I know someone whose 2-factor phone authentication was hacked...  - <AUTHOR> http://williamedwardscoder.tumblr.com/post/24949768311/i-know-someone-whose-2-factor-phone-authentication-was <comment><USER3> I use the Google Authenticator app, which makes the token only available to that specific device, rather than through SMS. This gets around the problem of cloning a phone number.

iOS: [http://itunes.apple.com/us/app/google- authenticator/id388497...](http://itunes.apple.com/us/app/google- authenticator/id388497605?mt=8)

Android: [https://play.google.com/store/apps/details?id=com.google.and...](https://play.google.com/store/apps/details?id=com.google.android.apps.authenticator2&hl=en)

<comment><USER4> I use this too, but I don't think it actually prevents the attack described in the article, at least in my case. When I setup my 2-factor auth for my Google account, I also setup a series of backups in case I lost access to my phone. One of them was my phone number, and another was a phone number of a trusted friend.

<comment><USER5> It prevents human engineering of the phone company. One might hope that Google would be better at the security implementation (i.e. the BT operator apparently "validated" an incorrect password, which indicates to me that it was a quick hack, probably just a field in the customer record about which the operators weren't trained).

Also: I'd hope that Google wouldn't allow a complete account reset based solely on the backup device. That should be a backup for your second factor only, you should still need the password.

</comment></comment></comment><comment><USER6> Something like the Google Authenticator App instead of an SMS would remove the phone company from the equation, also my bank gives me an actual device on which I have to punch my code in to log into my bank account. These remove allot of the social engineering options that thieves have.

</comment><comment><USER7> _It annoys me that a trick is missed with the secure fob. Imagine that: the challenge screen includes the amount you are authorising and you type that amount into your secure fob along with the challenge code_

That's basically how the auth works on with my online bank. I get a small calculator sized device that reads my debit card. I have to enter the card pin, a challenge code from the online transaction, and the amount - which then gives me a code to authorise the online transaction.

(The downside is that the devices are all identical - so anybody with one + a cloned card + my stolen login info can auth transactions - hey ho...)

<comment><USER8> That is beyond stupid. Why not have different signing/encryption keys on the individual fobs?

<comment><USER9> Would you even trust the lowest-bidder factory where the card readers are made?

<comment><USER7> The factory isn't really an additional risk.

There's not a networked man-in-the-middle attack via the readers (they're not connected devices). You can't change the algorithm (it needs to be the same one implemented by the online bank). The algorithm is already essentially public (the devices are identical and widespread).

Pwning the factory doesn't really give an attacker an advantage.

</comment></comment></comment></comment><comment><USER10> Two factor authentication is still, in my opinion, the strongest way to go. This case is really the phone company's fault, maybe they'll learn from this and start teaching the customer support reps what the difference is between a correct password and an incorrect password.

<comment><USER11> (TL;DR at bottom)

I see a lot of hacks of voice mails and then requests for Google to use the second factor to reset the account...all by baddies. Who then proceed to take over the account.

So, it seems to me that it's worse than having no second factor at all.

After all, why is it stronger to use two factors than just using a strong password from your laptop or personal devices - without ANY backup contact information or second factor linked to the Google account? Hear me out.

Most people who are 'targets' (consider a millionaire VC who gets his contact details out a lot) are already far more compromised if their computer (personal laptop) has a keylogger or remote screen software (backdoors) by someone who knows who this person is, targetted the laptop they do all their work and most of their shopping on, and has gotten in. usually this hasn't happened. if this HASN'T happened, typing the password on that laptop via https is secure and doesn't allow anyone to get in. So, we have a stepwise function:

      ^
      |
      |
      |                                  you've been targeted and rooted: they can keylog
      |                                  and do A N Y T H I N G in your name from machine
     R|                                </comment></comment><comment></comment><comment></comment><comment></comment><comment></comment><comment></comment><comment></comment><comment></comment><comment>->
     i|                               |
     s|                               |
     k|                               |
      |                               |
     o|                               |
     f|                               |
      |                               |
     p|                               |
     a|                               |
     i|                               |
     n|                               |
      |                               |
      //                              //
      |                               |
      |                               |
      |                               |
      | (few people know it's your    |
      | laptop, none has rooted it)   |
      -</comment><comment></comment><comment></comment><comment></comment><comment></comment><comment>==</comment><comment></comment><comment></comment><comment></comment><comment></comment><comment></comment><comment></comment><comment></comment><comment>->
                           Level you are breached

so either someone is in looking over your shoulder (which a lot of people would like to be doing when you're a target)... and can remote control/ do stuff in your name (perhaps when you're not using the computer), keylog and basically do anything you can do or have been doing....

