I Ate Nothing but Meat for 2 Weeks - <AUTHOR> https://www.inc.com/sonya-mann/carnivory-zero-carb-experiment.html <comment><USER2> > The zero-carb community believes that we evolved to mainly eat meat, and > that ancient humans turned to plants only in times of near-starvation.

Correct me if I'm wrong but haven't most scientific studies of our evolutionary process revealed the opposite of this? For example, actual carnivores that have evolved over time don't require dietary supplements of vitamin c. Or if you look at the structure and prominence of our teeth they are clearly not designed to be solely for eating meat...

<comment><USER3> Chimps and Bonobos are our nearest relatives, so presumably we might look at their diets for pointers[1] - 50% figs, 3% meat, the remainder from other plants. I do like figs, but I don't think I can quite manage that... still, it's more sensible than eating nothing but meat (which is as you say nutrient deficient, has long-term risks for cancer, and clearly is not a viable option for a global population of 7.6B)

1: [https://blogs.scientificamerican.com/guest-blog/how-to- eat-l...](https://blogs.scientificamerican.com/guest-blog/how-to-eat-like-a- chimpanzee/)

<comment><USER4> Apes are closer. Plus humans are different enough from any still existing apes that the dietary comparison is quite worthless.

It is as if you were comparing tigers with house cats on diet based on hunting behaviour.

<comment><USER3> We're all apes[1]. And chimps are indeed our closest relations[2]. The tiger and my housecat are both obligate carnivores, so that comparison seems accurate to me (though I don't want him bringing down deer, there's a problem of scale).

1:[https://en.wikipedia.org/wiki/Hominidae](https://en.wikipedia.org/wiki/Hominidae)

2: [https://www.livescience.com/7929-human-evolution-closest- liv...](https://www.livescience.com/7929-human-evolution-closest-living- relatives-chimps.html)

</comment></comment></comment></comment><comment><USER5> I'm honestly not quite sure how to interpret this.

To me the idea seems bonkers. Even if I didn't try to eat more plant than animal, it would seem bonkers.

From what I've read, eating more meat is likely to increase the risk of bowel cancer [1]([https://www.cancercouncil.com.au/21639/cancer- information/ca...](https://www.cancercouncil.com.au/21639/cancer- information/cancer-risk-and-prevention/healthy-weight-diet-and-exercise/meat- and-cancer/))

Additionally, it's way, way harder to get all your vitamins and nutrients with only meats, especially while maintaining a variety of macronutrient options, but I don't really have a source for that, just mental math and experience.

<comment><USER6> Going to the extreme and eating only meat is a bit bonkers.

The main problem with our diet and what causes the most disease and death are carbs and sugar.

Take a look at this regarding nutrients and plants [http://www.zoeharcombe.com/2014/04/the-perfect-five-a- day/](http://www.zoeharcombe.com/2014/04/the-perfect-five-a-day/)

I have been researching all sides of this for 6 months now for a doc [http://foodlies.org](http://foodlies.org) so I'm very familiar with a ll the arguments and studies on both sides.

</comment></comment><comment><USER7> For those interested in long term viability, the Anderson family has been living on an all-beef diet for 17+ years now, including two children who have been raised entirely on beef.

[http://thenortheasttoday.com/anderson-family-on-meat-diet- fo...](http://thenortheasttoday.com/anderson-family-on-meat-diet- for-17-years/)

<comment><USER8> Come back when they are past 80

<comment><USER9> It might happen with n of 1 family...

</comment></comment></comment><comment><USER10> The diet she's describing is more commonly known as the ketogenic (keto) diet, rather than the "Bitcoin carnivore" diet.

<comment><USER11> Not really. The keto diet includes plants. Just not starchy or sweet ones, e.g. cauliflower, lettuce, broccoli, etc.

<comment><USER12> > Just not starchy or sweet ones, e.g. cauliflower, lettuce, broccoli, etc.

I dropped broccoli because of high carbs..

<comment><USER13> Broccoli is not really high in (net) carbs.

<comment><USER12> Around 5 carbs per cup, which can push from 20 carbs / day cap for keto diet.

</comment></comment></comment></comment></comment><comment><USER14> Two weeks? I've been carnivore since Jan. 1. Feeling great.

</comment><comment><USER15> I usually read most of the article, until I get the main point and some details, but this time i went through the whole thing because right now I am in the middle of a diy diet myself (nothing fancy, just cutting on carbs, paying a bit more attention to what I eat and cooking at home instead of eating outside).

First thing first, eating only meat is not as bonkers as it might seem. In fact, it's a huge an distinctive part of the Dukan diet, which starts by imposing a protein-only diet(§) for, guess what, ten days to two weeks. This is to get the same effect that Sonya Mann (the author of the article) experienced and thus to give a confidence boost to the dieter as immediate result help the dieter to go through the diet (keeping dieting is the hardest part of a diet as anyone that has dieted at least once can tell you).

After that you integrate vegetables (in this phase you're still losing weight) and go on like this with meat + vegetables for ideally one week for each kilogram you want to lose.

After that, you can basically start eating regularly(§§) for the rest of your life BUT you must always observe the meat/protein only Thursday (§§§), this also for the rest of your life.

I have followed the Dukan diet and it affected me positively and I have lost a significant amount of weight (but keep in mind, I was/am mildly overweight -- that is, i have belly fat).

The book that Dr. Dukan wrote about its diet is very cool because it explains in simple but proper terms how the diet works and _why_ it works. It also explains what to expect and when to expect sub-optimal results (for example, women should expect a wider variance in results because of hormonal ups and down -- mostly due to menstrual cycle).

So...

Going back to the story, eating meat only can be sustainable. Not sure how long, though.

Surely, I don't think it's such a great living. What bothers me the most, actually, is that the meat you buy nowadays at grocery store is filled with hormones and antibiotics (used to get animals to grow very much and very fast). One could argue, the humankind has evolved to eat meat, but also to go hunt for meat and eat it "fresh" (as in non-conserved, with no preservatives, no hormones and no antibiotics) but that's unfeasible nowadays.

Notes:

\-----

(§) calories only, plus yoghurt and integral oats to help with digestion.

(§§) regularly as in european-regular

(§§§) Thursday has been chosen randomly, for no particular reason, it's just a convention.

Edit: formatting.

<comment><USER6> There's no reason to ever go back to eating carbs, all they do is damage.

There actually isn't a ton of hormones and antibiotics in grocery store meat, it's mostly vegan propaganda I believed in until last week when I actually researched it. Soy products have 1000 times the hormones than any piece of meat.

<comment><USER16> Phytohormones don't bind to human receptors.

</comment></comment></comment><comment><USER17> So, what do mean-only eaters do about constipation? Because I've gone meat/fat only for periods of time, and if I didn't simultaneously supplement with fiber (usually hemp and chia), the results were not pretty.

<comment><USER14> Eat more fat.

</comment></comment><comment><USER18> Very nice one @ exolymph.

</comment><comment><USER19> This is the stupidest and most poorly researched article I may have ever seen.

They can't even get the name of the diet or the origins right.

</comment><comment><USER20> There are many researchers that come to the complete opposite conclusion. Most of the Animal products we can buy today are produced too cheaply and thus not very healthy to eat in large quantities.

Just watch "What the Health"[1] or "Cowspiracy"[2] and tell ne what you think about it?

[1] [http://www.whatthehealthfilm.com/](http://www.whatthehealthfilm.com/)

[2] [http://www.cowspiracy.com/](http://www.cowspiracy.com/)

<comment><USER6> I 100% agree we need to change our factory farming practices...

However, What the Health was riddled with lies, bad science, and misinformation.

[https://www.dietdoctor.com/health-review-health-claims- backe...](https://www.dietdoctor.com/health-review-health-claims-backed-no- solid-evidence)

[https://www.vox.com/science-and- health/2017/7/25/16018658/wh...](https://www.vox.com/science-and- health/2017/7/25/16018658/what-the-health-documentary-review-vegan-diet)

Even a vegan dietitian admits it is full of misinformation and bad science and calls for an end to this practice [https://www.vegan.com/posts/vegan- dietitian-review-what-the-...](https://www.vegan.com/posts/vegan-dietitian- review-what-the-health/)</comment></comment>


How to talk to a 36-year-old space probe with GNU Radio, a USRP and a big dish - <AUTHOR> http://www.jmalsbury.com/how-to-talk-to-a-36-year-old-space-probe-isee-3-with-gnu-radio-a-usrp-and-a-big-dish/ <comment><USER2> Oh cool! They presented this at Dorkbot-SF a couple of weeks ago. A bit I particularly liked was that, because of the relative speed of the probe, a couple of km/sec, the frequencies sent and received had to be separately adjusted. And also, Arecibo was broadcasting with enough power to _boil birds that flew over it._

It's _cool space shit,_ is what I'm saying.

Edit: here's some video: [https://www.youtube.com/watch?v=NTljlMH-0oM](https://www.youtube.com/watch?v=NTljlMH-0oM)

<comment><USER3> "Arecibo was broadcasting with enough power to boil birds that flew over it"

Birds that flew over the parabola of the antenna or birds that flew between the focal point and the parabola? I can't imagine the amount of energy the former would take (and the latter is impressive by itself)!

<comment><USER4> Same thing with the Mig-21 radar, and I presume other fighters. If they powered it up on the ground, bird would drop.

During WWII, soldiers would stand in front of the radar to keep warm. This was before health and safety.

<comment><USER5> There's a darwin award for a security guard at (I think) a TV studio who decided on christmas eve that work was too hard and instead spent the night sleep in front of one of their microwave transmitters. I believe they found him dead and cooked right through in the morning.

