Nixon was told: sea level would rise by 10 feet in 31 years - <AUTHOR> http://motls.blogspot.com/2010/07/nixon-was-told-sea-level-would-rise-by.html#more

<comment><USER2> During the Cold War, the US Government had two sets of calculations for the effects of nuclear arms (at least according to my dad, who worked for some time studying tactical nuclear weapons in the Marine Corps). The calculations for American _losses_ were a worst case scenario--in other words, they were a generous overestimate of how much death and destruction nuclear weapons could inflict on American targets. The calculations for _enemy_ losses were also a worst case scenario--in this case, a generous underestimate of how much we could kill and destroy by nuking them. The difference between these figures was often tremendous, and yet both figures remain very legitimate planning tools for the business of nuclear warfare.

If Moynihan's figures were intended to serve as a similar worst case scenario for climate change, they were not off by much--the increase in CO2 concentration was off by less than a factor of 2, and the measurements for temperature and sea level were just over an order of magnitude off (reasonable if you take worst-case scenarios for both CO2 concentration and the effects of higher CO2 concentration).

Incidentally, some factors, such as glacial melting, seem to be progressing _faster_ than contemporary global warming estimates have predicted.

</comment><comment><USER3> i think it just goes to show that "the environment" and "weather" are ridiculously complex and difficult to predict.

i'm sure they thought they were right at the time.

<comment><USER4> _i'm sure they thought they were right at the time_

I'm sure they were _scared_ that they might be right, hence the creation of the EPA.

It's hard to judge predictions from so long ago because they were used to influence policy. That policy then influenced what _actually_ happened, so it's not like two independent time points. I doubt that the seas would have risen 10 feet, but if there was no EPA, not environmental movement, not push to curb CO2 emissions, etc... we would probably be in a lot worse shape.

<comment><USER5> I could be totally wrong, but my impression is that at the time of the EPA's creation, the model of pollution that it was designed to prevent was based on more or less directly harmful contamination: litter, mercury, smog, that kind of thing.

I don't _think_ (and again, this is only an impression) that they saw the EPA as addressing global CO2 emissions.

<comment><USER6> Your impression is certainly consistent with the major environmental legislation that gave the EPA its teeth: we have a Clean Air Act and we have a Clear Water Act. We do not have a Carbon-free Act from the same time period empowering the EPA to significantly reduce greenhouse gas emissions.

</comment></comment></comment></comment><comment><USER7> I remember being in grade three (1988) and being told about what was then called 'the greenhouse effect' - some apparently respected scientists informed us alarmingly of how whole parts of the world would be underwater by 2000.

<comment><USER8> I also remember similar predictions from the late 1980s. I think the bottom line is that prognostications of doom sell much better than more conservative predictions with caveats and margins of error added. Scaremongering is more likely to result in increases in funding, career promotion, magazine/journal articles, impassioned speeches by celebrities, etc.

<comment><USER9> I'm a bit older (was in third grade in '69-70, right after watching Apollo 11 in real time) and the climate science consensus in the '70s and I think before was that we were headed for very bad global cooling, a new Ice Age that would put a mile of ice on top of much of the continental US. Read rather a lot of topical science fiction based on this "science".

Of course it was all man's fault (ignore that we're due for another Ice Age anytime now, see e.g. _Fallen Angels_ : <http://www.baen.com/library/> -> The Authors -> Larry Niven) due to sulfur dioxide increasing the reflectivity of clouds.

</comment></comment></comment><comment><USER10> Eh, primitive data was primitive.

Note that the key part of the prediction was the rate at which CO2 would increase. As it turned out, atmospheric CO2 hasn't yet reached the point that was predicted. So it should be no surprise that the sea level effects, etc, have not occurred either.

The key principles are correct: CO2 does trap heat. Atmospheric CO2 has been increasing over the century. Do the math. Clearly, unless you're counting on a deus ex machina to save your bacon, or expecting to be raptured out beforehand, the conservative stance is to reduce CO2 emissions in order to maintain CO2 levels within the range that is best compatible with the current distribution of humans on earth.

<comment><USER10> Also, only a moron would use predictions from 40 years ago, based on 40 year old science and data, as an argument against current client science. We have vastly more data, better tools, better methods, better technology, and science has progressed since the Nixon administration.

If you're going to do that, you might as well claim that the movie "Toy Story" would be impossible to create, because the Apollo program computers were unable to do 3D rendering.

<comment><USER11> It reminds me a bit of creationists, in 2010, arguing over Origin of the Species as if it were the latest in biology.

</comment></comment></comment><comment><USER12> The Crichton lecture linked on that page is very good: <http://www.s8int.com/crichton.html>

</comment><comment><USER13> I thought the 70s were all about global cooling?

<http://en.wikipedia.org/wiki/Global_cooling>

<comment><USER14> There was a lot of press hype about it, but global cooling wasn't widely accepted scientifically. The first paragraph of that Wikipedia article even says this.

One thing hasn't changed: the mainstream media's handling of science and technology was just as bad 40 years as it is now.

<comment><USER9> " _The first paragraph of that Wikipedia article even says this_ "

BZZZT. One thing you won't find on Wikipedia is honest coverage of climate science. "I was there" (back in the '70s) and it was taken seriously by many opinion makers and the like.

<comment><USER2> I hasten to point out that "opinion makers" and "scientists" are widely disjunct sets of individuals. (There's also a big difference between "taken seriously as a risk" and "taken seriously as the most probable outcome", and it's very easy to trip the first threshold without tripping the second. Even a 10% chance of, for instance, terrorists using nuclear weapons has to be taken extremely seriously even though it's highly improbable.)</comment></comment></comment></comment>


An Introduction to Google Fiber Customer Service - <AUTHOR> http://googlefiberblog.blogspot.com/2012/08/an-introduction-to-google-fiber.html

<comment><USER2> Hopefully more than a bulletin board / comment section with a _very_ occasional, condescending non-answer from a Googler taking a moment away from "more important stuff".

I'm hopeful for Google Fiber -- I really want it to work. Nonetheless, you know what I mean.</comment>


Bookwheel, the 16th Century Forerunner to the EBook Reader - <AUTHOR> https://www.amusingplanet.com/2019/01/bookwheel-16th-century-forerunner-to.html <comment><USER2> Not sure how it's the forerunner to e-readers. The title made me imagine it as a way to save you from paging manually through a book.

It's a ferris wheel of books for the purpose of referencing multiple books when you're too tormented with gout to walk around a table.

</comment><comment><USER3> One of the core improvements over traditional books, is portability.

I can carry around 100s of books whenever I travel - without having suitcases packed with them.

To compare this with ebooks is pretty strange, considering the portability is 0. It's basically saying "you can have multiple books open at the same time which keep their reading position".

Great, you have multiple tabs in a browser open now - you've achieved it.

</comment><comment><USER4> Being the happy owner of an ebook reader I just can't force myself to pick up a dead-tree book. Even though I have a dozen waiting for me to start them. It won't happen.

E-ink + Configurable font + Touch screen = Reading bliss

<comment><USER3> I'm not sure why you are being downvoted.

I read a lot, and was reluctant to getting a kindle. Now I've owned one for a year and I wouldn't go back. Being able to read from bed without glasses, with a bit of light from the device itself is just perfect to me for reading at night.

It's much more portable - which is great! The battery life is also amazing on those devices so my worry of having to charge them too often quickly disappeared.

The only books I do (sometimes) read in 'dead-tree books' are the more technical ones. But even those I'm starting to replace - some programming books have images embedded where the fragments of code are, so the formatting is preserved as the kindle can show the images perfectly fine.

The convenience and comfort of a kindle is just amazing - but for some more technical books with bad ebook support you still need traditional books.

I do tend to buy traditional books from time to time though - becaus I like the way they look on my bookshelves. Though now only for books I really like and want to be reminded about when I'm looking around in my room ^^</comment></comment>


Is there room for another search engine? - <AUTHOR>

I am developing a structured search engine to help web searchers find user-contributed information (yes, I know about network effect) in a way that is easy to perform sophisticated queries such as 'a list of jobs in industry A where the company has branches in B, C, D states and is founded by someone whose name consists of E'.
(the given query is just an example, though; it is not restricted to jobs)
The concept is similar to Freebase but not exactly a clone as I don't do clones.
I bounced this idea to a local (I'm Singaporean) forum and the typical response is "Why should users use your search engine and not Google?" even though I have stated that it is not meant to be a replacement for Google.
I am curious to the response of the HN community.
Is there room for such a search engine?
What kind of queries do you not use Google for? <comment><USER2> Google is... lacking when it comes to vertical or specialized searches, millions of database specific search interfaces on the web are a proof of this.

Furthermore, I would never ever gauge the viability of an idea simply based on feedback provided by random users on a forum, no matter how biz/tech savvy they might be. You need a more robust process for evaluation your ideas that's based on actual customer data. I suggest Steve Blank's The Four Steps to the Epiphany.

Good luck with your idea.