 _or_ nobody is in yet. (Except as general malware that doesn't know who you are, nobody is remote controlling/keylogging you and checking those files.)

This is MOST of the cases - how do you even know which of millions of computers out there that are 'mostly secure' except against a targeted attack with a lot of known information about the laptop target, is the one that belongs to this millionaire VC? They'd have to look through millions of computers to find him or her...

I'm not talking about a botnet you're part of that has millions of users. I'm talking about someone targeting you.

So, it's basically vulnerability exposure is a STEP function, with a function that goes from "no remote keylogging; even though I'm important no one knows my computer's mac address or what software it's running" at x = 0 to whatever, with a corresponding horizontal y value of "low level of exposure", to, at the next step, "a keylogger is installed on my computer" having a HUGE jump in exposure rating to "totally fucked since now they have my every credit card, can see my every email, etc etc etc. They can just watch over my network and whenever I make a purchase, also make themselves a purchase."

Since Google services can be accessed via https, between those two steps, aren't you "safe as long as no one is getting into your computer since they don't even know this computer belongs to a strong target?"

But with the second factor, you're adding a step there between that stepwise leap:

-> Someone's figured out my phone number; now if they can hack my voice mail they can get Google to send a reset code to it, get the reset code, and take over my account.

The point is: WITHOUT breaching the original second step (i.e. even finding out what physical mac address or, at a given time, IP address, belongs to 'you', or what hardware and software you're even running.)

Your email address and phone number you use, meanwhile is in some sense 'totally public' as that is where you're MEANT to be reached. Both of those things are things that you give out willy-nilly, unlike any information about which computer in America is yours.

So it seems to me that not introducing an insecurity step between step 0 and step 1 would be a good solution: use a secure password, don't write it down anywhere, and use it from computers which aren't especially linked to you or particularly 'tainted'.

why make yourself a target with hackable 2-factor authentication?

 _TL;DR: your phone number is supposed to be public, your email is supposed to be public, the phone company is not a security token. Don't use the second Google factor._

<comment><USER12> 2FA using phone calls/SMS is basically lameness (similar to KBA; it protects against huge numbers of users with bad passwords being a vulnerability to the bank, and is a cheap compliance step, but provides no additional security to a targeted victim).

Overarching all of this, there's a great opportunity to fix things in the desktop -> mobile transition; desktop OS security is IMO a lost cause, but mobile started from a much better place AND is progressing well.

2FA using a physical token, or, better, some kind of key storage device + secure I/O (to unlock and verify), reasonable increase in security.

2FA using a software application on a phone paired to your laptop (and hence having full ability to extract data, etc.) is somewhere in between -- implementation details and use case. Requiring two distinct devices does help (especially if one is stolen but not the other), but over time, people will move to mobile-only with some kind of cloud syncing, so it will make less sense.

The ideal is still something built into a mobile OS with hardware protection (e.g. iOS Keystore), storing either random long string passwords or some kind of public key credential, and either a trustable network proxy converting that to standard username/password to log into sites, or sites adopting this as a means of authentication (client cert auth sucked a lot in the past, true, but it doesn't have to suck).

Then, all your identity/presence (biometric, geofencing, heuristics, ...), backup, key recovery, etc. could be handled in one place, by one API.

That's what I was hoping Apple would do with Passbook/iOS6/iCloud, but doesn't appear to be anything they care about. Only Apple could build this (due to how the platform works, you can't override things), since every app would need to use the API, and web browsing (via Safari) would be 90% of the use. Unfortunately Android has no platform security (and anything would be 2-3 years away, once MTM is available), BB is dead, BB10 is stillborn, and WP doesn't seem to care.