<comment><USER6> Did that actually happen? I know someone who worked at a shortwave (a.k.a. microwave) radio station when that almost happened. They had to shut down the transmitters occasionally to paint the radio towers, but someone had the bright idea that they could just power down long enough for the painters to climb on. Then, when they weren't grounded, they could power it back up during the painting. They actually did a test run with chickens before it dawned on anyone that they would be cooking anything up there!

<comment><USER7> Why would they do a test run with chickens if it hadn't already dawned on them to some degree?

<comment><USER6> They were worried about electrical problems, not radiation problems.

</comment></comment></comment></comment></comment></comment></comment><comment><USER8> Oh man. This is such a cool example of how open software platforms have made the world more accessible. Imagine how hard it would have been to rig up that modulation system from scratch 30 years ago.

Also, this article made me realize how you can do frequency addition/multiplication on arbitrary signals via complex multiplication/exponentiation! That part of the flow graph really confused me for a bit. So cool!

</comment><comment><USER9> Some glossary to make it easier to read:

USRP, Universal Software Radio Perhipheral - [https://en.wikipedia.org/wiki/Universal_Software_Radio_Perip...](https://en.wikipedia.org/wiki/Universal_Software_Radio_Peripheral)

SDR, Software Defined Radio - [https://en.wikipedia.org/wiki/Software- defined_radio](https://en.wikipedia.org/wiki/Software-defined_radio)

</comment><comment><USER10> Looks like we've already thrashed his server (oom errors); so here's a link to a cached version for the lazy: [http://webcache.googleusercontent.com/search?q=cache:Qhe6rYL...](http://webcache.googleusercontent.com/search?q=cache:Qhe6rYLO9rEJ:www.jmalsbury.com/how- to-talk-to-a-36-year-old-space-probe-isee-3-with-gnu-radio-a-usrp-and-a-big- dish/+&cd=1&hl=en&ct=clnk&gl=uk)

</comment><comment><USER11> I got to get me one of those _Arecibo_ dishes! I'm still impressed that they were able to get access to it.

</comment><comment><USER12> it was amazing the way they accessed it

</comment><comment><USER13> The hole thing they are doing is very cool and they write and post allot of stuff.

Unfortunately most of the text they post is quite boring and detail less.

It would be nice if they added someone new to the team that was a better writer.</comment>


Computing Ranges in Constant Time - <AUTHOR> https://deniskyashif.com/computing-ranges-in-constant-time/ <comment><USER2> Conclusion: You need pre-processing and another data structure (sparse table) anyway....

On the other hand, if you have a particular problem, there is always someone that have solved in a very clever way to make it optimized for the given situation.

But, Please, folks in HN, don't take questions/answers like this and ask them on interviews....

They are very specific, and the solutions are basically using tricks (i.e. enough esoteric data-structure and algo), to solve those limited amount answers.

<comment><USER3> I am not so sure about this technique being specific. I'd say sparse tables are quite well known and presented to students at one of Algorithms and Data Structures courses at most universities. Another generally known solution applicable here would be segment trees with Theta(n) preprocessing and Theta(log n) query.

Also the problem of querying range sums, as the author himself notes, has actually much simpler solution in form of a prefix sum array, which is exactly what the name suggests and can be computed in one iteration, queries being constant time.

Obviously self-taught developers might be unfamiliar with these concepts and one might make a point of these questions screening for computer science background, but I personally believe that being aware of fundamental algorithm design techniques is important for programmers working on non-trivial problems. Some people say that you can always google these things, but can you really? It's like saying that you don't have to learn integration and just continue on with calculus, always being able to just look up needed formulas as you go.

The value of these fundamental algorithms is much more than just knowing how to write them when the need arises. They teach you general principles of algorithm design, present with many patters you can apply in problem solving and create a solid foundation for being able to deal with non-trivial problems. Knowing how segment trees or sparse tables work opens you up to whole new domains of useful applications building on them. There are reasons why these are generally taught at undergraduate level.

<comment><USER2> Comp Science major here, I still think these type of questions are not relevant years down the road, unless you explicitly are working with them. (eg. most database systems, log storage, and such will have to deal with such optimizations).

If you do, then it is fair to ask. But I have seen interviewers asking questions like these even for folks that would not need them . (aka, mobile development, of front end JS)

It is like asking a motorcycle racer/driver on whats the fastest way to swap four wheels in a F1 race.... Makes sense of the formula 1 driver, but not for the 500c motorcycle driver.

Unfortunately our industry is filled with lots of self-congratulating types that use interviews to inflate their own sense of self worth.

</comment></comment></comment><comment><USER4> So this method works for max and sum. What else? Is it any sort-of "associative function" \- ie, f st. f(x, f(y,z)) = f(f(x,y), z)?

Are there other useful functions satisfying these conditions?

<comment><USER5> The one that works for sum works for all associative functions. One can do a bit better using the same amount of space, but with query time O(α(n)), where α is the inverse Ackermann function. [http://citeseerx.ist.psu.edu/viewdoc/summary?doi=10.1.1.79.1...](http://citeseerx.ist.psu.edu/viewdoc/summary?doi=10.1.1.79.1554)</comment></comment>


Copyright troll Righthaven ordered to pay $120k in attorney fees - <AUTHOR> http://www.lasvegassun.com/news/2011/oct/26/righthaven-ordered-pay-nearly-120000/

<comment><USER2> $120k is maybe peanuts for a copyright troll firm backed by millions from investors. As long as investors are willing to put money into these kind of firms, a lot of lawyers will be seduced to keep up the trolling. They need to make a living too, and it's easy money.

<comment><USER3> FTA they are having problems posting a bond on previous $34k fee awarded against them.

</comment></comment><comment><USER4> I can only hope this is over quick and does not become the medusa case that was the SCO case where you thought it was over but just kept coming back after many deathblows.

<comment><USER2> And if it will, we'll be able to follow the proceedings along with excellent comments, on <http://www.groklaw.net/>

</comment></comment><comment><USER5> Thank god for common sense rulings.</comment>


On the search for exomoons and one possible candidate - <AUTHOR> https://blogs.scientificamerican.com/observations/are-astronomers-on-the-verge-of-finding-an-exomoon/ <comment><AUTHOR> The pre-print (not yet peer-reviewed) is on Arxiv [1]

[1] "HEK VI: On the Dearth of Galilean Analogs in Kepler and the Exomoon Candidate Kepler-1625b I" [ [https://arxiv.org/abs/1707.08563](https://arxiv.org/abs/1707.08563) ]</comment>


The Sound So Loud That It Circled the Earth Four Times - <AUTHOR> http://nautil.us/blog/the-sound-so-loud-that-it-circled-the-earth-four-times <comment><USER2> Nice. I hadn't thought of there being a limit (due to vacuum) to sound intensity.

Reminds me of this recent comment on reddit: [http://np.reddit.com/r/space/comments/2h9y9g/the_first_launc...](http://np.reddit.com/r/space/comments/2h9y9g/the_first_launch_from_cape_canaveral_1950/ckr6mev)

"the Saturn V rocket produced a SWL (Sound Power Level) of about 220 decibels, which is sufficient to melt concrete nearby and set grass aflame a mile away,"

<comment><USER3> Yes! My favorite example of this is the sound made by the space shuttle's solid rocket boosters at liftoff. Techies who have seen recordings of shuttle launches generally assume the guttural crackling, popping roar sound they hear is due to a badly adjusted microphone clipping the loud sounds. In fact, this was a physical phenomenon that could be heard in real life, due to the pressure waves physically "clipping" against a vacuum upon reaching the atmospheric pressure limit! Sorry I can't seem to find any better sources, but this is an anecdote I've heard from several witnesses: [http://forums.prosoundweb.com/index.php?topic=98023.25;wap2](http://forums.prosoundweb.com/index.php?topic=98023.25;wap2)

Here's a good example of the sound I'm talking about: [https://www.youtube.com/watch?v=OnoNITE- CLc&t=1m44s](https://www.youtube.com/watch?v=OnoNITE-CLc&t=1m44s)

<comment><USER4> I had the privilege of watching STS-134 launch from the press site and everyone tells you: "it's loud. louder than loud. you will be surprised by how loud it was." and that still wasn't enough to prepare me. It is loud. It is literally like the sound is clipping, the brapping noise moves through your teeth, it vibrates your clothes, you feel it inside of you. It is incredible, and I was so lucky to have watched it from the closest any humans are allowed to be (except for the brave rescue team in an APC 1 mile away).

<comment><USER5> Wow! That sounds like an amazing experience. Kind of a dumb question, but were you also impressed by how fast it goes up, or does it 'float' into the sky?

</comment></comment></comment></comment><comment><AUTHOR> Hey, I'm the author of the post (on twitter @aatishb). Thanks for voting it up. Would love to hear your thoughts and constructive feedback. Cheers. (PS the references linked to at the bottom of the post are packed with fascinating information about Krakatoa, for anyone who wants to dig deeper.)

<comment><USER6> How does something like the Tzar bomb compare in terms of sound pressure? Would the immense volume of ejected material from the volcanic explosion move more air than a nuclear explosion? I'd guess lots of mass (air molecules) is just vaporized in a nuclear explosion, leaving much less mass to create pressure deltas.

<comment><USER7> Wikipedia says it was four times as powerful as Tzar Bomba, which would put it in the neighborhood of 200Mt. Technically Tzar Bomba was suppose to yield about 100Mt, but the scientists dialed it down a bit because they were worried about it.

<comment><USER8> My understanding is that the yield was halved by the use of a lead tamper, rather than a uranium one. The tamper is a shield around the core that slows down the explosion in order to consume the reactants more fully. In production they commonly make the tamper out of waste uranium, which undergoes fission during the blast and contributes a significant amount of energy, but if you don't need the boost then lead works fine, or anything else heavy. The other thing about uranium is it greatly multiplies the radioactive fallout (fusion bombs are actually pretty clean when lead is used), which may have contributed to the decision not to use it.

