushing the reality of the situation to the back of your conscience.

<comment><USER8> That's not entirely fair. It's not like every single person in these huge institutions is craven unprincipled authoritarian.

But there are clear cultural problems, and a broader political failure that enables these flaws to escape accountability.

I wish I had an easy answer, but sadly, I think the way things will go is that they'll get worse before they get better, and the process of change will not be easy. In the meantime, a great many largely innocent people are going to get ground up in the gears of the system our society is building.

<comment><USER7> The specifics of the individuals and their beliefs don't matter, the ultimate behavior of the institutions is corrupt. Talking about culture and notions of accountability is missing the forest for the trees - any resulting reforms will simply be received as 'what hoops do we have to jump through now?'. The only way to stop the NSA from performing surveillance on everybody is to completely remove their on-books funding and then dismantle the remaining criminal organization.

<comment><USER8> I'm sorry, but that just doesn't match reality.

I wish we lived in a world where we could put down our stick and trust everyone else to do likewise, but I do not believe that is the case.

The problem we have right now is ensuring the stick is used morally. That is an inherently cultural concept. There is no easy answer, unless you believe you are entitled to the same autocratic oppression of those you criticize.</comment></comment></comment></comment></comment>


Disrupting Wall Street [pdf] - <AUTHOR> https://www.time-machine.com/DISRUPTING-WALL-STREET-Print.pdf <comment><USER2> This is an incredibly fascinating concept, I'd love to see other opinions on the top of algorithmic trading!</comment>


Ask HN: How do you charge customers for calling your hotline? - <AUTHOR>

I know that at kneejerk that sounds like a terrible thing, since we all hate that.<p>But I'd like to know how to do this. Twilio already provides me with a mechanism to cheaply receive and process calls, but how do I charge the users for this? anybody ever look into this? Google doesn't turn up much that is useful. <comment><USER2> That's a tough one. Psychologically, customers feel that any difficulty they have is due to a defect in your product, and they shouldn't have to pay for your defects.

Also, you don't want to charge for Installation problems, and God knows they are the source of many support calls (I'm looking at you, InstallShield).

Customer Support can be a benefit to the company that makes the software, because they signal bugs or imperfections that you want to address. For every customer that calls, there will be many that don't bother and don't buy either.

Try two-tiered support: a free Support Forum with 24-hr response, where customers have the option of searching for questions from others who had the same problem, and what the solution was.

Phone support is available to premium customers who buy a yearly maintenance contract.

<comment><AUTHOR> no no, this isn't for customer support.

lets say I want to run a sex hotline. how do I charge you for calling?

(I'm not actually running one, but thats the example)</comment></comment>


Valve Moves to Choke Off $7.4B Gambling Market - <AUTHOR> http://www.bloomberg.com/news/articles/2016-07-13/game-maker-valve-moves-to-choke-off-7-4-billion-gambling-market <comment><USER2> I think Valve has a bit of responsibility in this, because they created microtransactions for "skins" in the game in the first place...

</comment><comment><USER3> Fascinating read. Long-time MMO and online player (and also years-long Steam user) - and I've never even heard of skin gambling.</comment>


Socialism - <AUTHOR> https://ideqa.blogspot.com/p/socialism.html <comment><USER2> Exactly one of the nordic countries has relevant amounts of oil money. What works there can't be 1:1 transferred to a random other country, but "OMG they have free money" is not the reason. All countries pay for "free stuff" in some way or the other. Extremely low effort article.

</comment><comment><USER3> Germany, socialist, free university, free healthcare, no oil. The us could easily afford such things, it is just a matter of priorities. This article is short sighted and uninformed.</comment>