<comment><USER13> Apple cares too much about user experience than to foist this type of inanity on users.

<comment><USER12> Single-Signon is basically universally regarded as the ideal user experience.

Enter your passcode (or otherwise ID yourself to the device), and then everything "just works", with no need to remember or type passwords to every single site. Apple's already perfectly content to consider iPads and iPhones single-user devices, and with OS X, you can have multiple user logins with fast user switching.

</comment></comment></comment></comment><comment><USER14> I'm a pretty big fan of the rolling token 2-factor authentication model, with the app on your phone presenting you the rolling token. The Blizzard login app is the biggest single example that comes to mind. SMS really isn't secure, I think something like this could be a good next step to phase in.

<comment><USER15> This is the same as the Google Authenticator app that people are talking about.

<comment><USER16> The thing that bugs me about this model is that it's not challenge-response, so someone can play man-in-the-middle.

While it's possible to hijack someone's phone number, as demonstrated, it requires a relatively high amount of effort per target. Whereas if you compromise a network segment somewhere (with DNS and a rogue SSL cert or whatever you need), you could just sit there, farming authentication cookies. Have your MitM check the "authenticate this computer for 30 days" checkbox and you've got a nice little collection to work with.

<comment><USER14> Are you familiar with methods that are resilient in the face of MitM attacks?

</comment></comment></comment></comment><comment><USER17> I hate to use the cliché, but: weakest link. SMS and dial-back systems rely on the security of the telco, who are dis-incented to secure their users' accounts. These systems do not use encryption! Of course they are going to get owned.

</comment><comment><USER18> I wonder how much publicity this type of breach is getting outside of the HN bubble? I'd guess not a lot because I still have many friends that act like I'm paranoid just for using 2-factor at all.

At some point though, shouldn't phone companies notice and beef up their end a little bit. Maybe we need another large phone hacking scandal to really lock down answering machine security. [http://en.wikipedia.org/wiki/News_International_phone_hackin...](http://en.wikipedia.org/wiki/News_International_phone_hacking_scandal)

</comment><comment><USER19> If RSA 2-factor tokens can be hacked (or "stolen" I guess, but the effect is the same), there's not much hope for the rest of us. Still a whole lot better than not doing 2 factor.

<comment><USER20> The attack was on a phone call message for 2-factor authentication "Your one time password is XXXXXX. Please use this to login now" not an RSA token.

<comment><USER21> I believe the OP is referring to <http://www.finextra.com/news/fullstory.aspx?newsitemid=22375>

<comment><USER22> The point of multi-factor authentication is _not_ that the additional factors are infallible. Rather, the point is, when one factor fails, there remain other factors still in place.

When RSA was compromised, accounts in which RSA was used as an additional factor remained protected by their remaining uncompromised factors - <USER2> time to replace the RSA factor.

</comment></comment></comment></comment><comment><USER23> Wish he had stated which UK bank since most of the ones I am aware of use 2-factor authentication using a card reader device. They even seem to use an identical card reader!

<comment><USER24> I looked into this a while ago and I believe that Lloyds TSB must be the bank as it uses telephone authentication as follows: [http://www.lloydstsb.com/security/security_improvements_we_h...](http://www.lloydstsb.com/security/security_improvements_we_have_made.asp?wt.ac=SECX70411)

"When you set up a new payment, we'll give you a call to ensure that the instruction is coming from you.

Step-by-step payment security:

All you need is a telephone near you. You'll be able to choose which number we call you on, provided it's a number we already hold for you.

You'll receive an automated call asking you to confirm details about your transaction.

Then you'll need to enter a four digit number that will appear on your screen into your telephone keypad."

There's a Flash demo of this here: [http://www.lloydstsb.com/new_internet_banking_demo/index.htm...](http://www.lloydstsb.com/new_internet_banking_demo/index.html?ibdm=8)

<comment><USER25> It sounds like LloydsTSB to me too, not only is the process for sending money as above, but you don't need your card to login (there is a User ID number, a password and a "memorable phrase" which you have to give three digits of).