</comment></comment></comment></comment><comment><USER9> Interestingly, the sound intensity will decay as a 1/r law, where r is the distance from the source. (I'm assuming conservation of sound energy as it travels horizontally, i.e., no loss to interactions with atmosphere and terrain). Compare with the 1/r² laws like the strength of an electric field at a distance r from charge Q: E(r)=kQ/r².

In both cases there is a total of something (sound energy or electric field lines) and that total must be split over all possible directions. The total electric field must be split over the surface area of increasingly larger and larger spheres hence the 1/r² behaviour (1/4πr² to be precise). The sound energy is spread uniformly over a circle with circumference C=2πr, hence giving a 1/r decay, over short distances.

For longer distances, the curvature of the earth will play a role. Come to think of it, it must have been _really_ loud somewhere diametrically opposite to Krakatoa, 17 hours after the eruption...

<comment><USER10> Sound intensity actually falls off as 1/r², and here's a source:

[http://hyperphysics.phy- astr.gsu.edu/hbase/acoustic/invsqs.h...](http://hyperphysics.phy- astr.gsu.edu/hbase/acoustic/invsqs.html#c1)

<comment><USER11> If sound traveled as a sphere, then it wouldn't be able to circle the Earth. If you imagine a sphere growing from a point on the Earth's surface, most of it will wind up in space, and none of it will reach the opposite side of the Earth. The 1/r^2 falloff is probably just an approximation that holds true for short distances or smaller intensities.

In this case, the soundwave was able to follow the curvature of the Earth, which implies that it wouldn't decay as a sphere but rather a plane, which would be a 1/r falloff. I wonder why sound of massive intensity will follow Earth's curvature?

<comment><USER12> Why don't you think that the sound waves would go in all directions, and be absorbed / redirected at the edges? What you see following the curvature of the Earth is the result of that, and once you factor in the second-order wave reflection, it's still on the order of 1/r^2 isn't it?

<comment><USER11> Nah, imagine a point on the earth. Now trace rays from that point in every possible direction. All of those rays will eventually lead to space or to the ground, and none will reach the other side of the Earth. Since molecules are physically further apart the higher you go in the atmosphere, it seems unlikely that the energy would be redirected at the edges, only dispersed. That must mean the wave is literally following wherever the atmosphere is thickest rather than simply being reflected.

<comment><USER13> _Sound waves can diffract around objects, which is why one can still hear someone calling even when hiding behind a tree._ :

[http://en.m.wikipedia.org/wiki/Difraction](http://en.m.wikipedia.org/wiki/Difraction)

<comment><USER11> Is diffraction the reason why soundwaves could travel around the whole Earth? My previous understanding of diffraction was that obstacles cause waves to propagate in different ways. But the thinning of the atmosphere isn't really an "obstacle." The molecules that soundwaves use to propagate are simply further apart from each other, meaning waves are more likely to disperse and lose energy than to keep traveling or bounce. That would imply the boom from the volcano should disperse into space and go silent rather than travel around the Earth. But since that doesn't happen, it seems like the waves follow wherever the atmosphere is thick.

I'm having trouble understanding how diffraction would cause that end result of "waves go where the atmosphere is." If waves could bounce off of the thin atmosphere near space, that would make total sense. But they can't bounce due to thin atmosphere, only disperse, so it seems like there's some other phenomenon in play.

<comment><USER13> Sound waves are points of high pressure and points of low pressure. At each point of high pressure the pressure tends to spread uniformly in all directions. Likewise at points of low pressure there is sucking from all directions. Opposite directions cancel, i.e. orthogonal to the wave direction. All in all the sum of all points of pressure creates a moving wavefront. Which naturally bends around obstacles. The earth is just a very big obstacle.

<comment><USER11> Hey, thank you for taking the time to explain this. I really appreciate it.

I'm having trouble seeing how that explanation would explain the case at hand. Your explanation is likely correct, and I'm probably just thinking about it incorrectly. Would you mind pointing out the flaw in my logic?

In this scenario, a volcano's boom was so loud that it traveled through the atmosphere, all the way around the Earth. Your explanation is perfectly reasonable for thick atmosphere. In thick atmosphere, a soundwave is a pressure differential, and since molecules are densely packed together (since the atmosphere is thick), there's no choice but for the molecules to "slosh around." The high pressure areas will spread to the low pressure areas within the thick atmosphere and create a moving wavefront, exactly like you said.

But as the soundwave travels closer to space, the atmosphere becomes thinner. There are fewer molecules for the soundwave to travel through. That means a pressure differential will have less medium through which to traverse. Since there are fewer molecules, there's more room between them to absorb a pressure differential, right? For example, the reason sound travels so well underwater is because water is extremely dense in comparison to the atmosphere, so less energy is needed to travel an equal distance underwater. Correspondingly, near space where the atmosphere is thin, _more_ energy would be needed to traverse an equal distance. That must mean that as the wavefront approaches space, the wavefront should dissipate. Since more energy is required to travel through less atmosphere, then as the atmosphere approaches zero, the energy required for a wavefront to travel one meter should approach infinity, and that's why it seems like the wavefront should dissipate near the edge of the exosphere.

But in this case, the wavefront didn't dissipate. The volcano's boom kept on going all the way around the Earth, and it was somehow able to maintain its energy. If the soundwave travels as a sphere from its point of origin, then that sphere should have a hard time traveling all the way around Earth, shouldn't it? So it must not be travelling as a sphere, but something else.

You're saying that "something else" is diffraction. I'd like to understand that. How is it that a wavefront of such intensity can approach the exosphere where it should dissipate, yet not dissipate and instead keep traveling all the way around the Earth due to diffraction?

<comment><USER13> It is enough to think about the part of the sound wave, a ring, that travels horizontally to see that it bends with the curvature of the earth. The front of the wave will at every point "shoot" some of the energy horizontally forward, and horizontal is at every point tangential to the earth surface. What happens to the sound energy going upwards, well, energy can't disappear. And certainly not into the nothing between the air molecules in thin air. The wavefront going vertically up will eventually push some air molecules away from earth without them hitting any other molecules further out. And then gravity will pull them back. That is in fact a kind of reflection. The speed of sound changes with density, so the wavefront will not move perfectly spherically. That and the gravity induced ripples on the top of the atmosphere will distort and dissipate the energy around the earth in a somewhat complicated pattern. I think. I'm not a physicist.

</comment></comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER14> To put this in context, the Krakatoa eruption released energy roughly equivalent to a 200 megaton bomb, which is roughly four times larger than the "Tsar Bomba", an H-Bomb which is the largest nuclear weapon detonated to date. The globe's average temperature fell 1.2 C after the eruption due to SO2 increasing the Earth's albedo. The Volcanic Explosivity Index (VEI) of the Krakatoa eruption was 6, and it's estimated to be a roughly once in a century eruption.

When you think about it, we're living on a extremely thin crust that's formed on the surface of a molten, roiling ball of rock and metal. People are strangely obsessed with the threat of asteroid impacts when what's beneath our feet presents a perhaps even greater danger, one which we know next to nothing about!

<comment><USER15> My wife is a geo-chemist. She says that plastic is a better term to get an idea on the mantel. Yeah, it is a liquid, but the pressures and temperatures are just so crazy to us that calling it 'roiling' is a little bit of a misnomer. Also, because of these pressures and temperatures, it's hard to ever know anything about the interior of the planet. Turns out, dense things that are very deep and hot are very hard to study.

</comment></comment><comment><USER16> Another amazing/frightening statistic is that pyroclastic flows killed people living 30 miles away over open ocean. If I was living that far away across an ocean, I would have felt perfectly safe. It just boggles my mind that even at this distance Krakatoa was deadly.

</comment><comment><USER17> For anyone interested, I'd recommend Simon Winchester's book "Krakatoa": [http://www.amazon.com/Krakatoa-World-Exploded- August-1883/dp...](http://www.amazon.com/Krakatoa-World-Exploded- August-1883/dp/0060838590)

Also interesting are how quickly the volcano has risen out of the sea again after being totally obliterated, and how much life now thrives on it.

<comment><USER18> I second that opinion. Great book.

</comment></comment><comment><USER19> So the sound got harder to hear as you were farther away, but what if you were at the exact antipode on Earth? Would it have been audible at all?

<comment><AUTHOR> The sound was only audible up to 3000 miles in radius, or about 1/13th the globe. It wasn't audible in the other side of the Earth (although it was detectable.)

<comment><USER20> He mentioned the "exact antipode on Earth", so he's probably thinking of an effect similar to antipodal chaotic terrain [1]. The fact that sound was only audible up to 3000 miles in radius is not enough to rule it out, you need other arguments.

[1] [http://en.wikipedia.org/wiki/Caloris_Basin#Antipodal_chaotic...](http://en.wikipedia.org/wiki/Caloris_Basin#Antipodal_chaotic_terrain_and_global_effects) ("It is thought by some to have been created as seismic waves from the impact converged on the opposite side of the planet.")

</comment></comment></comment><comment><USER21> I've been really impressed with Nautilus. Awesome to have a new magazine that seriously covers scientific topics, and do it quite well and with style.

</comment><comment><USER22> One thing I only see a little bit about is the negative pressure pole created on the opposite side of the earth? I guess I need to spend some time at the library, but I've only seen this stated as a trivia item, but no further details, like was the effect as pronounced at that point given this is when the reflections outward all met up again?