<comment><AUTHOR> Thank you for the words of encouragement. I appreciate it.

</comment></comment><comment><USER3> There's certainly room for another search engine. Have you ever tried shopping searches on Google? They're painful and I'm building something to fix that. Another horrible search experience is site-specific search. Try looking for some techcrunch articles about a topic or company. You'll get a ton of results, but filtering them is nearly impossible.

I think there's great scope for innovation on the UI, as hipmunk has clearly shown. Touch-based interactions, instead of typing and clicking, are going to be important.

Is there any specific vertical you're thinking of?

<comment><AUTHOR> I have figured out a way, which I can't share for now, on how to make it as vertical as it is horizontal (if that makes sense to anyone).

</comment></comment><comment><USER4> Are you familiar with Sparql ?

<comment><AUTHOR> Yes, but I won't touch that at all because I figured a way to make the search engine usable for non-geeks (no offence to geeks).

I think sometimes we need to take a step back and see things from a non-geeky aspect in order to come up with a practical solution.</comment></comment>


President of the International Criminal Tribunal = US Puppet? - <AUTHOR> http://www.information.dk/464080

<comment><AUTHOR> Legal conclusion = well, maybe. Any lawyers? Discuss.

 _" Yes, they could be seen as compromising, but I am not sure how relevant it is to view that he operates as a puppet

[...]

The documents contain absolutely no proof that Meron took instructions from the US and Israel. The scandal is not Meron. The scandal is that a Danish Judge at the Tribunal puts forward unfounded rumors. Harhoff ought to be recused from the trial chamber in the Sesejl case, he is prone to convict." \- Kevin Jon Heller, Associate Professor at Melbourne Law School.

Information tried to get in touch with judge Meron for a comment, but he did not respond to emails._</comment>


Fred Wilson invented Embedly: How we got a Y Combinator interview - <AUTHOR> http://blog.embed.ly/fred-wilson-invented-embedly-how-we-got-a-y-c

<comment><USER2> Added this to my list of blog entries about the yc interview process: <http://ycuniverse.com/interviewees.php>

<comment><USER3> I was really surprised to see the parent downvoted. It provided useful information to me (I didn't know such a list existed or where to find it) and presumably others ... what's the objection?

<comment><USER2> Yeah... I was surprised to see it down-voted as well. Although my repeated linking to that page in comments seems very spammy, my heart's in the right place.

I don't think very many YC applicants and potential YC applicants realize how much useful information I have on that site.

</comment></comment></comment><comment><USER4> If the first sentence itself is a disclaimer, then why write such sensational headline? Don't be so dramatic. I'm interested in reading your article and learning from it. Please don't fool me. I tend to loose respect for your content and efforts due to such marketing tactics.

<comment><AUTHOR> We all need to give hat tips to the people that inspired us to be greater and try new things. We would not be here right now without Fred. I'll put his name in titles all day long just to adknowledge his contributions.

<comment><USER4> You could have said "Fred Wilson _inspired_ Embedly". The "invented" sounds too dramatic and may be inaccurate too.

</comment></comment></comment><comment><USER5> posterous seems to have issues:

[http://webcache.googleusercontent.com/search?q=cache:f3LGdaE...](http://webcache.googleusercontent.com/search?q=cache:f3LGdaE2eAQJ:blog.embed.ly/fred- wilson-invented-embedly-how-we-got-a-y-c+http://blog.embed.ly/fred-wilson- invented-embedly-how-we-got-a- y-c&cd=1&hl=en&ct=clnk&gl=us&source=www.google.com)</comment>


FastMail under DDoS Attack - <AUTHOR> http://blog.fastmail.com/2015/11/11/ddos-attack-may-lead-to-potential-service-disruption-this-week/ <comment><USER3> We recently were hit by multiple DDoS attacks over a weekend. We have our own servers in a data center with 5 redundant 1 Gbps links. The DDoS was 20Gbps according to the upstream providers.

Our upstream implemented layer 7 mitigation which did an unbelievably effective job at stopping the attack in it's tracks. I don't know the tech that they used, but it performs deep packet inspection up to the application layer and they charge a modest additional fee for passing our traffic through that system.

The effect was that our traffic dropped to very slightly below normal levels during the attack, which would indicate that there were probably a few false positives, but we didn't have a single customer complaint.

<comment><USER4> With such a positive feedback you should really tell us the name of the upstream

<comment><USER5> Ditto. Would you care to share?

</comment></comment></comment><comment><USER6> And Protonmail. [https://protonmail.com/blog/protonmail-ddos- attacks/](https://protonmail.com/blog/protonmail-ddos-attacks/)

Fastmail, pro tip: don't pay any ransom.

<comment><USER7> Not a chance :)

<comment><USER8> Thanks for taking this stance. I'm a customer (I think we actually talked together recently about Apple/Google vCard implementation) and I appreciate you guys making a stand against this criminal behaviour.

It could seem to some people that such a stance is easy, but no matter the strength of principle, when you see your business go offline and customers start banging at the doors for you to sort it out then the situation becomes more complex.

So from this customer - keep up this stance, keep being transparent and I for one will stick by you guys without hesitation!

<comment><USER9> Indeed, I don't want them to fund criminals with my money like those Swiss guys did.

DDoS mitigation isn't that expensive antway considering the size of FastMail.

</comment></comment></comment></comment><comment><USER10> DDoS attacks today are such a commodity. It takes next to nothing to launch them.

You can get upwards of 200Gbps for 1/6 of a bitcoin. It is very easy to setup and you can DDoS your favourite site in a matter of minutes.

These are not very smart attacks and can be mitigated even using the free tier of cloudflare.

I don't have the background on the mail provider attacks but 6.5k ransom seems to come from attackers who use easily available booters. Hushmail switched to Cloudflare throughout their attacks and that seemed to have helped, not sure what fastmail will do.

But any public web service should not be in a position where they are vulnerable to off the shelf DDoS attacks.

DDoS attack as suffered by for example Githuh with heavy coordination and nation states behind them require more specialised defenses. There are commercial alternatives out there that go from anywhere between 9k-40k per month depending on bandwidth and technology - see Imperva, Prolexic, Neustar, Nexusguard, Blacklotus, Incapsula, etc..

Apart from the initial setup which is more involved than Cloudflare's there is not much to do apart from throwing money at it. Quite the money making business really :)

<comment><USER11> If we were pure web we would have ducked behind Cloudflare immediately. Since we do SMTP/IMAP/POP3 as well, we've had to go with a more complex (and costly) solution.

This is our theory for why they're currently attacking email providers. We're not "just a web site", and attackers realise that the situation is more complex for email sites, we can't just hide behind Cloudflare.

We're not sure who's actually attacking us, the ransom note comes from a freemail provider and a connection from a tor exit node. We can only guess at their total capabilities.

<comment> cat-dev-null 0\. Place an HA pfSense CARP or OpenBSD pf CARP setup as a pair of transparent proxies in front of everything (eg at the edge on the other side of HA network gear with either 2 (or 3, if deploying a private, admin network too) NIC teams for isolating traffic). This will let you do raw L3 traffic measurements on each side with graphite/collectd, cacti, rrdtool, etc. and L2/L3 IP/network banning (if you don't own/admin the network gear or don't want to touch it in production). These are super cheap and only need ~128 MiB RAM each and very little CPU and disk (except for logging, you want a dedicated PCIe SSD or SSD partition if possible). (Your public IP(s) should point to these boxen.)

1\. Definitely get stuff behind reverse SMTP/IMAP/POP3 proxy like nginx or haproxy.

nginx: Compile it from source if that's all you need, and reduce your attack surface. [http://nginx.org/en/docs/mail/ngx_mail_proxy_module.html](http://nginx.org/en/docs/mail/ngx_mail_proxy_module.html)

haproxy: [http://blog.haproxy.com/2012/06/30/efficient-smtp-relay- infr...](http://blog.haproxy.com/2012/06/30/efficient-smtp-relay- infrastructure-with-postfix-and-load-balancers/)

2\. Setup something like fail2ban: [https://rtcamp.com/tutorials/nginx/fail2ban/](https://rtcamp.com/tutorials/nginx/fail2ban/)

3\. There are many other tweaks and there are some appliancized VMs for anti- spam and DDoS that can be dropped behind the trusted network-side. (I would advise against Cloudflare-like services for most mature and non-web apps because they are add'l points of failure and increase latency, and they duplicate what good sys/netadmins implement routinely, especially if you're already deployed to multiple DCs servicing multiple continents and/or geodns.)

Pedigree: I'm a founder and once-upon-a-time security researcher & sysadmin whom sold out and became SRE manager and then a consultant. I used to maintain multiple deployments of commercial Zimbra (from m&a activities) for clients including hi-ed, non-profits, VIP individuals, and enterprises.

<comment><USER12> this is the first I've heard of being able to block traffic in excess of 10Gbps with "128MiB" and "very little CPU" in addition to Cloudflare-like services adding latency.