While it's convenient as you don't have to remember the card reader when you want to login, it does worry me that it is less secure and vulnerable to keyloggers.

Edit: Halifax is also the same, but then it is owned by Lloyds and has recently transitioned its backend to the same platform as Lloyds uses.

</comment></comment></comment><comment><USER26> This also underscores why the whole "banking through SMS" is not trustworthy - the telecoms are not banks, and are essentially weak points in the security chain.

The only way to do this properly is certificate-based 2-factor like with Google's Authenticator app.

</comment><comment><USER27> The point is: Nothing is ever truly secure. Do what you can to avoid being the low-hanging fruit and you'll probably be OK.

<comment><USER28> No, I don't think that's the point. The point is more like "something I can access" is not a factor that's as strong as "something I know/am/have".

<comment><AUTHOR> I liked this so much I added it to the article at the bottom :)

<comment><USER28> Thanks!

</comment></comment></comment></comment><comment><USER29> The way it's commonly implemented, two-factor authentication is definitely not "a step in the right direction".

Two-factor authentication using phone numbers is a huge privacy breach, especially when you're dealing with websites that have no business knowing your phone.

And rolling code tokens aren't feasible for anything except some really high- security applications. Even there, I doubt they are really much more secure than a USB stick with your paraphrase-protected private key. Sure, you can't copy the token, but that doesn't just add to security, it detracts from usability.

</comment><comment><USER30> Bcrypt is no longer recommended.

NIST recommends PBKDF2.

In short, it appears that advances in hardware have made it possible such that bcrypt hashes can be efficiently computed.

<http://en.wikipedia.org/wiki/PBKDF2> [http://security.stackexchange.com/questions/4781/do-any- secu...](http://security.stackexchange.com/questions/4781/do-any-security- experts-recommend-bcrypt-for-password-storage)

<comment><USER31> Please read your references...

        The bcrypt key derivation function requires a larger (but
        still fixed) amount of RAM and is slightly stronger
        against such attacks, while the more modern scrypt key
        derivation function can use arbitrarily large amounts of
        memory and is much stronger. (wikipedia)

        Basically they recommend PBKDF2. This does not mean that
        they deem bcrypt insecure; they say nothing at all about
        bcrypt. It just means that NIST deems PBKDF2 "secure
        enough" ... On the other hand, bcrypt comes from Blowfish
        which has never received any kind of NIST blessing (or
        curse). (stackexchange)

The general consensus here over the past few months/years is that bcrypt is good enough, scrypt is probably better, and PBKDF2 is pretty good. And that ALL of them are much better than hashing+salt.

</comment></comment><comment><USER32> django-twostepauth ([https://bitbucket.org/cogni/django- twostepauth/src/79bbf0ce3...](https://bitbucket.org/cogni/django- twostepauth/src/79bbf0ce3af0)) is a Django app that works really well and has an exampleapp that makes it as easy as can be to try out. Setting up TFA with Google's authenticator is a breeze.

Unfortunately, the release of Django 1.4/django-registration 0.8 ([https://bitbucket.org/ubernostrum/django- registration/src/27...](https://bitbucket.org/ubernostrum/django- registration/src/27bccd108cde/docs/upgrade.rst)) complicates matters a bit, and I'm torn between figuring out a way to keep my TFA or just roll it back altogether and implement d-r, and see if it has support for TFA.

If you're using Django 1.3 with something else than the default password- hashing, you should check out django-TSA.

</comment><comment><USER33> Relatedly, it is possible to read the 2FA SMS message on android without pattern unlocking the phone -- it appears in the notification bar briefly.

I don't know whether it amounts to a security vulnerability, but it certainly makes it that little bit weaker.