<comment><USER23> Sound doesn't travel at the same speed given different air pressures and temps. I think the waves wouldn't meet up at certain point.

</comment></comment><comment><USER24> Not only is this article fascinating, even more so is the 600-page report it links to! Thanks.

</comment><comment><USER25> It would be so amazing to capture such an event from satellite. I wonder how much deformation would be evident, sure some material was pushed into space (not speaking earth - but gases)

</comment><comment><USER26> Fantastic article. Thanks for sharing

</comment><comment><USER27> "Holy smokin' toledos"

</comment><comment><USER28> interesting article</comment>


Boot Camp will not work on Apple silicon-based Macs - <AUTHOR> https://arstechnica.com/gadgets/2020/06/heres-whats-happening-to-boot-camp-amid-the-apple-silicon-transition/ <comment><AUTHOR> The original title is " _Here's what's happening to Boot Camp amid the Apple silicon transition_ " but I've instead used a line within the article because I felt that was the more important point.

<comment><USER2> Yes, I guess Ars is attempting to lure clicks with their title but I'd rather take your title over theirs as it just gets to the point of the article.</comment></comment>


Using FOIA and public databases to track down Department of Defense contracts - <AUTHOR> https://www.muckrock.com/news/archives/2018/aug/24/how-use-foia-find-department-defense-contracts/ <comment><USER2> (disclaimer: I own a non-profit for submitting requests, education, and advocating the release of digital records)

I seriously recommend that everyone submit a FOIA request for information that they're interested in and make it public. Either locally or federally. You'll learn a _lot_ about the interface between you and your government.

Something to think about - Illinois FOIA allows the submission of code within a FOIA request. For example, as long as you know the schema of a database, you can submit SQL for a government owned/contracted database. The schema is often included in contract specs, but more often requires a request to figure it out. My nfp is working on some projects (through muckrock) to build out a list of schemas across all states' big cities. It's possible, but there's still a lot of work to do!

<comment><AUTHOR> > _you can submit SQL for a government owned /contracted database_

I've heard of journalists working with government IT folks to craft a SQL query, but not sending code in the records request. Do you by chance have an example letter that uses code?

<comment><USER2> I just made sent one: [https://www.muckrock.com/foi/chicago-169/canvas- database-sch...](https://www.muckrock.com/foi/chicago-169/canvas-database- schema-60175/)

The idea comes from [1], where like you say, a journalist/requester can work with the government IT folk to craft a SQL query. A big problem comes, though, from the burden and staffing required to write the query. To add to that, FOIA often requires cost estimates prior to starting a request - which, in the case of writing code, can muddle estimations... which have to be paid on the onset. My position is that if the requester understands the schema, then the burden required to write the query is essentially nullified. That way, the only cost would then be the review of the query, which is trivial in comparison to writing one from scratch.

There's a lot of prereq knowledge needed before submitting a request for code. That, and there's generally a potential for penalty against a public body that doesn't run a full search. So in many ways, there isn't really a need for a requester to submit their own SQL from the onset.

[1] [http://illinoiscourts.gov/Opinions/AppellateCourt/2018/2ndDi...](http://illinoiscourts.gov/Opinions/AppellateCourt/2018/2ndDistrict/2170617.pdf)

(not a laywer, etc)

<comment><USER3> Is it not possible to request an electronic copy of the database dump in its entirety?

<comment><USER2> It is possible! For example, I recently received [1] a mysqldump of Chicago's "data dictionary" database, which is a collection of database schemas from databases throughout Chicago.

That said - it's not always simple. The big problem is that information being released through FOIA still needs to be reviewed by a person, which can be time consuming and expensive. Especially so when a technical person gets involved. It's often just much easier (for _everyone_ ) to request specific information.

The "data dictionary" database dump was only easy to get only because I knew for a fact that the database was already reviewed through a process that matched FOIA's.

[1] [https://www.muckrock.com/foi/chicago-169/data-dictionary- mys...](https://www.muckrock.com/foi/chicago-169/data-dictionary-mysql- dump-59229/)

</comment></comment></comment></comment></comment><comment><USER4> This is a great starting guide. As someone that heavily researched procurements for awhile these are good off the shelf resources. It takes awhile to understand the specific language and codes (NAICS, labor codes, etc) used for each of these contracts, but after awhile they start to make some sense.

I would also recommend taking a look at budget planning documents and other resources from the DoD Comptroller ([https://comptroller.defense.gov/budget.aspx](https://comptroller.defense.gov/budget.aspx)) continue to follow-up on task orders that are available under massive "ID/IQ" or BPA contracts in the billions of dollars (these are often withheld from the public but available to the firms that won the original work, though the actual values can be found sometimes in FPDS under sub-codes.

Additionally, many of these folks hold various BPA / GSA Schedule contracts and sometimes their lead officers will respond to inquiries.

Example: GSA Schedule 70, MOBIS, Navy SEAPORT-E, etc.

Happy hunting!

</comment><comment><USER5> [https://www.usaspending.gov/#/](https://www.usaspending.gov/#/) is another great resource

</comment><comment><USER6> ...i havent made a lot of FOIA requests lately, but there was a time when redaction would vary depending on the reason stated for the request, thus enough different requests for different reasons could be use to assemble a nearly complete document...</comment>


Workers and customers are catching Covid-19. Should businesses escape blame? - <AUTHOR> https://www.latimes.com/business/story/2020-08-27/covid-19-lawsuits-california-business-liability <comment><USER2> If you give companies a big shield against cv19, how will you incentive them to give basic and necessary protections to workers? These low wage job workers are really vulnerable because they mostly don't have money saved up and have to work. There's the issue that you can't know where someone got it, but in these big factories where huge numbers of people get it and it goes through the factory, it came from there at least for some of them. I think we're just screwed. Big business wants these shields, workers in the us don't often have a good outcome in that situation.

<comment><USER3> If you make companies liable for Covid, you make them liable for every illness under the sun. Say goodbye to society.

Better is to make the individual liable for giving someone else Covid, similar to HIV.

A sick person is the one who is contagious, not the business.

</comment></comment><comment><USER4> > Maria Pilar Ornelas struggled to breathe with a fever of 103.7.... she says > her supervisor told her to come to work anyway.

What can be said about that kind of attitude towards other human beings who are your employees and whose labor is the source of your profits?

It's insane. And the sane response is to save yourself. And if they don't care about you, you don't care about them, and you sue their ass off to get your bills paid, and you tell their customers all about it loud and clear.

If businesses like that are 'worried', that's a damn good thing. Because their attitude is inhuman, and they belong in the sewer of history. Along with Mr. Turtle from Kentucky.

</comment><comment><USER5> Governments and medical bodies have no idea wtf to do, but business do?

But it is a interesting legal topic for the moment. Is it worth losing your house over reopening your business? Can you get insurance atm? No matter what you do your customers and employees will get it at some point.

> given the hurdle of proving where exactly anyone was infected.

Some place are using genetics to play the blame game already. I wonder why we never did this with AIDS. No technology or we didn't like dystopia?</comment>


Jeff Bezos on the Future of Amazon.com - <AUTHOR> http://www.smartmoney.com/Investing/Stocks/Jeff-Bezos-on-the-Future-of-Amazon-com/ <comment><USER2> "Bezos: We are responding to customer needs.

SM: No one asked for the Kindle."

What's wrong with this guy (the interviewer)?

Imagine Bezos answering that question with the following quote:

 _If I had asked people what they wanted, they would have said, "Faster horses." -- Henry Ford_

</comment><comment><USER3> The interviewer is an asshole,

" _Your handlers_ said I could only talk to you about Kindle but that you wouldn't give specifics on its sales. _That sounds paranoid._ "

"Amazon has about 6 percent of all U.S. sales online. That's huge. _Why muck it up_ with all the other businesses you've added, like manufacturing [the Kindle] and your new customer-service software?"

Totally unprofessional and if I were the editor I would be embarrassed to publish this piece of shit. Just publishing Bezos's answers would be better than seeing the way SmartMoney's interview asked the questions.

<comment><USER4> I totally disagree. This was a smart interviewer setting the tone early - one, the interviewer appealed to Bezos' ego to get the PR handler's rules dismissed (win - Jeff answered questions about AWS) and made it clear that PR answers wouldn't be acceptable (fail - Jeff was remarkably on message).

Interviewers are supposed to get interesting answers out of their subjects. Being combative and having a point of view are tactical decisions, not a sign of being unprofessional.

(As an aside, Sarah Lacy's fawning over Zuck was a tactic that failed. It also might have worked if it wasn't up on stage in front of everyone. Different tactics work for different interviewers and different subjects in different settings and times.)

<comment><USER5> Bezos is a remarkably good PR bot, his speech at Startup School last year was a 30 minute long worthy PR spiel for AWS and probably the least informative talk ever given at Startup School.

</comment></comment></comment><comment><USER6> "We launched our Web services two years ago; it's the equivalent of creating an electric grid, but for computing. Recently, I went to Luxembourg and visited a 300-year-old brewery. It had this gigantic relic of a generator from when it had to make its own electricity. As soon as they could buy off-grid, they did. Making their own electricity didn't make their beer taste better. It's the same for running your own data center."

Awesome analogy. I don't understand why so many people want to host their own services. Stick to your core business.

<comment><USER7> Many businesses have their own photocopiers, fax machines, and PBXs, do their own accounting, maintain their own supplier lists, provide support to their own customers when they have problems, and pay their own employees, even though you can outsource each of these services. Sometimes the problems of outsourcing a business function are greater than the benefits of the enhanced specialization.

For several years now, the vast majority of companies that have an internet connection have had some of their internet-connected computers inside their own companies, and others somewhere else, like a colocation center. Even though AWS is pretty awesome, I don't expect that to change anytime soon; the balance will shift back and forth according to things like available technology, legal liability, experienced quality of service, and so on.