<comment><USER11> Yeah, it's small-time advice. Good advice for protection against complexity attacks, not so much for protection against tens of Gbps of random junk that fills your entire pipe.

(we do run nginx on out frontend machines for both web and mail protocols, protecting the Cyrus servers behind it from complexity attacks and providing fan-out connection routing)

We dropped all the DDoS packets at our edge firewall quite comfortably - <USER2> wouldn't have even noticed except that it filled up our incoming links, so packets started dropping.

I'm really quite impressed at the tech which the big DDoS protection providers have for packet inspection and cleaning the feed before it reaches the end host.

It does lower the overall egalitarianism of the internet to have to deploy defenses - we lower our overall routability to put these mega filters in front of incoming packets - but that's the reality of a world where fiends can control tens of thousands of boxes and have them spew traffic at any random network address. You need to filter out at the boundary.

Nothing short of filtering beforehand can stop a channel from being filled if it gets more than its capacity per second of incoming packets.

</comment></comment></comment></comment></comment><comment><USER13> I've just started checking out Fastmail as a result of this thread. I hadn't heard of it before but I'm really into it.

I've been trying out different email services lately in an effort to untether myself from Google, and this one seems like a really good choice.

I'm not into the iOS themed non native Android app though, but being an Android developer I'm more averse to that nonsense. It seems to work great and is really fast though. Does anyone know if there is a native app planned?

I'd be willing to pay a subscription for email if it's worth it. I'd love to hear others' experience with them.

<comment><USER14> I have a lifetime email alias from my university, and when I used it with Gmail it would always appear to people as "From firstname.lastname@example.com on behalf of firstname.lastname@example.com". I wanted my .edu to be my _actual_ email address, but my gmail address is what was ending up in people's address books.

So I tried out Fastmail with my alias and had no trouble getting it working the way I wanted it to work. So I've been with Fastmail ever since.

<comment><USER15> _when I used it with Gmail it would always appear to people as "From email@example.com on behalf of firstname.lastname@example.com"._

This doesn't happen if you configure an external SMTP server in Google Mail for the alias.

[http://gmailblog.blogspot.de/2009/07/send-mail-from- another-...](http://gmailblog.blogspot.de/2009/07/send-mail-from-another- address-without.html)

[https://support.google.com/mail/answer/22370?hl=en](https://support.google.com/mail/answer/22370?hl=en)

Moreover, you don't want to use a different 'from' address without sending through the appropriate SMTP server. If the domain has SPF or DKIM set up, a receiving server might reject your mail if it wasn't sent from an expected SMTP server.

</comment></comment></comment><comment><USER16> Given that so many of us are now hosting on AWS, I'd like to ask the question - who has been hit with a DDOS attack / extortion letter while is hosting on AWS? It would seem that there's many old-tech companies hosting in data centers that would seem to be far more vulnerable to non-TCP attack vectors than AWS-hosted systems. Is that who is generally targeted here? Are there any stories, anecdotal or otherwise, about people getting hit with DDOS attacks while using AWS. Here's a talk by AWS on their measures against attacks - [https://www.youtube.com/watch?v=Ys0gG1koqJA](https://www.youtube.com/watch?v=Ys0gG1koqJA). The only thing short of Silverline etc defense that they seem to be lacking is the reporting dashboard indicating when they've defended against DDOS attacks. So has anyone received a letter from DD4BC and other miscreants whilst hosting their domains on AWS?

</comment><comment><USER17> It's nice to see this published proactively. At the very least, transparency like this helps users understand what the circumstances are ahead of time.

Best of luck to the Fastmail team, I hope they are able to weather the storm out.

</comment><comment><USER18> And they've very clearly refused to pay the Danegeld demanded by their attackers. Smart, principled and yet another reason I'm a happy customer of theirs.

</comment><comment><USER19> Runbox was also recently under ddos attack [https://blog.runbox.com/2015/11/ddos-attacks-on- runbox/](https://blog.runbox.com/2015/11/ddos-attacks-on-runbox/)

</comment><comment><USER20> I ditched gmail for fastmail two years ago and don't regret it for a second. I haven't noticed any disruption at all. Keep up the good work, guys.

</comment><comment><USER21> Zoho Mail also attacked recently: [https://www.zoho.com/service- updates/blog/zoho-services-unde...](https://www.zoho.com/service- updates/blog/zoho-services-under-criminal-attack.html)

</comment><comment><USER22> It looks like it's a general attack on email providers because they can't duck behind Cloudflare (or similar).

</comment><comment><USER23> Hushmail recently had it as well. [https://help.hushmail.com/entries/107539976](https://help.hushmail.com/entries/107539976)

</comment><comment><USER24> I have not noticed any service interruption at all. Well done in handling this attack! This is just one more reason why I will remain a loyal FastMail customer.

</comment><comment><USER25> Wow, seriously, fuck these people. There has to be a technical solution to this, since it's infeasible to find/fix/finish the Armada Collective.

SMTP/IMAP/etc. are pretty crappy protocols in a lot of ways, but they're what everyone has deployed. They can be proxied like HTTP/HTTPS. There are spam/reputation issues with outgoing traffic, too, which makes this even more annoying.

<comment><USER26> There is a SilverLine by F5 Networks: [https://f5.com/products/platforms/silverline/f5-silverline-d...](https://f5.com/products/platforms/silverline/f5-silverline- ddos-protection).

</comment></comment><comment><USER27> We're a FastMail reseller, and so far we haven't experienced any problems - either on delivery, or the front end interface. So good job defending against it.

</comment><comment><USER28> What I love about FastMail is that I can neatly organize my emails into folders based by categories (via rules for subdomains), such as: newsletters folder (firstname.lastname@example.com), social (email@example.com) etc. Everything is so clean and I don't even see any spam, they're top notch.

</comment><comment><USER29> As a happy FastMail customer: thank you for standing up to them and announcing this in advance. More power to you!

</comment><comment><USER30> DDoS is a type of attack that is so old that I wonder why it is still possible to exploit it. It is at least 15 years old? (edit: I am not blaming FastMail, this is just a general assumption)

<comment><USER31> It's still possible to exploit because "DDoS" isn't one attack, but a category: people keep finding new ways to slam a target with tons of traffic.

For a while, the most common way was with botnets of compromised PCs. They still exist, but big attacks with them are less common since Microsoft has gotten better at securing people's computers. The big thing now is "amplification attacks": basically, finding a way to send a small amount of data and get some other host to flood your target with a huge amount of data in response. Search "NTP amplification attack" for details. More recently, China has weaponized the Great Firewall to be yet another DDoS vector: they inject JavaScript into pages that people visit, and that JS floods a target with requests.

As long as there is some way to point a lot of requests somewhere you want, DDoS attacks will be a thing.

<comment><USER30> not necessarily... you could use AI to detect attacks or some other methods that I am not aware of.

<comment><USER32> Most attacks are trivial to detect, you don't need AI. It's just hard to get useful work done when all your incoming interfaces are overloaded with easily detectable abuse.

<comment><USER33> The "best" way would be to have application logic to detect non-legitimate requests, and make an API call out of band to upstream networking gear to insert a null route for that IP (so as to drop the traffic at the edge before any real "work" takes place on it).

In a previous life, I ran physical datacenters, and while the gear wasn't terribly powerful then (we're still worried about running out of memory on core routers, hence why IP blocks don't get sliced up and piecemealed out with the exhaustion of IPv4 space), I'd expect newer hardware to be able to keep up.

The network can remain irrational longer than you can stay online.

<comment><USER34> Problem is, beyond a certain volume, even the upstream gear is gonna get saturated just reading the header on the bogus packets and directing them into the bit bucket. It's not unheard of for the larger attacks to take down entire ISPs.

<comment><USER35> Unless you keep propagating "upstream" and the message gets to the "source" ISP, and they block the actual misbehaving user/account. For all we know, they can kick them off the network after sufficient transgression, and ban their account at the hardware ADSL level (assuming that's what it is). This also presumes the ISP is willing to implement such a feature, and kick-off their paying (albeit infected) users.

I don't know much about this stuff, so I'm extrapolating and pseudo-solving.

<comment><USER32> Usually there's a lot of diversity in the immediate source of the traffic. If it's a volumetric attack, the immediate source is the misconfigured servers that spoofed packets are being sent to. If it's an in band attack, the immediate source is usually botnet members, but occasionally regular browsers being served bad scripts by a compromised or mitmed site.

You could work to notify the network owners, but it's whack-a-mole; even with strong efforts there are enough DNS and ntp servers out there configured to generate a pretty big reflection.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER36> Why do we always hear of DDoS attacks to mail services, but never to Gmail? are they more DDoS resistant? are the attacks not public?

<comment><USER37> One would assume DDoSing the biggest service around, run by a company that has experience running giant internet facing services, a lot of security experience and tons of cash would be a lot harder than a provider with in comparison small connectivity and a small number of locations, yes. Pure size helps, + if you are at the scale of Google your upstreams probably have more interest in helping you if it were necessary.