<comment><USER34> Message previews in the notification bar can be disabled.</comment></comment>


Twitter List for YC Applicants - <AUTHOR>

Congrats to the startups that were chosen by YC to interview. For those of us who are continuing to bootstrap I'd like to take this opportunity to create a network out of the promising entrepreneurs that are still dedicated to making *it happen for their startups.
Please post your Twitter usernames here. I would like to follow you all, and hoping we'll all follow each other. I'll also create a Twitter list from the names posted here.
I'll start...
@wdm954 @taweetcom <comment><USER2> Excellent idea. Thoughtscream Media doesn't even have an official site up yet, at this time - alas, almost certainly one of the many flaws in our application. Oh well, it didn't cost us to make the effort, even if we're so barely starting out, the wheels've barely begun to turn.

Actually, does content format experiments on a /personal/ blog even count as going anywhere right now?

In lieu of getting into a debate about that, our twitter accounts:

@ThoughtScreamM (group) @JCThoughtscream (editor) @SCThoughtscream (technical)

I'll post my audiovisual cofounder's account once I convince him that Twitter's actually worth investing time in.

</comment><comment><USER3> Gridspy - Power monitoring on the web <http://your.gridspy.co.nz/powertech/>

I'm bootstrapping without having applied to YC - We are based in NZ with families so YC not practical. However, I have read every single one of Paul Graham's excellent essays.

@gridspy

</comment><comment><USER4> @optask @euwyn

<http://optask.com> \- Outsourcing on a micro level, give us a ping on twitter (@optask) for some free minutes to try out the service. Get help with marketing grunt work, simple Photoshop work, web research.

</comment><comment><AUTHOR> Here is the list so far...

<http://twitter.com/wdm954/startup-entrepreneurs>

If anyone else wants on post your @username here.

</comment><comment><USER5> @joshOiknine @luisVega @bindder

Connecting your social messaging Site is not up yet but alpha is expected in the next month. bindder.com

</comment><comment><USER6> Nice idea!

@visualizeus : Social bookmarking for pictures

<http://visualizeus.com>

</comment><comment><USER7> Cool!

@flooha - App + addon builder and hosting.

<http://flooha.com>

</comment><comment><USER8> Great idea. This might actually get me to start using Twitter again. I'm @chaosprophet.

</comment><comment><USER9> And for non-YC applicants too. I'm in: @brodlist

</comment><comment><USER10> I like your thinking - @michaeltroy - artsbox.com

</comment><comment> Ye-Ha @BHeard

BHeardUSA.com

#BHeard

<comment> Ye-Ha whoops, embarrassing typo! It's @BHeardUSA on Twitter!

</comment></comment><comment> Ye-Ha How's the list going?

</comment><comment><USER11> Great idea. @pzupan

</comment><comment><USER12> @trekfon

</comment><comment><USER13> @pramit</comment>


Geeking Out on the Logo - <AUTHOR> http://marissamayr.tumblr.com/post/60336044815/geeking-out-on-the-logo <comment><USER3> This is a brilliant move by Marissa Mayer. She knows from experience that having the best of the best (not only in engineering- but also in design, marketing, etc.) is necessary for your success in tech. Large tech companies depend on their employee's pet ideas and projects, the fact that they might be well known in some niche for some open source project or blog, and so on. In a way, if you're a large company that needs to constantly be on top of the latest trends and technologies (because if you're not, the same thing happens to you as happened to Myspace), you're no different than YCombinator - <USER2> that instead of wanting your recruits to start their startup, you want them to run a project for you internally (all of the famous Google projects that originated from 20% projects could have easily been startups of their own).

Through these actions and posts, shes's showing how cool and fun Yahoo! is. Look, the CEO works on weekends with a small skunkworks team on designing logos, and nerds out on the subtle details like any cool designer would do.

This is all about making Yahoo! a desirable place to work at again. I'm receiving way more emails from Yahoo! recruiters these days than Google or Apple recruiters, and they all have a common tone: "check us out, we're fun!".

Similarly, all the small startup acquisitions have 2 goals: poach for talent, and get Techcrunch, HN, Engadget, etc. to talk about Yahoo. (the big acquisition we all talked about was about receiving a mature project internally as a way to make up for lost time)

Of course it's not just this that will bring Yahoo! to victory, but those little things show how much strategy there is in Mayer's execution.