</comment></comment><comment><USER8> Worth reading for this single phrase: "Our approach is not to set a goal. Our approach has been to create the best physical model and let customers choose".

</comment><comment><USER9> The interviewer kept trying to get him to admit he was spreading himself thin. What gives?

</comment><comment><USER10> This is a chaotic and cynical interview.</comment>


One Laptop Per Child Project Works With Marvell to Produce a $100 Tablet - <AUTHOR> http://bits.blogs.nytimes.com/2010/05/27/olpc-partners-with-marvell-to-launch-100-tablet/?ref=technology

<comment><USER2> While OLPC may not be a huge success in its original goal, it has had a huge impact on the computer market.

I owe my netbook to Negroponte and the OLPC folks. Without the pressure, I doubt notebook manufacturers would ever contemplate this segment.

<comment><USER3> The goal of the OLPC project was to get low cost computers to children that couldn't otherwise afford them. Before OLPC, a 'cheap' laptop cost $1500, with many over $2000. Now, 40 million netbooks - most under $400 - are in people's hands. A secondary used market allows people to get used netbooks for under $200 (thanks, EBay). We all owe a debt of gratitude to OLPC.

<comment><USER4> Did OLPC have anything to do with this? It seemed more like the asian computer makers thought it would be a good idea to roll out machines their own citizens could afford, since it's a gigantic market.

<comment><USER3> Initially, no manufacturers were willing to do this. OLPC began designing and spec'ing the initial machine themselves, then worked with an ODM for manufacture. When countries started showing interest, other manufacturers (like Intel) started jumping in to get market share. Once sales commitments hit million unit counts, many manufacturers (ASUS, ACER, MSI) jumped in, later to be followed by OEMs like Dell and HP.

If OLPC hadn't forced the issue, no one would have cut their manufacturing costs and margins to this level.

<comment><USER5> This is my memory also. Manufacturers were saying that no one wanted the low powered machines... It wasn't until OLPC was able to sell some of theirs with the buy 1 get 1 and the EEEPC (I own a first generation 7 incher) went on sail and people snapped them up so quickly that I had to stalk the local micro center to get the wife one for christmas... Did the other manufacturers think there might be a market for this.

Now we can get a 1.6 Ghz laptop with wifi + camera +windows XP for under 200$ (Saw the Acer netbook for 189 the other day!). Frankly, while they were never able to hit their 100$ sweet spot I think the OLPC project has been a massive success.

Heck, we may even be able to attribute the push for the cloud... and cloud based applications running in a browser... to the low powered laptop movement started by the OLPC project.

</comment></comment></comment></comment></comment><comment><USER6> I found funny the jab the guy did at Apple's excuse for closed-source software: "[...] we'll run anything, including viruses and Flash."

<comment><USER2> Unless there are viruses that can run on Android/Sugar and/or Windows Mobile, it's a ludicrous jab.

It's a given it won't run desktop Windows.

OTOH, if the ARM in it is fast enough, it could emulate a Pentium II or III at native speed. That should be able to run a couple viruses.

</comment></comment><comment><USER7> I am skeptical about the final product looking anywhere near as good as their rendering does...

</comment><comment><USER8> An Android powered iPad clone for ~$100 is already selling:

Relevant submission: <http://news.ycombinator.com/item?id=1386333></comment>


Psychological techniques for boosting creativity - <AUTHOR> http://www.spring.org.uk/2010/06/get-creative-7-more-psychological-techniques.php

<comment><USER2> Looking at these techniques I see them all leading towards a series of behaviors that we've learnt as kids, and that turn out to be quite useful in tapping into our "creative side". Behaviors like exploration, which is about going for quantity, building and thinking with our hands and role play, where acting it out helps us both have more empathy for the situations in which we're designing, and to create services and experiences that are seamless and authentic.</comment>


Daydreams Shape Our Sense of Self - <AUTHOR> http://nautil.us/blog/daydreams-shape-your-sense-of-self <comment><USER2> This is a disturbingly misguided exercise in Western psychology. If you think that the endless stream of thoughts in your mind is your self, then you have not realized your true self. When we are day dreaming, we are in a kind of dream, which means we are not awake and not in the present moment. This can be highly destructive, for example if you are constantly day dreaming when you are around your partner or your children, then even though you are physically present you are not really there for them and that can have long term consequences for relationships and development. The way to break the cycle is through meditation.

In his books, the Buddhist monk Thich Nhat Hanh describes a cartoon he saw depicting the Western philosopher Descartes raising one finger in the air and declaring "I think, therefore I am." In the background a horse is depicted saying, "You think, therefor you are what?" Thich Nhat Hanh goes on to assert that Descartes should have said, "I think too much, and therefore I am not in the present moment."

<comment><USER3> I'm no Buddhist scholar and think highly of Buddhism, but didn't Siddhārtha Gautama leave his wife and child on his path to enlightenment? Appreciate the perspective and agree you're not present when you daydream, but your example might confuse its intended audience. To me, it says, "Do as I say, not as I do."

<comment><USER2> Yes he did, and I am not a scholar either. I will just say that the path is not something to be debated, it is something to be experienced directly.

</comment></comment></comment><comment><USER4> This is true, and one of the reason why people lack a sense of self these days - we're too deep into distractions to really daydream. We're constantly bombarding our self with information to process and think about without having time to ponder about our life and self only with ourself. That manifests as lack of goals, visions, decisions, as we're not sure what we want for ourselves.

<comment><USER5> I don't think these are mutually exclusive. I think people can daydream without reflecting on that and without learning anything.

I think that is exactly the point the article is trying to make. Help people get some benefit from daydreaming.

</comment></comment><comment><USER5> I have aphantasia and this seems quite obvious to me. Although I wouldn't say it shapes ourself but just emphasizes what is on your mind, where you would like to see yourself, preparing yourself. You can think about how you might act in a specific situation or reaffirm some beliefs.

Negative daydreams also shows you parts of yourself and your environment that do not align with your worldview or experiences that you haven't let go off emotionaly yet.

But the underlying feeling and thoughts are there anyway, no matter if you daydream or not.

<comment><USER6> Is aphantasia is a recent discovery or something? I've only started hearing about it here and on reddit in the last year-ish.

It's super interesting since it seems so crazy that you can be incapable of picturing thing, and also because some people told me I might have it in a conversation when I mentioned that I don't tend to picture things like the bar people walk into in the man walks into a bar joke format and can't draw even slightly, but I know that I don't have it because I _can_ picture those things but just don't.

<comment><USER7> I think it goes both ways. I don't really understand what people mean when they say they "picture" something. What's the sensation like, compared to not picturing something?

<comment><USER8> Some people, like my wife, can recall both sound and imagery from a movie they've seen. Not all movies, not all scenes, but yeah, video and audio feeds from historic memories...i.e. echoic memory and iconic memory recall to the point one is conscious of seeing something from the mind, in the mind's eye.

As far as I can tell, this ability to visualize and hear things in the mind is entirely dependent on the individual's own thinking process and therefore highly varied. Many can see family members in the mind, but a few can see many images for a single family members (thousands I was told from one person of images of his wife in mind). Those who pray don't see as many images, or enjoy strong consistent imagery when they do. Those who create see their creations in mind and can change them. This creative process is typically called "visualization" but seeing one's parents in mind uses the same process.

The Pineal gland appears to be somewhat responsible for these images, but there isn't much info about the Pineal being the mind's eye as a hard proven scientific fact [https://en.wikipedia.org/wiki/Pineal_gland](https://en.wikipedia.org/wiki/Pineal_gland). It's more a belief of many cultures, if anything.

Many, even aphants, report seeing imagery while falling asleep (when the visual consciousness is shutting down): [https://en.wikipedia.org/wiki/Hypnagogia](https://en.wikipedia.org/wiki/Hypnagogia)

<comment><USER7> I do experience hypnagogia sometimes. I dream very rarely though (a couple times a year, maybe).

If I really stretch the definition of "imagery" I can sort of invoke the feeling that I'm seeing something, but your description of visualization is way too vivid to match that. I literally can't imagine it :P I can't really hear things either unless it's a very recent experience, and even then it's more like the "feeling" of hearing something rather than anything really auditory.

The note about prayer is interesting, but I've been non-religious my entire life and I've never uttered a prayer with any sincerity.

If you asked me to describe my family to you, I probably couldn't do so with any sort of accuracy. I could probably tell you their most recent hair colour and maybe some very generic features, but I can't recall for example anyone's eye colour besides my own.

I gave a shot at trying to learn to draw at some point, and made some progress towards being able to replicate what I see, but drawing always seemed to be a process of trial and error, since I'd have no idea what my marks would end up looking like before I put them on paper. I did enjoy it when I really got into the drawing process, but the good parts weren't really good enough to outweigh the massive stress and frustration it usually caused.

</comment></comment></comment></comment></comment><comment><USER9> See also: you can't be good at something that you don't think about in the shower, [http://www.paulgraham.com/top.html](http://www.paulgraham.com/top.html)

</comment><comment><USER10> We should note the distinction between natural moments of daydreaming (one minute here and there) and the daydreaming as an escape from reality where one lives in their fantasy land. I think the former is harmless and may actually help the brain sort out some thoughts. The latter is obviously pathologic.

</comment><comment><USER11> Poor people buying lottery tickets live in the daydream where they have won the lottery and are spending their millions.

<comment><USER2> That sounds accurate. Day dreaming is an escape and not a good one.

</comment></comment><comment><USER12> define: Self</comment>


Hire for your career - <AUTHOR> http://www.randsinrepose.com/archives/2010/01/04/wanted.html

<comment><USER2> The literary devices used in this are grating.