It would be interesting to see how often people try though.

<comment><USER8> It may even been simpler than that and they might not even need 'upstream' any more. They may not even have upstream for many things, given their scale now, they probably just peer to Tier 1, if they even need that any more! (they were actually just as big as Tier 1 folks back in 2010![0].

Google has been buying up 'dark fiber' for years and has thousands of miles of cable connecting their data centers.

They can certainly handle petabit/s levels of traffic inside the datacenter[1], it's not that much of a stretch to think that they can handle double digit terabit/s through their collective external fiber links.

Also, just think about their normal level of operation. Even just all the Android devices feeding data back and forth, let alone analytics, maps, gmail, search etc etc. They've got 36 data centers and co-locate in more than 60 public exchanges (and that was in 2010!), not to mention the Google Global Cache (GGC) servers inside consumer networks across the globe.

Their scale is ridiculously large. I suspect that they actually can't be DDoS'd in the normal 'chuck traffic at them' sense.

[0] [http://www.theregister.co.uk/2010/03/17/the_size_of_the_goog...](http://www.theregister.co.uk/2010/03/17/the_size_of_the_googlenet/)

[1] [http://googlecloudplatform.blogspot.co.uk/2015/06/A-Look- Ins...](http://googlecloudplatform.blogspot.co.uk/2015/06/A-Look-Inside- Googles-Data-Center-Networks.html)

</comment></comment></comment><comment><USER38> last week protonmail, then zoho (their services were offline for 6 days) ... a new one every week it seems</comment>


Math: Deriving the Y-combinator - <AUTHOR> http://www.ece.uc.edu/~franco/C511/html/Scheme/ycomb.html

<comment><AUTHOR> I am well aware I am the queen of "...and crickets chirped." when it comes to submissions. That actually generalizes to other forums, so it is not a left- handed slap at HN. Anyway, I am posting this because I have a serious question: Is there such a thing as an "N-combinator"? I mean mathematically speaking.

When I google either term, what comes to the top are company names. But it is possible to find the math stuff for Y-combinator but no such thing comes up for N-combinator. This kind of came up in conversation on HN yesterday and I had too much time on my hands this morning and began wondering about it.

Thanks.

<comment><USER2> <http://news.ycombinator.com/item?id=3955532>

When you have 26 letters to choose from, you're bound to end up recycling some letters. Some combinators were useful enough that they got to keep their names. I've seen at least three N combinators, but they were almost always stepping stones to simplify later expressions and never useful enough to memorize or allocate a reserved letter to.

<comment><AUTHOR> Thanks. I am a calculus drop out and non programmer, so some of what goes on here is way over my head (which is part of why I hang here).</comment></comment></comment>


In the future, your body won't be buried, it will be dissolved - <AUTHOR> https://www.wired.co.uk/article/alkaline-hydrolysis-biocremation-resomation-water-cremation-dissolving-bodies <comment><USER2> We have too many dead people - makes sense to me. I also like the idea of dead bodies as fertilizers for trees. But I'd way prefer to have my ashes help nourish a badass oak tree then just slowly rot away. Or maybe an apple tree...

</comment><comment><USER3> Excellent idea for a process that merely speeds up something (recycling) that's going to happen whatever, given time.</comment>


Ex-Googlers have invested in 200 startups since '05 & are just getting started - <AUTHOR> http://www.businessweek.com/print/magazine/content/10_10/b4169039637367.htm

<comment><AUTHOR> Good quote from pg (last paragraph):

"When people write the history of Silicon Valley 20 years from now," says Graham, "the true impact of Google could come more from all the things that Google people go on to do after they leave Google."

<comment><USER3> This is certainly true of older, failed companies like Netscape.

<comment><USER4> It's also true of Paypal, which has spun off tons of companies (Youtube, Facebook(angels), RockYou, etc.).

</comment></comment></comment><comment><USER5> These people definitely have the money, and probably the brains. The question is: is that enough?

Because I doubt many of them are entrepreneurs by vocation. Otherwise they wouldn't have been G. employees in the first place, working in their own startups instead. So I guess many of them are angels because "that's what you do if you have money in the Valley".

So, how important is being an entrepreneur for the success of the company you are funding? Maybe they should've stayed employees? Or as long as you have the money and the brains, you're a good angel?

I guess we'll find out. If nothing else, it will be a great experiment - <USER2> would love to see the final statistics.

<comment><USER6> I suspect that a great many of these individuals share the following traits:

\- extreme intelligence

\- experience riding an extremely succesful company to the top

\- conifdence from that ride

Many of these folks were in the right place at the right time however, and do not neccesarily have the experience as investors and business advisors.

Should be interesting though. It doesn't matter how they got the money, they are putting it to work, and the relative efficiencies that startups have today vs 5 or 10 years ago will make these investments even more effective.

</comment></comment><comment><USER7> And think, just a month or two ago a hot link on Hacker News was how Google was killing innovation & startups by buying so many.

</comment><comment><USER8> _Ron Conway, one of the Valley's most active angel investors, who has backed 190 companies_

Anyone happen to know if that number accurate? It seems like, given the length of time he has been investing, that number would be higher.

<comment><USER9> They're using the numbers from YouNoodle's report, which only goes back 5-6 years.

<comment><USER10> Specifically, for Ron Conway, we look at 2004 and onwards.

</comment></comment></comment><comment><USER11> Not really sure why Google doesn't setup their own version of YC, and fund their own people's startups... Take 5-10% for 20k-30k and let their people have a go at it.

<comment><USER12> Close...

<http://www.google.com/ventures/>

</comment></comment><comment><USER13> All of this sounds like an elaborate plan to motivate google employees to quit and start their own ventures.</comment>


A compiler for Crisp, a Lisp-inspired language, in Haskell with LLVM - <AUTHOR> https://github.com/talw/crisp-compiler

<comment><USER2> The LLVM project has a tutorial for building an expression language[0]. The tutorial was ported to Haskell by Stephen Diehl[1]. The person who built Crisp is also following that tutorial (I recognize snippets).

I can recommend anyone interested in building a language to try this tutorial, either the original one or the Haskell one. It's easy to follow, and you can just copy and paste as you go along and in the end you will have not just your own little toy language that you fully understand and can modify to your liking, but one that actually is compiled with a world-class optimizer, getting you sweet performance.

I am currently attempting the build a C compiler in Haskell with the tutorial as a basis. (It's nowhere near even compiling Hello World, which requires more C features than you'd think ;), so I won't link it)

        [0] http://llvm.org/docs/tutorial/
        [1] http://www.stephendiehl.com/llvm/

<comment><USER3> Indeed, I have used Stephen Diel's excellent tutorial as a starting point to get off the ground by taking snippets as they are, albeit with slight modifications. Stephen's wrapper of the LLVM bindings to create an LLVM DSL in Haskell is wonderful. Although the more interesting aspects (at least for me) such as lambdas/closures and data structures such as lists or arrays, are not covered in that tutorial, it's actually for the better as it gives you enough of a push in the beginning for working with LLVM, without overwhelming you.

Overall, it has been an enjoyable and educational (Haskell/compilers/dynamic languages/Scheme/LLVM - wise) experience. Quite noticably, my troubleshooting time was largely spent fixing compiling errors, with only a fraction of the time, relatively speaking, spent fixing runtime errors. Adding new features (barring those that necessitated making an overhaul to the design itself, as it emerged without much foreplanning) was a breeze.</comment></comment>


Syswall: a firewall for syscalls - <AUTHOR> https://www.polaris64.net/blog/programming/2019/syswall-a-firewall-for-syscalls <comment><USER2> Sounds a little bit like OpenBSD's pledge - was that a source of inspiration?

<comment><USER3> Yes, partially, although I wanted to create a more interactive system for end- users to reason about software. I wouldn't recommend it (certainly not yet at least) for system security, tools like seccomp and pledge will do a better job there.

<comment><USER4> Nice work. Just read this :-)

</comment></comment></comment><comment><USER5> sounds like [https://en.wikipedia.org/wiki/Systrace#Features](https://en.wikipedia.org/wiki/Systrace#Features)

more ... [http://www.citi.umich.edu/u/provos/systrace/](http://www.citi.umich.edu/u/provos/systrace/)

it didn't work out then, but best wishes to the new generation

<comment><USER6> What do you mean by it didn't work? Not adopted or are there implementation issues?

Also - for the OP. Don't be discouraged there's so many features to add, management, attribution, machine learning etc

<comment><USER7> There were some security issues in systrace. /[http://www.watson.org/~robert/2007woot/](http://www.watson.org/~robert/2007woot/)

</comment></comment></comment><comment><USER4> How is this different from seccomp?