EDIT: finally was in a situation where I could watch the video, and I only feel stronger about my point. Listen to the music (some dubstep/ibiza dance/feel good summer hit hybrid) - this is clearly destined to appeal to the 21 year old Stanford student looking for a new job, not the guy on HN who will criticize anything that makes it to the front page.

<comment><USER4> Her experience and micromanagement apparently produced a logo that looks like it belongs on a web portal framed by IE6's forward thinking UI and appears to have been designed by someone who just figured out that illustrator could do 3d effects.

So, so much for making users think the company has moved beyond its stagnant products. Which in a lot of ways it has, look at the Yahoo weather app for Android, the design is modern and integrates one of Yahoo's rather under leveraged properties: flickr. That was nice design.

As to signals to the best of the best, this blog post confirms both that she will micro manager you and do design by committee simultaneously (a dubious distinction I don't think even Steve Balmer could achieve). And that's the signal if they like the logo.

<comment><USER5> Micromanagement is a management style, not something you do over a weekend. Saying that the CEO micro manages because she's deeply involved with the evolution of her company's brand is a bit silly.

Someone said that Steve Jobs wasn't a micromanager, only a great manager obsessed with details. I guess he should have stayed in his kitchen making sandwiches for his four kids.

<comment><USER6> > Micromanagement is a management style, not something you do over a weekend.

Micromanagement is a _bad_ management style to apply with creative teams. It breaks the creative flow, clouds judgement of quality and adds external pressure to a process that depends on consistent internal drive. You can micromanage accountants, SAP programmers and clerks, but if people like those in design teams or R&D are focused on quality, micromanaging them quickly begins to resemble herding cats.

> Someone said that Steve Jobs wasn't a micromanager, only a great manager > obsessed with details.

Someone said that about Steve Jobs, and his work was of a very different nature. Articulating the concept of personal computing into a product is very much unlike the process of designing the logo, even if they are superficially similar.

<comment><USER7> PG commented about Jobs yesterday re: Google compose. Basically, he argues Steve Jobs is an anomaly in that he can micromanage design without breaking it.

</comment></comment></comment></comment></comment><comment><USER8> Several annoyances here:

1\. Showing hand-drawn versions of your logo in what clearly is set in hardly- modified Optima (a typeface designed way back in the 1950s) makes me cringe. Why show fake process work?

2\. No one is impressed when the manager does the job of their employees. For one, it implies that they don't trust their employees, and secondly, it makes the job of designers look like a fun hobby that anyone can get into. The result is exactly what happened here: an utterly boring logo redesign that looks just-polished-enough to make people think that Marissa Mayer is some kind of genius, yet simple enough to make people think that true designers bring no value to the table.

3\. The whole 30 days of logos schtick was awful. Good artists know that the worst thing you can do for yourself is show _too much_ of your own work. After a while, everything looks same-y and the weaknesses begin to become more apparent. The whole concept reeks of indecision and a pray-to-God moment that one of the logos would have such a huge outpouring of support that the Yahoo! team wouldn't have to make up their own minds on a vision.

4\. The bevel isn't even customized. It's a preset Adobe effect. Pretending like the Y shape in the bevel was intentional is horseshit and obviously a desperate attempt to give some sort of conceptual significance to what is otherwise a completely forgettable design.

<comment><USER9> Totally right. That's why the design by consensus is always wrong. The brand is now biased. MM had a reputation of being intrusive even on silly details making the design process horrible and with crappy results.

From this I remember various things you may remember too:

1\. The Google favicon. They did thousands and the one they choosed was crappiest one. They had to change it later. 2\. The Google favicon with blue. Also, they did silly tests. Now that thing is gone.

I think this post resumes it well [http://stopdesign.com/archive/2009/03/20/goodbye- google.html](http://stopdesign.com/archive/2009/03/20/goodbye-google.html)

</comment></comment><comment><USER10> I've been trying to evaluate this logo under the assumption that the people who are working at Yahoo are smarter than me and have more information than me.

My personal reaction is that I hate the bevel. Hate. I was rooting for #10, which is a simplified and modernized version of their old logo.

But. I'm not a Yahoo user. Period.