The repetition that the beginning is trite. Fake conversations, pretend thoughts, conversations with the reader, overly hip tone.

It might be normal in a business book but in the end it just gets in the way of the content.

<comment><USER3> It worked for me.

</comment></comment><comment><USER4> This sounds like a good argument against working for large companies.

<comment><USER5> Yeah, but not everyone can follow that advice ^_^, and more to the point, there are some things we want to accomplish that can't be done in smaller companies. Jet planes, power plants, all sort of neat stuff.

<comment><USER6> I don't know if it's accurate to say that power plants and jet planes _can't_ be done by small companies. Instead of one big company, the work could be split among a number of smaller companies.

I don't know the history of Boeing or the major powerplant constructors, but I'd guess that a lot of them have formed over time from the consolidation of smaller companies.

<comment><USER7> Ronald Coase (one of the top 10 economists ever) has a paper about this: firm size is related to factors including communication complexity.

<http://en.wikipedia.org/wiki/The_Nature_of_the_Firm> <http://en.wikipedia.org/wiki/Ronald_Coase>

There are big problems I'd like to solve (cheap space launch optimized for LEO satellite constellations, nuclear power), but since firm size for those problems right now is high, I'd rather work on less-interesting problems which can be more readily addressed by startups, at least until technology advances to let <100 person companies work on the big problems too.</comment></comment></comment></comment>


Is SQL injection still a bad thing if the user is restricted to - <AUTHOR> https://security.stackexchange.com/a/229255/21144 <comment><USER2> If the user is supposed to enter arbitrary SQL queries, then it is already allowed. (SQL injection should still be prevented when using forms that do not say you can use arbitrary SQL code, though, even if it is the same database and even if it is read-only and all data is public. This isn't because of any kind of vulnerabilities, but merely to avoid bugs in the form in case a user enters something unexpected.) However, you may add some access restrictions to the database to ensure that it cannot be written (how to do that depends what database you are using; with SQLite, there is an authorizer hook, defensive mode, read-only mode (when opening the file), file permissions in the operating system, progress callbacks, etc). Also, if you are allowing users to enter arbitrary SQL queries, please link to the documentation so that the user is aware what variant of SQL is in use; there are different variants of SQL which have a few differences from each other. Being able to enter arbitrary SQL queries is helpful, but this should be done properly, which is by documenting this feature properly.

In other words: If the only query form is for the user to enter their own SQL query, then SQL injection is irrelevant. If it has such a query form but also has an additional form that does not use the user's own SQL query, then the additional form without the user's own SQL query should be protected against SQL injections, by passing parameters properly.

But there is another possibility too, which is to use remote virtual tables (which could then be accessed using SQLite on the user's own computer, with a suitable extension installed (I invented a "remote virtual table protocol", although possibly improvements could be made)). This allows the user to do such things as use JOIN queries with other data, create temporary tables, do their own formatting, etc.</comment>


The Church-Turing Thesis: Logical Limit or Breachable Barrier? - <AUTHOR> https://cacm.acm.org/magazines/2019/1/233526-the-church-turing-thesis/fulltext <comment><USER2> Is there any actual content in this? It seems to start from the idea that Turing considered his machines as "what could be mechanically solved" and was referring to human "computers".

It then rambles off into quantum Turing machines, and briefly (literally mentioned in passing) discusses that the halting problem was replicated, and demonstrated to hold up, on QTMs as well.

<comment><USER3> Yeah, I think it's fluff. They also make some pointless distinction between "simulating" versus "replicating" Conway's game of Life. It's ridiculous to suggest that the game is not representable as a Turing machine.</comment></comment>


Ask HN: To Those Who Have Raised Friends/Family Round - <AUTHOR>

Any advice?
I understand the importance of managing expectations, the risk of ruining relationships. Any other advice/experience you could share would be appreciated.
About my startup:
Hardware product that automates/makes possible a common task that can and is frequently done by hand but can not be done consistently well by human hands, hence my machine. The output of my machine is far superior to what can be done manually.
I have buyers lined up, and a working prototype, demand is huge and I have filed a provisional patent. I need the money to continue operations through a crowd funding round and for legal counsel/liability.
I'm looking to raise under Rule 504, amounts of 5-10k from several friends/family that have offered, well off/sophisticated but probably not accredited. Looking to raise 60k.
Hacker News changed my life, I learned enough reading the articles/comments here to start a viable consulting business. I got my best clients from the monthly seeking freelancer posts, and I thank the community in advance for the good advice I am sure I will receive from this post.
Update:
Any thoughts on strategy of raising small F&F round and going for crowd funding round vs trying for a proper San Francisco angel/VC seed round?
The product is truly disruptive and in a hot industry. People get really excited about it. It's sexy. The niche my product is in currently is in the same place as microcomputers were before the Apple I, with lots of hobbyists making their own setups.
I have a friend who built and sold a solar company with contacts in San Francisco he could introduce me to.
The product is disruptive and the market is huge/sexy. I have no doubt I could raise from proper angels, however my bias it to maintain as much ownership/control as possible.
Thoughts?
Sorry for being secretive, but I think its best to stay in stealth mode for now. <comment><USER2> F&F money is the cheapest money you'll find. Unlike most angels, they don't negotiate hard to push down your valuation pre-investment, and they don't try to distract you or run an aspect of your business. Take all you can get.

After that, be realistic about how much money you need until you are cash flow positive (for software I'd double the runway you think you need, and hardware triple or more). Make sure you raise the full amount before you start burning on it, even if your F&F round comes up short. Getting distracted halfway through your valley of death because you're running out of cash will run you out of cash faster.

Although F&F terms are usually awesome, don't forget: no deal is too good to walk away from.

</comment><comment><USER3> Hardware is expensive. If you can build it yourself, then you can start by getting some initial customers. If you want to scale _and_ retain control, then you might be best off using some of the FF money to do a crowdfunding campaign. This will give you more capital to go after manufacturing partners (assuming that's needed). If that's successful and you have enough growth, then you should be able to negotiate a round at more favorable terms.</comment>


Ask HN: I need a blog engine, which will be around for 10-15 years - <AUTHOR> Hi All,
Desperately need help. I need to create a blog. My wife has taken my child. The idea, to document everything so when my child is 15-16 years old, she will be able to read each and every post I do for her. Which blog platform, do people fee has longevity, in this crazy Covid-19 ridden world of companies going bust daily? <comment><USER2> Technical answer: if longevity is your priority, you need either to self-host everything or use a static blog generator. In the first case, you can install anything you want in your own server (Wordpress is always a good choice) and it will keep running as long as you pay your bills. For the second case (with something like Jekyll or Pelican), all you need is a website that hosts static files (namely, all of them) and if one goes down you simply re-upload somewhere else.

There's yet another point to consider: is there a reason why it has to be a blog? If you intend to give it to your child, a Word document is all you need.

Personal answer: I would encourage you not to blog in anger. I had to sort through a book written once by someone in pain for losing a child, and it was a very uncomfortable experience. I encourage to ask yourself "is this something that will make my child's life better, or is this something that will make my life better?". If it's the second, I would encourage you to still write it, but in a private diary rather than a public blog.

<comment><USER3> > There's yet another point to consider: is there a reason why it has to be a > blog? If you intend to give it to your child, a Word document is all you > need.

It sounds to me that he has no part in the child's life, so he cannot give it to her, but must rely on her finding it on her own.

<comment><AUTHOR> Either I will be able to show it to my child, or SEO her name so when she searches it one day, she will find it.

</comment></comment></comment><comment><USER3> Posthaven ([https://posthaven.com/](https://posthaven.com/)) claims to be just that.

Unfortunately, the founder was also a founder of Posterous, which was insanely cool back then and pretty much the same as Posthaven now, including the longevity claims. Posterous is no more.

Still, they claim to mean it this time, and not take VC money, so it's worth a look.

<comment><AUTHOR> Thank you, I'll take a look

</comment></comment><comment><USER4> Why do you need a platform? Get something that renders to a static site and stick the result in an object store with a domain attached. Or even just a html file with
contents
. Or even a txt.

</comment><comment><USER5> WordPress.

It's open source, easy to use, hostable pretty much everywhere and you can easily export and move your content anywhere.

I'm sure even if Automattic go bust, it'll continue

</comment><comment><USER6> Wordpress or Ghost.

<comment><AUTHOR> Thank you.

Looking for a hosted solution

<comment><USER7> Both are available hosted. But for a 15 year timeline, relying on any single offering staying available is risky. I would focus on portability, so you can move your content if necessary. That's where static generator etc shine if you are ok with their UX: they produce a bag of HTML files you can host anywhere (and don't require ongoing maintenance of a running server software somewhere)</comment></comment></comment>


Elon Musk's Neuralink wants to turn AI into an extension of our brains - <AUTHOR> https://techcrunch.com/2017/04/20/elon-musks-neuralink-wants-to-turn-cloud-based-ai-into-an-extension-of-our-brains/ <comment><USER2> Given how inevitable it seems for any computer system to have critical security vulnerabilities, I just find it surprising that anyone is seriously contemplating this level of computer/human integration. Already it seems stronger AI will be (is?) able to predict and manipulate people's behavior. With direct access to your brain this goes from creepy and worrying to downright dystopian and apocalyptic. And I don't necessarily mean that in a Skynet kind of way. Someone (or something) will find a zero-day against Neuralink that could throw humanity into a pit of despair.