<comment><USER3> seccomp is a robust way of restricting a process's syscalls so that it can only do what you allow it to.

syswall is more of an interactive tool (similar to systrace as mentioned in another comment). The goal is not to replace seccomp (it's certainly not meant to provide complete security), but rather to allow users to reason about what a process is actually doing. For example, allowing users to see if a new version does something different from the previous, perhaps meaning that malicious code was added unexpectedly.</comment></comment>


Kordam, the First Game Editor in Your Browser. Create - Play - Share - <AUTHOR> http://blog.kordam.fr/2015/02/kordam-begins-nananana.html

<comment><USER2> I don't speak French.

<comment><USER3> For those who can't read speak French, it says that Kordam is developing a game editor that will be accessible from the browser. However, the page is just an announcement and there is nothing available yet - it's still under development.

<comment><AUTHOR> Right, they will put online the first release next month. I received their announcement in my inbox : [http://www.kordam.fr](http://www.kordam.fr)</comment></comment></comment>


Google Kills Its Other Plus, and How to Bring It Back - <AUTHOR> http://waxy.org/2011/10/google_kills_its_other_plus/ <comment><USER2> I've just switched my default search to duckduckgo.com. Will see how it goes.</comment>


The difference between a corporation and startup - <AUTHOR>

Corporation: 90 % of time talking about the problem, 10 % working on it. Small Business: 10 % talking about it, 90 % working on it. <comment><USER2> I've always held a quite different view of startups. Namely that enterprises hold a lot of responsibility, they provide stable products, long support windows, quality customer service and a lot of their money, time, and effort goes into ensuring that continuity. Yes, they spend a lot of time talking, but that's because getting it right is an imperative. "Just doing it" isn't going to meet their customers' needs.

Meanwhile, startups have a lifetime generally of "until they get bought out", and hence are apt to start and shutdown products with little to no warning, provide a minimal amount of long-term support or assurance, and with minimal or basic customer service. Sure, they operate with a lot less overhead, but they provide a much less reliable product.</comment>


Single-use JIT Performance on x86 Processors - <AUTHOR> https://github.com/animetosho/jit_smc_test/blob/master/README.md <comment><USER2> You have to be a bit careful with the CLFLUSH method. I tried to use it in a widely used program years ago because Intel recommended it, but we found that it just hangs the CPU on some older VIA/Centaur CPUs. Presumably that's fixed these days, but the old CPUs are likely still around.

<comment><AUTHOR> Thanks for the info! Unfortunately I don't have access to any VIA/Centaur CPUs, so couldn't test on those (though test results welcome if anyone is willing/able to!).

But yeah, you have to check the CPU you're running on when doing these tricks unfortunately, as results vary greatly across micro-architectures.

Interestingly, there's a more optimal CLFLUSHOPT instruction on more recent processors, which often seems to be quite effective for this task.

</comment></comment><comment><USER3> Looks fun, but impractical. Are there real uses for this kind of thing, on modern architectures?

Related question: has anyone tried to create a high-level language for doing this kind of madness?

<comment><USER4> There are practical applications for this.

Perhaps most importantly for regexp compilation, as it is a fairly common use case [1].

Some other examples I can think of: JIT compiling an eval-statement. Constructing a filter for example for a database scan. CPU based pixel shader. Etc.

A lot of code is JIT compiled, but executed only once. So this was a pretty interesting article with practical performance implications in some scenarios.

[1]: See for example [https://www.pcre.org/original/doc/html/pcrejit.html](https://www.pcre.org/original/doc/html/pcrejit.html)

<comment><AUTHOR> Thanks for the info. I'm not particularly familiar with common JIT applications, but I suspect that this use-case is actually more niche than may think.

The problem is that the example presented requires a memory page with write + execute permissions (at the same time). I suspect many JITs don't do this for security reasons (and to deal with OSes which don't allow it), as it may make it easier for an attacker to gain arbitrary code execution. It's likely that many JITs toggle between write and execute permissions, rather than have both enabled at the same time. Whilst this reduces attack surface, changing permissions on allocated memory requires syscalls, which are quite expensive in terms of performance.

The scenario presented in the article avoids the impact of syscalls, to maximize performance, leaving only the impact caused by the processor itself. If a JIT isn't overly concerned with this type of security, using write+execute memory could be a way to avoid syscall overhead. On the other hand, if a JIT does toggle permissions, the syscall overhead is likely much more significant than overheads caused by the processor (although the techniques shown might still help depending on how the JIT engine works).

<comment><USER4> Yeah, the security implications are obvious, R+W+X should not be used with untrusted inputs.

Not that I'd recommend this, but alternatively you could also map exact same memory twice, one with R+X and the other with R+W. The attacker would need to figure out the writable address. Unfortunately there are probably a lot of ways to accidentally leak this information to the attacker...

There are still plenty of use cases where inputs can be trusted.

<comment><USER5> For performance I think this scheme is fairly common for W^X JITs.</comment></comment></comment></comment></comment>


Dammit LinkedIn, I'm a college dropout (2009) - <AUTHOR> http://paulholmes.ca/2009/11/20/dammit-linkedin-im-a-college-dropout/ <comment><USER2> This rings true for me. I'm a high school dropout with a GED and a couple of community college credits, but nevertheless found success in tech. I know a lot of people my age took this unconventional path, but LinkedIn basically tells us to fuck off.

<comment><USER3> Conversely I'm in the same boat, but I still can't find value in LinkedIn because it feels so disingenuous, and not at all part of my peer hiring circle. I suppose if I weren't already employed in a job that fulfills all of my needs, I'd be more concerned, but LinkedIn has never been anything but a curiosity for me. I'm sure others may find more value in it, but in responding to your comment I guess I just felt the need to say you're not the only one that took the same unconventional path.

<comment><USER4> Highschool dropout as well. I see LinkedIn as sort of the antithesis of GitHub.

Whereas LinkedIn is sort of a social proof via credential, GitHub is social proof via work product.

Plenty of people smarter than me have written about the diminishing value of credentials and credentialism as social proof[0]. I believe that is partially why LinkedIn is such a cess-pool/shit-show.

Maybe it's my bias from being a dropout that only my work product has ever mattered. I believe there's room for a social network to replace LinkedIn with a "GitHub for non-tech people". Perhaps this would have a mix of credentials and a way to show ones work.

[0]: The Future of the Professions: How Technology Will Transform the Work of Human Experts Book by Daniel Susskind and Richard Susskind [https://www.amazon.com/Future-Professions-Technology- Transfo...](https://www.amazon.com/Future-Professions-Technology-Transform- Experts/dp/0198713398)

<comment><USER5> I agree with the first part about credentials, but I see a bit of danger in how you view Github.

I _wish_ I had time to put more stuff in my Github account, but I don't.. All the work I do is for clients, or for my employer, and I can't post or share it.

Sometimes I can extract a small piece and share it, but otherwise, I can't. I also don't have a ton of time in my life to code on personal projects anymore.

So while I consider myself an experienced and accomplished developer (been at it for 20 years now), if Github is my "social proof via work product", then I don't look like much..

I'm not saying this is your fault or that people will only ever look at Github, but I hear this more and more ("show us your Github work") in the context of hiring and evaluating developers, and I hope it doesn't become just another thing that - following OP's point - people or systems hold against you for not having.

<comment><USER6> Only few of my colleagues have active github or open source contributions. They code enough in work basically. Some of them a lot actually. Oddly and I think it is just random, those with active github are less productive/reliable at work.

Then again, I never bothered to have linked in account. Nobody I know is using it.

</comment></comment></comment></comment></comment><comment><USER7> LinkedIn also only wants to consider jobs in the modern sense, not the traditional sense. So I decided to list myself as "Co-CEO of the Ganz Family" with the description "Full-time stay-at-home mom. Job description includes cleaning up other people's poop, so it actually isn't too different from corporate life..."

EDIT: And if you think that this approach would cut down on the dumb recruiter spam, you'd be sadly mistaken. :-/

<comment><USER8> It might not stop the poor recruiters but it might stop the good ones who had good leads.

Yes, there are some good recruiters even read profiles before they contact people.

</comment></comment><comment><USER9> I have never paid attention to any of the "you aren't complete!" messages or indicators. I don't care.

<comment><USER10> I ignored LinkedIn's "get complete!" messages for a long time. One night I sat down with the curiosity of hitting 100% on LinkedIn. I now have an "all-star profile", whatever that means, and in a top some percentage of profiles.

At the end of the day, it just means more people look at my profile.

It may be jumping to conclusions to say I get no value out of it — it's a mixed bag. More contacts from people I know about legitimately good opportunities, and them seeing my face pop up more on LinkedIn might play a role in that. But it also means more contact from recruiters, and usually that means spammy third party recruiters. I mostly just don't respond to them anymore.

</comment></comment><comment><USER11> I finally gave up complaining about this issue late last year, and filled in the education section of my profile with the following:

Hogwarts School of Witchcraft and Wizardry

Master of Wizardry, Arithmancy, Passed all N.E.W.T.s with grades E and O

1985 – 1989

Activities and Societies: Ravenclaw House, Dumbledore's Army

Thesis: "Extending Turing's Phase Conjugate Grammars for Extra-dimensional Summoning to Account for Quantum Many-Worlds Hypothesis using Dho-Nha Geometry Curves".