<comment><USER3> be optimistic as Elon Musk, I mean remember the Facebook satellite launch with SpaceX ? nah who remembers that stuff, let's all connect our last place of privacy with an computer how bad can it get ?</comment></comment>


Zero-day Exploit Price List - <AUTHOR> http://www.forbes.com/sites/andygreenberg/2012/03/23/shopping-for-zero-days-an-price-list-for-hackers-secret-software-exploits/ <comment><USER2> This is a great idea. Directly and publicly monetize security bugs. This is technical debt in terms of real, hard, cold cash.

As a community it makes sense to embrace this. As vendors (and especially people who develop apps for walled gardens) start seeing real-world feedback on platform security, we can all make more informed choices. It also incentivizes the hell out of companies to make their stuff more secure. Terrific concept. This shouldn't be some kind of dark grey-market site. It should be on a web location as visible as E-bay. (owned by somebody with no skin in the game)

For those of you arguing that such information can and does kill people, I feel your pain. But you can't hide knowledge. There will be a market whether or not there's a Forbes article about it. The only difference is whether you know about these vulnerabilities or you don't. A big, public market lets everybody see how crappy the things we use are. A secret, government- controlled market keeps all of that critical information away from the very people who need it. If the Syrian government is using security exploits to kill dissidents, all the more reason to let the sun shine in.

<comment><USER3> Just as important as the 0days themselves is keeping public who bought them. 0days, in many cases, are weapons. By keeping this market and it's transactions in the open perhaps we can keep the purchasing parties a little less evil, or at least drive up their costs.

This market, to me, looks very similar to the weapons industry. The more open it is the better for everybody. The other commenters are correct, this market isn't going anywhere. We may as well shed light on it.

<comment><USER4> > Just as important as the 0days themselves is keeping public who bought them.

That sounds ridiculous, I think. As soon as that is made public, there will instantly appear another market where that info is not made public, and most buyers will switch to that new market, sellers will follow as well.

</comment></comment></comment><comment><USER5> Disclaimer: I know people referenced in this article.

Whatever your views on the morality or ethics surrounding this market, the fact is that it exists and isn't going away. In fact it has existed for a long time (I certainly remember exploits being traded, bought and sold in the early 2000s and 90s) but the thing that's new-ish is the presence of numbers in the public eye.

Charlie Miller's paper on the 0day market[1] provides an example of what happens when someone has a lack of market information (they lowball and sell the bug for less than it's worth) in this space, and might be of interest to people who enjoyed this article.

[1] - <http://securityevaluators.com/files/papers/0daymarket.pdf>

<comment><USER6> You're right, but saying "someone else would do it if I didn't" is a pretty weak rationalization. They're making themselves rich at the expense of everyone else. They're a leech on society.

<comment><USER5> > They're making themselves rich at the expense of everyone else. They're a > leech on society.

No they're not, on both counts. They're not making themselves rich at the expense of everyone else. Their major customers are governments, who are in no rush to make their own purchasing patterns illegal. They're taking part in an active established market. Immunity have been doing this publicly for over a decade, with the difference being that anyone can buy Canvas.

The simple solution (which works in favour of the exploit dealers too btw) is to use a layered approach to defences that make it more expensive to develop an exploit. That's what Microsoft have been doing since Vista. There are now so many hurdles you have to jump through for a server-side remote code execution bug that for most people it's just not worth it (given that you'll have to chain exploits more often than not to bypass protective measures), which is partly why client side bugs are becoming more common.

<comment><USER7> Eh. Two much more important factors militating for clientside exploits:

* The client-side attack surface is, probably by many orders of magnitude in any metric you care to use, more complex than the serverside attack surface. Look at the kinds of libraries that have been long-term thorns in the sides of developers and security teams --- image codecs, font libraries, compression --- a big chunk of everything that goes on your computer screen can be influenced by attackers.

* The client-side attack surface includes multiple programming languages hooked up to anonymous content (the most important being Javascript), and so clientside exploits have significantly better tools to work with.

Not to take anything away from your point; I'm glad you're injecting some sanity onto these threads.

<comment><USER5> You're absolutely right on both counts, and thanks for the comment.

<comment><USER8> On a related note re: client vs. server. Taking a recent incident that was in the news, when the Brits pwned a pro AQ forum. From that vantage point, the best thing they can do is to target the admins, moderators and heavy users -- with client sides. Probably more than one, since it is unlikely that a single exploit would be effective against each of the targets. The valuable intel is going to come off those user's boxes, not off some semi-anonymous VPS shard. Logs of Tor exit nodes, googlebot, and proxies reveal nothing interesting. From a certain perspective, it makes sense that there just isn't much value to be had from servers, and so there's reduced incentive to pay high prices for server exploits.

Not to mention that gaining access to that server would probably be fairly simple given the atrocious security standards of most web hosting companies. CPanel, pilfered ssh key, SQLi, PHP bugs in the forum software, rent a VPS on the same host and LPE... I hardly need to tell _you_ how many alternative (cheap) ways exist to gain access to the server. (And this is assuming that they aren't running their own colo's and web hosts a la [http://www.schneier.com/blog/archives/2008/10/clever_counter...](http://www.schneier.com/blog/archives/2008/10/clever_countert.html))

Given the relative ease of access to servers, the poor quality of intel stored on them, and its no wonder that the market focus is on client sides. Finally, its worth mentioning that most (all?) of the servers with interesting data on them are in the legal jurisdiction of the US (just ask Kimble, ha!). Accessing that data requires a sternly worded letter on official letterhead-- not an exploit.

So, not to detract from either of your' points; but there is another angle to add to the mix.

<comment><USER9> Well, client-side attacks are great because they typically rely on the naivete or indifference of the user. And the client-side attack surface is typically protected to a lesser degree than a server. A well orchestrated spearfishing attack is tough to defend against, even for a security conscious user. The attack surface is just so large.

However, the meat on the bones is really on the servers. If someone pops my desktop at work, they won't find much valuable data. But they will be able to keylog me, grab admin password hashes, arp-spoof etc. Still, no data. But what they will get enables them to access our company files and databases in short order.

In essence, client-side attacks in the corporate world are definitely targeted at server data, while in the consumer world, they're targeted towards identity theft or botnet creation.

<comment><USER8> This is the gov world though, where the interesting information is things like your address book _, your emails (the content as well as the senders/recipients), your private keys and passwords, etc. etc. Client sides provide direct access to those things (or at least, a means of obtaining them).

There are very few governments that care about what is on your company file server or in your company databases. (Ignoring the elephant in the room on that one.)

_ Law enforcement agencies keep huge Access databases of the contacts they extract from cell phones taken from criminals. They share this intel with each other via email (I know, I know...). They can discover a great deal about who is involved in an activity and where they are on the totem pole from just this data. Its even possible to identify people by correlating the content of the "name" field and using the phone number is a unique ID. Criminals tend to have poor OPSEC.

<comment><USER9> I don't think it's safe to assume that government simply means spying on individuals for national security reasons. Governments engage in corporate espionage all the time, and not just China.

</comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER7> In reality, exploit sellers and exploit buyers are engaged in discovering the value of security exploits. That the value of those exploits might be pinned to unethical, immoral, unlawful, or belligerent conduct is irrelevant; markets have to operate in the real world, and we cannot stipulate that the bad actors absent themselves from the real world.

So while I personally find the sale of exploits distasteful†, I think Soghoian is in the weeds with this argument about exploit developers being "modern merchants of death". Exploits are nothing like conventional munitions. They're extremely scarce and their extraction from software imposes no intrinsic costs on the rest of the world.

In other words: vendors can simply outbid intelligence agencies for their bugs, or, better yet, invest more heavily in countermeasures to moot those bugs. Unlike guns, which can be manufactured so cheaply and at such a scale that no one organization could hope to stem the tide with markets, vendors can stop immoral abuses of their own software simply by participating more actively in the market.

$200,000 sounds like a lot of money, but it's under the cost of one senior headcount at a major software vendor, and vendor cash flows are expressed in high multiples of their total headcount cost. The higher the prices go, the more incented vendors are to stop vulnerabilities at the source.

Even today, the whole technology industry is captivated by the misconception that vulnerabilities somehow cost some fraction --- maybe 1/3, maybe 1/4 --- of a senior full-time dev salary. After all, they're generated by people who would otherwise be occupying that kind of headcount. And for the most part, that misconception has been bankable, because the best exploit developers almost as a rule suck at marketing themselves.

Every other price in the application security field follows from this misconception, from headcounts and org charts at vendors to assessment budgets to shipping schedules for products to the salaries of full-time application security people.

It's all built on a misconception; that misconception creates a market inefficiency; people like (allegedly) The Gruguqhquq are arbitraging on that inefficiency. But the solution to a market inefficiency is to eliminate it, not, as Soghoian implies, to install umpires around it and erect bleachers and a jumbotron so we can watch it more carefully.

I see this story as evidence of chickens coming home to roost, not as some dangerous new ethical lapse on the part of the security industry.

† _This is an easy moral stance for me to take because I don't invest any serious time into developing exploits for the targets on this price list._

<comment><USER10> I disagree, the more demand there is for exploits, the more exploits there will be. If there is enough demand for them, we will even start to see employees on the inside of these companies purposely creating them.

Companies do not directly lose money if their products are exploited. How many thousands of exploits have been developed for windows? They're still doing just fine.

Software is buggy and exploitable by it's very nature. The cost to secure a large software project is orders of magnitude higher than the cost to find a flaw and exploit it.

By participating in an open market for exploits and greatly raising demand for them, the government is making us all less secure. "This is why we can't have nice things".

<comment><USER7> Exploits do not come out of nowhere. They can't be scaled with demand.

The fundamental moral problem with the market isn't the value being imputed to exploits; it's the _lack of value_ imputed to resilient software.

<comment><USER10> > Exploits do not come out of nowhere. They can't be scaled with demand.

Why not? All large software projects have flaws. Doesn't more demand for exploits mean more people are going to look for and find them?

> The fundamental moral problem with the market isn't the value being imputed > to exploits; it's the lack of value imputed to resilient software.

I think it's both. People shouldn't be selling exploits to entities that will use them offensively. And vendors largely don't care about security as much as they should.

<comment><USER7> More demand does cause more people to look for exploits. But since there's a finite number of vulnerabilities to be extracted from code, I'm not sure how that's relevant.

</comment></comment></comment></comment></comment><comment><USER11> >One of the most vocal of those critics is Chris Soghoian, a privacy activist with the Open Society Foundations, who has described the firms and individuals who sell software exploits as "the modern-day merchants of death" selling "the bullets of cyberwar."

Are there any documented cases of malware killing someone? All this cyberwarfare stuff seems a little overblown.

<comment><USER12> The chief Iranian computer scientist in charge of managing Stuxnet was killed by a magnet car bomb attached by a motorcyclist.

[http://www.usatoday.com/news/world/story/2012-01-11/iran- nuc...](http://www.usatoday.com/news/world/story/2012-01-11/iran-nuclear- expert/52494192/1)

No exploit > No Stuxnet > No Death

<comment><USER11> That still sounds like someone using a conventional weapon to kill someone, it's a pretty big stretch to compare malware to a bullet.

<comment><USER13> Intelligence is a major part of warfare. It's a lot easier to assassinate people if you have good means of finding the people you want dead.

<comment><USER11> Well, I have no problem with calling it cyberintelligence, or even cyberespionage, but just because espionage is part of warfare doesn't make it warfare.

</comment></comment></comment></comment></comment><comment><USER14> One time I was working on a MapReduce that processed a lot of XML found on the internet (I can't remember why anymore (edit: I remember now why I can't remember, it was a friend's program that I was helping out on)) and I found it crashing on some input. After some examination of my code I traced it to a bug in libxml (which is also used by Chrome, Safari, and others). I simply reported the bug to the appropriate parties and it got fixed. It's funny to think that the author of that bogus xml file had gotten the syntax wrong enough in a way that would've been worth thousands of dollars!

<comment><USER15> It's worth noting that not every bug is a security-critical bug. Similarly, not every crash is a security-critical crash.

Sometimes you can exploit a bug to give you something, sometimes it's just a plain old bug.

People only pay for the security-critical ones.

</comment></comment><comment><USER16> I've always wondered this about vulnerabilities: how can one guarantee an exclusive sale? And why doesn't someone who bought it just go ahead and re- sell it to (multiple) others to make a profit?

<comment><USER8> As mentioned elsewhere, generally the payment is spread out over months, contingent on the seller keeping their side of the bargain. And the second query describes the business practices of many defense contractors who act as de facto gatekeepers to government contracts.

<comment><USER9> This implies that "there can be only one." The idea that you could effectively prove that a seller is keeping their side of the bargain also implies that no one else would discover it.

<comment><USER8> It just means that the seller is incentivized to minimize the number of people that know about the vulnerability. Which is effectively what "exclusivity" actually means, at least in this case.

As an additional point, if either side becomes known as a bad actor in the market, they will severely limit their ability to operate. There is some short term incentive to be dishonest (more money now), but in the long term it removes the ability to earn in the future. Like selling your fishing rod for fish today, tomorrow you'll be hungry again, only now you can't fish. (To butcher a cliche.)

[edit: grammar]

<comment><USER9> How would you prove that the seller didn't resell the exploit?

</comment></comment></comment></comment></comment><comment><USER17> Schneier has recently written an excellent analysis of the exploit market. He also links to a ton of interesting related material.

<https://www.schneier.com/crypto-gram-1206.html#1>

</comment><comment><USER18> Perhaps this is the explanation for how Flame and Stuxnet had so many zero day exploits: the Feds crowdsourced them through the Grugq.

<comment><USER19> It's an open secret that they both build them and buy them. Where the stuxnet ones came from is uncertain, but it could have gone either way.

I've heard they'll actually pay for one they already have if they hear a broker selling it. In this case, they are paying to keep it scarce (as these deals come with exclusivity).

</comment></comment><comment><USER20> Hopefully the result of this revealed information will encourage companies to raise the prices they offer for reporting/fixing security critical updates. It's a shame that the legitimate route pays 1/10th to 1/25th of the alternative. Particularly since the illegitimate route is basically selling coding services to a government agency in a lot of cases (albeit closer to cracker than hacker), which some people do anyways as a part of their normal coding jobs.

</comment><comment><USER21> Brokering 0days - legal? yes. Risk free? I doubt it.

Grugq makes me think of Gerald Bull.

</comment><comment><USER22> So is it a safe assumption that all porn sites are riddled with these types of exploits? Excluding generating revenue from these types of exploits, I've never understood how those sites could be sustained given the bandwidth charges those sites must incur.

<comment><USER23> While porn sites might be riddled with malware it is unlikely that they'll be zero days. More likely you'll see exploits for bugs that are publicly known but not yet patched everywhere.

The value of a zero days is largely rooted in the fact that it hasn't been disclosed publicly and any widespread use of a zero day threatens that value. Zero days will be used when the risk of discovery is very low or the payoff is very high and attacking random people who visit dodgy websites is unlikely to meet those conditions.

</comment></comment><comment><USER24> Perhaps the worst thing about this is that engineers at the browser makers are now incentivized to create Zero-days. $250k and rising for knowingly creating a backdoor? There's now a market for software engineer corruption. Maybe add in some middlemen...

<comment><USER25> Wouldn't it be fairly easy to get caught doing this? Especially if you did it multiple times, it seems obvious exploits in code you checked in would be traced back to the malicious engineer.

</comment></comment><comment><USER26> "Google typically offers a maximum of $3,133.70"

i believe they recently paid out 2x $60,000 prizes.

<comment><USER27> They did, but this was for prizes during Pwnium at CanSecWest , not everyday amounts up for grabs.

<comment><USER23> True but the reward is now up to US$20,000 in some cases.

<http://www.google.com/about/company/rewardprogram.html>

<comment><USER28> I should also note that that's $20k for a _bug_ or series of bugs, not an _exploit_. Considering the monumental effort required to write a stable, viable exploit, getting 1/5 of the money (in theory) could well be worth it.

</comment></comment></comment></comment><comment><USER29> I know it was inevitable, but I find it rather disappointing that exploits have become such big business. I felt like the hacker/cracker community between the late-80s to mid-90s was just that: a community, which likely developed naturally because of the scarcity of information at the time. Sure, there were exploits being traded (and probably even sold occasionally), but I never got the impression that anyone treated it like a business.

Admittedly, I'm probably just being sentimental about my childhood, but that's how I remember it.

<comment><USER9> It has changed a lot in the last 20 years. Now organized crime as well as the involvement of nation-states has made it far more lucrative, and conversely, dangerous. Kingpin (kingpin.cc) does a good job of describing how much money there is to be made, even when you're not a PhD.

</comment></comment><comment><USER30> It's a pity the article only mentions client-side exploits, it would have been interesting to see what is paid for server-side zero-days, especially linux/LAMP related...

<comment><USER8> Consider the possibility that governments can create their own exploits. If they have a large quantity of server side bugs the marginal utility of one more is effectively 0. It is safe to assume that they have existing capabilities in that area. Just mentioning a LAMP stack means SQLi as the most likely vector. No point in paying for someone to run sqlmap for you... ;)

</comment></comment><comment><USER31> The article says that this practice is legal. If the sale is made, and then the client uses it to do something illegal, is the hacker / Grugq free of liability?

<comment><USER32> I would guess yes. The sale of firearms is legal, but if a buyer then goes and kills someone with the gun, the seller of the gun is not liable. Not an exact comparison but for legal comparisons I believe it's apt.

<comment><USER33> But there are noble and perfectly legal ways to use a gun. But there are not many for 0 days.

<comment><USER28> Jailbreaking, test cases for hardening your own systems (c.f. Metasploit), opening appliances/devices to other analysis.

Three very common cases. Would quarter million dollar exploits be used for these? Probably not, but it doesn't change the fact that there _are_ legit reasons to buy, sell, and use zero-day vulnerabilities.

<comment><USER34> The prices that go on in these markets make any of those reasons fall pretty blatantly on their face. Just like someone wanting to buy 100 AK-47s is also certainly not going to use them to just take to the range.

<comment><USER8> Cydia (the gray market app store) generates over a million dollars a year in revenue. The operation of this store, and thus its revenue stream, is entirely dependent on jailbroken iOS devices. Thus, there is a business entity with a existential interest in iOS exploits that are easily available to the iOS using community (i.e. the public). Would Cydia pay a quarter million dollars for an exploit to ensure that their customer base continues to exist? (Disclaimer: I'm not affiliated with Cydia in anyway, that revenue figure is from an ex-Apple employee discussing an informal estimate.)

</comment></comment></comment></comment></comment></comment><comment><USER35> Another article that reveals nothing new and only serves to help elevate the public's fear that a full scale cyber war is imminent...

</comment><comment><USER36> The hacker should accept bitcoins for the exploit and save the commission fee and maintain better anonymity.

Also the buyer could stay anonymous too.

</comment><comment><USER37> Linux isn't on the list, so I'm safe! :P

</comment><comment><USER38> why would iphone be harder to hack than android? is it because iphone software is more closed source?

</comment><comment><USER39> Is there some aspect of this story that is new? The article was published three months ago.

</comment><comment><USER40> Linux is not interesting for the buyers or not that easy to hack?

<comment><USER41> Probably has to do with servers being locked up pretty tight and desktop linux not having a large enough market share.</comment></comment>