</comment><comment><USER12> Facebook did something similar and I entered 'Bovine University', which it turns out has tens of thousands of students.

<comment><USER13> The University of Northern New Jersey would be a fun choice. A fictional school created by US Homeland Security for a sting operation.

[https://en.m.wikipedia.org/wiki/University_of_Northern_New_J...](https://en.m.wikipedia.org/wiki/University_of_Northern_New_Jersey)

Edit: 72 Alumni and 2 employees on LinkedIn. Heh. [https://www.linkedin.com/edu/university-of-northern-new- jers...](https://www.linkedin.com/edu/university-of-northern-new-jersey-50010)

<comment><USER9> > The fake university was recognized by the State of New Jersey and was > accredited by the Accrediting Commission of Career Schools and Colleges > (ACCSC).[3] The director of the ACCSC confirmed that it had accredited the > "university" to cooperate with the federal investigation.[6]

Thus bringing into doubt any ACCSC accreditation. I pity the innocent student who, at best, wasted time researching UNNJ, and possibly moved forward without realizing where the trail was leading.

<comment><USER13> They appear to give out accreditation to massage schools, schools of "hair design", and so forth. I don't know that they reached a new low or anything. Homeland Security didn't appear to arrest any students, just the brokers. However, they did appear to let the students get screwed out of their time and money, and then deport them.

</comment></comment></comment></comment><comment><USER14> I never went to high school, and this option doesn't really exist in many sites and forms on the web. It is what it is.

<comment><USER15> Side note: how did you not go to high school and end up in tech(assuming here), just curious, you don't have to answer of course :-)

<comment><USER16> I did the same thing; never finished Grade 10. Had been playing with coding since I was 5 [1]. Always knew one day I'd "do something with computers". My dad wrote one of the first books on the Internet in '92 so I got some good exposure somewhat early. Moved to a third world country at 15 cause they didn't card for booze. Ended up with some web site contracts, and kept diving deeper until I was a "real" programmer (not just web/CRUD stuff - but high perf, high-scale, life-critical, reversing, etc.).

It was only hard for the first little bit. No one takes a 17-yr-old seriously. But I had a 24-yr-old business partner and that helped. I managed to get a speaking slot at a 300+ person business conference and picked up some solid clients that built portfolio. Plus it was 2000, so a whiz-kid-Internet-thing had some sort of cachet perhaps.

I already had a real career and some recognition by the time I would have graduated, so, eh, it worked out and was fun. Though I do regret not knowing maths and not having taken really solid algorithms classes (OTOH, no guarantee I'd have gone to a real school - might have gotten fake CS classes like so many end up with). And I wonder what kind of connections I might have made if I had stayed with it, especially staying in the US.

1: Most elaborate thing was designing a fake grade tracking program (demo) to convince other kids I had hacked the school's systems (hint: they used paper) and could change their grades.

<comment><USER17> which book?

<comment><USER16> "Fundamentals of Database Systems". Hashing schemes and so on. I thought I had come up with some neat stuff, it seemed to work real fast, showed my diagrams to a friend and he showed me identical ones from his classes.

Edit: Sorry I had made an edit and was referring to another book. The book my dad wrote was called NetPower. Was a collection of links, gopher servers, etc.

<comment><USER18> Is it the one by Navathe and Elmasri or a different one?

<comment><USER16> Yep that one.

Edit sorry. I thought the question was talking about an edit I made before where I mentioned another book.

<comment><USER18> No worries. I took a look at your github, etc and you didn't look like either Navathe or Elmasri's kid :) Congrats on setting an example for others!

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER19> Dammnit Linkedin, all you do is let recruiters spam me.

<comment><USER20> They do a lot more than that - e.g. they scan all your contacts so they can spam them as well.

<comment><USER10> Only if you grant them access. It's not required to use LinkedIn.

<comment><USER21> Erm, nope. Unfortunately, I downloaded the iOS app before Apple finally stopped their annoying "growth hack" by introducing a permission for accessing the contact list.

To this day, I still have ex-girlfriends, one-time ridesharing buddies and even some fictuous people "waiting to connect with me" on LinkedIn.

<comment><USER10> Not sure when you downloaded it but the contacts permission was added under iOS 6 in 2012.

[http://www.imore.com/how-restrict-apps-access-your- contacts-...](http://www.imore.com/how-restrict-apps-access-your-contacts- iphone-and-ipad-under-ios-6)

</comment></comment></comment></comment></comment><comment><USER22> Is a 100% filled in linked in profile something to strive for? It seems like the poster has chosen an arbitrary goal, then seeks to manipulate the goal so he can finish it. Why not just choose a different goal?

<comment><USER13> He was complaining about the LinkedIn UI, and probably things like email, that would constantly complain about it being unfinished.

They've moved away from percentages, but it still nags you: [http://imgur.com/a/vVOdv](http://imgur.com/a/vVOdv)

Note there's a "NOT NOW" button, but no "NOT EVER" button.

</comment></comment><comment><USER23> If liked-in does not make your "percent complete" available to others then who cares? If it does, that could be bad because people will think "this guy didn't bother..."

So what is the answer to this?

<comment><USER24> Add a custom stylesheet that removes the warning? ;)

</comment></comment><comment><USER25> It's not about LinkedIn. Apparently companies today don't care about your work or skills. All they want is a dog that is trained to obey. School education is part of that. Questions like "Where do you see yourself in 5 years?" are a sign towards that direction.

</comment><comment><USER26> Holy shit, posted in 2009 and still no change. I see this every time I'm on LinkedIn--I hate it. Still nowhere for me to add my book (sure, publications, but it will drown under more recent talks and papers), but it can harass me about my non-existent schooling.

What would be the harm in making the widgets modular and more customizable? I'm not asking for CSS, but let me completely remove sections that don't apply, and add new generic ones as I see fit.

</comment><comment><USER27> I just put "School of Hard Knocks" on my LinkedIn and leave it at that. If that's unacceptable to a prospective employer, I've successfully weeded out a bad fit.

So far it hasn't been.

</comment><comment><USER28> For eduction I put down "Various" \- that seemed to work.

</comment><comment><USER29> I put down the school that I attended, but no mention of a degree. Do they still let you do that?

<comment><USER30> They let you, but then nag at you to fill in more details. It doesn't get you to 100%.

</comment></comment><comment><USER31> Meh. I don't need LinkedIn to judge or validate my life achievements.

</comment><comment><USER32> I recommmend avoiding it entirely. That has worked well for me so far.

<comment><USER24> How do you deal with the email invites? I'm thinking of making a filter to auto-delete them.

<comment><USER10> Settings > Communications > Emails in the iOS app

You can turn them all off.</comment></comment></comment>


The Elements of Clunk - <AUTHOR> http://chronicle.com/article/The-Elements-of-Clunk/125757/

<comment><USER2> Bah, Humbug! This is the worst kind of High School English teacher nit- picking. -1 point for an upside-down period! I exagerate, but only slightly. The distinction this pollyanna made between a plural and a singular pronoun for referring to a team or group proves it beyond a doubt!</comment>


Ask HN: Desktop sharing for Linux as simple as join.me? - <AUTHOR> join.me is a quick and easy service for desktop sharing. I didn't realize until today that it doesn't work for Linux desktops.<p>Is there a Linux-friendly alternative which HN readers can recommend? <comment><AUTHOR> I just found this on wikipedia:

[http://en.wikipedia.org/wiki/Desktop_sharing](http://en.wikipedia.org/wiki/Desktop_sharing)

I didn't think to search there previously... Mikogo and TeamViewer look like good options for non-commercial usage, and I will be investigating both in short order.

</comment><comment><USER2> Chrome Remote Desktop has a Linux beta version available.

</comment><comment><USER3> I've used TeamViewer 6, try it out

</comment><comment><USER4> Screenleap

<comment><AUTHOR> Thanks for the suggestion, but it doesn't offer "remote control" which is one of the features I need.

<comment><USER4> ah ya sorry, it's just for screen sharing. best of luck!</comment></comment></comment>


Why Did Human History Unfold Differently On Different Continents? - <AUTHOR> http://www.edge.org/3rd_culture/diamond/diamond_p1.html

<comment><USER2> This is from 1997. Lots more info if you read Diamond's _Guns, Germs and Steel_.</comment>


A Monk Who Left the Monastery to Fix Broken Retirement Plans - <AUTHOR> https://mobile.nytimes.com/2017/06/09/your-money/monk-who-fixes-broken-retirement-plans.html <comment><USER2> I saw this story going around on Reddit. This guy is getting an amazing amount of free press.

I went straight to being a financial advisor right out of undergrad. Instead of going to the big city, I went back to my hometown to fix people's retirement plans.

(I sold insurance, investments, financial planning, and advice services. Then I managed other people's money as I went back to school, spending a year in a Finance PhD program then doing my MBA instead. Now I'm a developer in finance.)

There are a lot of good-hearted people out there trying to fix people's retirement plans. I imagine most of them are quite envious of this guy's free press.

The leading industry certification is Certified Financial Planner (CFP). There are others. (I'm studying for the Chartered Financial Analyst, CFA, designation, which is more generally about analyzing and managing investments.)

We do need more people to pay attention to their financial planning. I think our economy will become stronger if more people would save more, spend less, and invest in things that last and grow.

<comment><USER3> > save more, spend less, and invest in things that last and grow

That's the basic formula for retirement saving in a nutshell. I'd wager that most people grasp the logic of this formula at a basic level without a formal education in investing, or needing to pay for a financial advisor.

What people (myself included) lack is the discipline to save more + spend less, and the accounting skills + access to information required to make informed investment decisions and to create/manage balanced portfolios.

The rise of the index fund has been helpful...but investing is still an extremely opaque process at best. One of the more recent examples is the death of the intuitive link between "buy low, sell high" AKA "value investing"[1] that has a bunch of GS investors scratching their heads. If this basic economic link starts to break down...how can people with already limited financial knowledge make smart investment decisions? Or is buying the index really the way forward, until another market correction?

Are you seeing any interesting companies in the space that are working on solving these basic problems, or working in this space yourself? As a 24 year old I'd be interested to hear how the industry is evolving to accommodate younger investors that are just starting out on the retirement path.

[1] [https://www.bloomberg.com/news/articles/2017-06-08/goldman-s...](https://www.bloomberg.com/news/articles/2017-06-08/goldman- sachs-mulls-death-of-value-investing-after-losing-decade)

<comment><USER4> Don't make smart decisions. Sign onto Vanguard, set up autoinvest, and forget you ever did.

<comment><USER5> Theoretically, can Vanguard ever go down? As in a major everything crash?

<comment><USER4> Of course. So buy a target date fund to reduce your exposure as it becomes time to retire.

</comment></comment></comment></comment></comment><comment><USER6> I recently got to take a retirement finances course from the local Society for Financial Awareness (SOFA [1]) person. They're totally non-profit, the classes are free, and (as was the case with the guy who taught the classes I took) they can't reveal who they work for, if it's in the financial arena.

The classes were informative, and covered a lot of things I hadn't taken into account for retirement. So I recommend them highly... as is said in the article above, many people are lazy about preparing. It's worth fixing that now, wherever you are with respect to retirement.

[1] [http://www.sofausa.org](http://www.sofausa.org)

<comment><USER7> Can you give examples of something you hadn't considered?

<comment><USER8> The primary thing taught about retirement planning is the power of compound interest. And creating a budget to save enough to live x years on money in low yield low risk bonds.

</comment></comment></comment><comment><USER9> Helping people with retirement planning is surely an important calling. The broken promises that are already in the pipeline will shake the developed world to its foundation.

I hope Mr. Lynam is also honest with his clients about the big picture. Developed countries have stagnant productivity growth and falling populations. There is no way everyone can squeeze a comfortable retirement from that stone. For many people at this late stage in the game all they can do is reduce their expectations.

</comment><comment><USER10> One story, from a book called "Tales of a Magic Monastery," describes a parish priest on retreat who seeks guidance from a monk about his own spiritual life. His response comes in the form of a question: What do they need?

 _Brilliant!_

</comment><comment><USER11> >Every person who arrived with a spiritual issue had a financial problem lurking somewhere beneath it.

Other studies have shown a strong inverse relationship between financial success and belief in religion.

</comment><comment><USER12> Dear NYT,

Please let me zoom your articles on my Android tablet, my eyes aren't what they used to be.

Thx

<comment><USER7> Fyi Chrome accessibility settings has an option to force zoom-in on websites that disallow it (as well as an option to force a minimum font size). Happy trails to you</comment></comment>


Fort 5.5 - <AUTHOR>

I'm proud to announce Fort 5.5 release.
-Directory encryption support.
-Windows 8 is now officially supported and Fort is 100%  compatible with it.
-Vault no longer displays files that do not exists.
-Vault view no longer decrypt files unless "Decrypt all" is clicked.
Several stability fixes for the encryption engine. Standard version of Fort is also now freeware. Official explorer extension and support is available for $14.90.
Also, there is now community forums available. Enjoy.
For more see http://byteptr.com/fort/ <comment><AUTHOR> Oh, I'm sorry. I'm not familiar with HN formatting.

<comment><AUTHOR> Ok somewhat better now.</comment></comment>


Ask HN: How do you monitor financial markets? - <AUTHOR> Hi HN,
How do you monitor financial markets?
I used to have a Bloomberg Terminal license at my previous job. Now that is gone, I lack a good tool to monitor markets (like WEI<Go>/WB<Go>/GMM<Go>). Or something similar to the launchpad?
Which app/website do you guys use?
Thank you,
Maxime. <comment><USER2> Koyfin is decent. It does not have good terminal commands like BBG unfortunately. It is surprising that no good extensible alternatives exist, but I suppose this is part of Bloomberg's cachet. I used BBG at Goldman when I was working in agency CMO structuring and it is definitely powerful, but I found it a little annoying that there was no API I could write scripts against. I moved laterally from technology to trading and there was massive hesitance from partners higher up to allow lateral moves to still have developer access in general, so that was an unfortunate situation all around.

<comment><AUTHOR> Thanks, I will check it out. There are a few python wrappers around Bloomberg APIs. For example: [https://github.com/kyuni22/pybbg](https://github.com/kyuni22/pybbg). It mimicks the Bloomberg Excel formulas (BDP, BDH, BDS). Quite powerfull. But you can hit the daily limit easily (500,000 data points per day max). They released the Bloomberg Query Language (BQL) that you can use to make larger queries. But not all FLDS fields are available yet... They also provide BQNT, a jupyter notebook where you can run BQL queries and share "apps" with your colleagues.

</comment></comment><comment><USER3> If you have an Interactive Brokers account (real money or test) you can use Traders Workstation, and IB also has an API that lets you pull data. There is an active mailing list [https://groups.io/g/twsapi](https://groups.io/g/twsapi) .</comment>


Spainish Study Confirms Hemp Oil Cures Cancer without Side Effects - <AUTHOR> http://www.endalldisease.com/spain-study-confirms-hemp-oil-cures-cancer-without-side-effects/ <comment><USER2> This is a terrible article. It is sensationalist. It is undated. When it finally gets round to quoting a scientist, the quote undermines the certainty in the headline: "[cannabis] _may offer_ a _new road_ to therapy against lung cancer". It is full of references to absent footnotes.

Much of the text is lifted directly from a "source" link at the bottom. That document is also full of references to absent footnotes.

This isn't even up to the low standards of the Daily Mail.</comment>


Ask HN: when do SSDs become cost-effective for home media server?s - <AUTHOR>

I just replaced a 1.5 TB disc in my home RAID1. It cost me about hundred dollars. At what point should I consider changing out to SSDs?<p>Presumably the chassis and motherboard, Which have been running since 2003, are okay indefinitely, Except the whole point is power savings. I guess there are power questions from the CPU, A 3 GHz Pentium something, and the disks. Possibly also the power supply if it is spending too much on conversion. <comment><USER3> I don't think they ever make sense, at least not in the near future - <USER2> center is a perfect workload for spinning disk - big files and sequential access. You can have 10X the storage cheaper than in an SSD and do a 3-way mirror for redundancy. Power is cheap.</comment>


Tom Dale and Yehuda Katz's Pairing Setup - <AUTHOR> http://tomdale.net/2012/01/tildes-pairing-setup/

<comment><USER2> At the risk of adding very little, I'll say that I just got that same 3.4GHz iMac at work (with just the SSD) and it has RUINED me on everything else. It's the best computer I've ever used, including and since my Commodore 64.

</comment><comment><USER3> Is pairing efficient when the two developers use different editors (or even different keybindings)? I feel my IQ drop by 30 points when I can't use my customized Emacs and I dont know if the benefits of pairing are enough to counter this.

<comment><USER4> Given a sufficiently large monitor, it's fine. I (Emacs user) routinely pair with a Vim-using coworker; we just put Emacs on one half of the screen and Vim on the other.

The only thing you need after that is for both editors to automatically refresh when a file changes on disk. With Emacs, you can get that with "(global-auto-revert-mode 1)" in your init.el. You can make Vim auto-refresh too, though I'm not sure how.

<comment><USER5> :set autoread

</comment></comment></comment><comment><USER6> The key bit of information that was missed from the piece is that, I'm guessing, the iMac is linked up _in mirror mode_ to the Thunderbolt display on the other person's desk... so they are each seeing the same thing on their own computer.

From the photo it wasn't clear if one person had the iMac and the other had a MacBook plugged into the Thunderbolt display -- which left me wondering how they were actually pair-programming.

<comment><USER7> Updated to be more clear; thanks!

</comment></comment><comment><USER8> How many startups here use pairing? Anecdotal evidence tells me its mostly used by consultancies (Pivotal Labs and Hashrocket are others that come to mind).

<comment><USER9> That is because pairing helps mitigate risks (human error), when you're being paid to build software no client like to pay for bug fixing, they would rather pay a bit more to make sure there are less errors (or at least appear more bug free).

If you're a bootstrapped start-up, it is not an efficient use of time to be pairing 100% of the time. We tend to only pair on 'core' parts of apps or 'hard' problems, or when someone needs another pair of eyes on something (two heads etc), otherwise clients budgets are quickly exhausted on pairing for pairing's sake.

</comment></comment><comment><USER10> Ah, this finally explains those Ember-commits by a guy called 'tomhuda'!

Btw, I love that slight Statler/Waldorf-vibe in your story, i.e. running vim with two file-browsers because you can't agree on one. ;-)</comment>


...and people are still using java? - <AUTHOR> http://www.eiffelroom.org/blog/manus_eiffel/and_people_are_still_using_java <comment><USER2> Does one have to know all of the pathological corner cases in language X in order to be allowed to state "I know X" without being categorically wrong? Does the fact that it is possible write funny little gotchas in language X make a point about the inferiority of X?

<comment><USER3> There aren't any "corner cases" or "gotchas" in these examples. I even fed the examples to javac to confirm my answers. Just to see if something changes, I then translated the examples to Python, and found that Python does exactly the same thing as Java. It's really, really simple stuff, and anyone who ever wrote a "finally" clause to clean up a file handle should understand it.

So the author's assertion, that most people in his audience had no idea what that code does, really just shows that his audience consisted of idiots.

<comment><USER4> The audience was mostly full of professors and PhD students, I would not call them idiots.

</comment></comment></comment><comment><USER5> People still use COBOL, it has its place. Can I write something faster that is more maintainable and readable in a different language? Yes. does it matter? Depends on the situation. That said, this article is really just picking on some odd cases which anyone can do in about any language.

<comment><USER4> Actually that the point of the article, not all languages are equivalent on this front. Some have more than others. My claim is that Eiffel is a language with very few of those.

</comment></comment><comment><USER6> This seems to basically be bitching about 'finally' (which is a perfectly legitimate thing to bitch about) -- but finally isn't java specific it also exists in JavaScript, C#, Delphi, and quite a few others (strangely however not C++, who'd have thunk it :D )

<comment><USER4> Actually C# is much better than Java in this area.

</comment></comment><comment><USER7> "That's why I use Eiffel."

This is just Eiffel propaganda.

<comment><USER4> What do you expect? It was posted in a forum for an Eiffel audience. It is beyond my control that someone posted the link here.</comment></comment>


Lavabit code open sourced - <AUTHOR> https://github.com/lavabit <comment><USER2> I never read the closing letter and it is quite unnerving.

"If my experience serves any purpose, it is to illustrate what most already know: our courts must not be allowed to consider matters of great importance in secret, lest we find ourselves summarily deprived of meaningful due process. If we allow our government to continue operating in secret, it is only a matter of time before you or a loved one find yourself in a position like I was – standing in a secret courtroom, alone, and without any of the unalienable rights that are supposed to protect us from an abuse of the state's authority."

<comment><USER3> What is the closing letter? Can you give a link?

Edit: Found the source. Link is: [http://lavabit.com/](http://lavabit.com/)

<comment><USER4> I was also looking for it, thx

</comment></comment></comment><comment><USER5> A number of comments in this thread appear to suggest that Lavabit was end-to- end encrypted. It was not.

[https://moxie.org/blog/lavabit-critique/](https://moxie.org/blog/lavabit- critique/)

<comment><USER6> What does end-to-end mean encrypted mean?

<comment><USER7> It means that if Alice sends a message to Bob, that message is encrypted with a key that only Bob (or Alice) knows. No server in between them can read the message, so the question of whether they _trust_ the server doesn't matter very much.

</comment></comment></comment><comment><USER8> It's not the original Lavabit, but dark mail.

<comment><USER9> Where's the original Lavabit?

<comment><USER10> I would imagine a stipulation of the original subpoena would involve not sharing the source of Lavabit. It sounds as though what Ladar has done is re- engineer Lavabit in the form of Dark Mail to bypass any gag orders.

<comment><USER11> I don't it. LE should love a fundamentally insecure design like Lavabit to get picked up.

When I looked at the Dark Mail draft it was incompatible with regular email. And the trust models it has were basically the same as you'd get with Gmail today. End to end remained difficult (of course).

Plus it has weird stuff. Like a field for political party on all contacts or something.

</comment></comment></comment></comment><comment><USER12> Curious: what would happen if a bunch of these popped up all over the place and used end to end encryption between each other making email truly secure between each other? Would such a thing be possible? Adopt Mega's model where they store the private key, but encrypt it with the user's password and only the browser has the decrypted copy.

<comment><USER13> > Adopt Mega's model where they store the private key, but encrypt it with the > user's password and only the browser has the decrypted copy.

Unless you're going to audit every single line of code Mega uses on their site every time you use it, that would leave you completely vulnerable to any backdoor included in the code (because of a court order or a $5 wrench).

Secure E2E Web Crypto is a myth.

<comment><USER14> "Secure" anything is a myth, it's about what levels of risk you are willing to accept.

The bottom line is that yes, this sort of setup would be worse than PGP email, but it would still be better than traditional web mail which the vast majority of people use.

 _On an interesting aside:_ You don't have to audit the code every single time. On first execution of the code, it can store itself in the browser's application cache indefinitely, and manage upgrades in the same style as traditional software. This is fairly new ground though :)

<comment><USER15> > store itself in the browser's application cache

That _may_ solve some of the distribution problems, but no browser-based software can ever be truly secure for a different reason: you have to run the crypto in the same process as the network and parsing code. All browsers have a history of security issues and other bugs in these areas. We should be minimizing attack surface, but browser designers instead decided to add more features that inevitably lead to more bugs.

The browser is an incredible "weird machine"[1], and relying on them for security requires believing that nobody will figure out how to program that "weird machine". The solution is something in the style of the "agent" programs[2] for ssh/gpg. The crypto - especially the private keys - must be done in an isolated process, so buffer-overflows and parser bugs at worst leak only the current data. If the crypto is handled in the browser itself, there is always risk that a bug will allow the keys to be leaked.

[1] [https://media.ccc.de/v/28c3-4763-en- the_science_of_insecurit...](https://media.ccc.de/v/28c3-4763-en- the_science_of_insecurity)

[2] ssh-agent(1), gpg-agent(1)

<comment><USER16> True, browser is more and more looking like a regular OS which executes untrusted programs. As far as security is concerned though I am hoping Servo will solve most of the issues.

</comment></comment></comment></comment></comment><comment><USER17> I've seen some opensource implementations of Protonmail's stuff, any comparisons?

</comment><comment><USER18> so what happens if you run this on Amazon (or any other cloud provider that would cooperate with govt intrusion)? do you need your own servers to make it work as intended?

</comment><comment><USER19> Fun. Don't believe that an open source version of Magma makes it more secure. It just means this version you see is one that looks like the one used on a server. What is actually on the server may not be the version you see in a public repository. Thanks for sharing Magma!

</comment><comment><USER20> can anyone speak to the value of the DIME spec?

[https://darkmail.info/downloads/dark-internet-mail- environme...](https://darkmail.info/downloads/dark-internet-mail-environment- march-2015.pdf)

<comment><USER21> Relies on DNSSEC or CA to validate keys (pp. 22). Not a good idea of your threat model is governments.

Defines fairly arbitrary list of non-extensible metadata including gender, alma mater & political party (pp. 60). Seems like this should be extensible and predefining a lot of that is short-sighted.

</comment></comment><comment><USER22> I have no clue how this works but could people not just host their server outside the jurisdiction of these assholes?

<comment><USER19> No. Jurisdication is irrelevant. The transmission has to pass through local jurisdiction servers and wire and thus falls prey to those laws. Hosting in Aruba for your US customers does not provide any veil of safety from prosecution.

</comment></comment><comment><USER23> the repo wasn't public before?

</comment><comment><USER24> So Ladar Levinson closed his company because he refused to provide a backdoor to his customers email encryption ?

This seems similar to the Apple case, was Tim Cook just too big to bully ?

Snowden had his own encryption or used GPG so a Lavabit backdoor encryption key would not lower the entropy of Snowden's encryted emails.

Was Levinson's gag order lifted ? Why did Lavabit have to close but Apple didn't ?

[EDIT] Levison was not jailed.

<comment><USER25> Ladar Levinson was never arrested or jailed, and he chose (to his credit) to shut down his own company instead of complying with a court order.

<comment><USER11> He complied with previous warrants, right? And since he didn't use PFS, when he finally did hand over his key, it put all previous requests at risk. The problem was representing more security then he actually had.

<comment><USER26> The security provided was fully within the threat model presented, which never considered this type of attack.</comment></comment></comment></comment>