The bevel immediately made me think of some brands you'd find on sale at Macy's, which mainstream America associates with quality, but which my artisanal-y brainwashed brain thinks of as mass produced junk.

Imagine for a second that Yahoo has research showing normal people reacting to this logo with words like luxury and high-class.

If that's the case, then Yahoo just pulled an epic branding end run. Google, Apple, and Microsoft are fighting to be the flattest, plainest, more boring brands. Then Yahoo stepped up and said, "Yo. Let's be fabulous together!"

In the old days, Yahoo's skunkworks Brickhouse division had posters in their break room titled "Know your competition" with pictures of Bill Gates, Larry Page, and Sergey Brin. Trying to copy the other tech giants was (one of) Yahoo's problems because the Yahoo teams couldn't celebrate what they were actually doing well.

The contrarian in me salutes Yahoo for this crazy, out of left field, gaudy, off-trend logo. Genius.

<comment><USER11> Being Dutch, I associate the bevel with "American bad taste". Design is sacred here, logo design doubly so. This would be ridiculed.

<comment><USER12> Since when are bevels an American phenomenon? You know that bevel is a French word, right?

<comment><USER13> The origin of a word has ZERO no relevance, how can it? May only French speaking countries be the places where the phenomenon of entrepreneurialism exists, with the phenomenon occurring only to smaller extents in other countries. Invention of a word does not give you the sole or even the greatest entitlement to its meaning.

</comment></comment></comment></comment><comment><USER14> I'd like to point out, for the record, that this "logo design team" consisted of:

\- CEO

\- SVP of "Brand Creative"

\- VP, Creative Director

\- Someone who doesn't seem to exist online, outside of articles about this new logo

\- An intern

You'll notice a distinct lack of _professional designers_ in that list. Apparently this 10 billion dollar brand wasn't important enough to put in the hands of, you know, experts. Instead, they spent a weekend (ONE WEEKEND) "geeking out" over it. Which is definitely the best way to design a global brand.

This is micromanagement at its very worst, and is an insult to the craft of design.

<comment><USER15> Hmmm, while I agree with the sentiment, I don't think it's as simple as putting it in the hands of a "professional".

Simply picking the right designer is something that requires an inordinate amount of taste to start with. People with no taste or feel for design stand a strong chance of picking a poor designer (or agency).

I'll cite Wolf Olins here as my example. Not only is it clear that no one in Wolf Olins seems to have taste or a feel for design, their clients don't seem to have it either. So there's a feedback loop of affirmation as people with no taste reward other people with no taste, which in turns makes other people with no taste think those other people with no taste have taste because all the people they know that they think have taste think those other people have taste.

Meanwhile, the actual people with taste are watching from the sidelines, because they've marginalised themselves by being honest about what is good design and what is bad design, but with a passion that comes across as pedantry and rudeness. So they watch in despair as the whole debacle unfolds in front of them, growing ever more frustrated which serves only to marginalise them even more.

While I'm here... I think almost everything Wolf Olins churns out is sub- stadard slop barely worthy of a fist year national diploma students portfolio. Their work has neither grace, finesse, or charm. It's all cack-handed indulgent arse-gravy of the highest order dipped in a seemingly bottomless ocean of post-rationalisation and I can not believe that people keep lapping it up. It's rank amateur. Their work stinks like shit and I hate them for it.

And there I go, proving my point about why no-one listens to designers.

</comment></comment><comment><USER16> First impressions for me were "They've sterilised the logo!". Now it looks so corporate and planned...

... and I actually laughed when I read _" Our last move was to tilt the exclamation point by 9 degrees, just to add a bit of whimsy"_.

<comment><USER17> It looks like a logo that I would create. My logo creation technique involves typing out the brand name, then selecting whichever stock font installed on my machine most strikes my fancy.

Perhaps the ratios of the bevels and font size contain some hilarious, hidden inside joke for mathematicians which I do not understand.

<comment><USER18> Don't forget to add some bevel or shadow, it would be a waste do let your dangerous Illustrator skills go to waste... :-/

</comment></comment></comment><comment><USER19> > We didn't want to have any straight lines in the logo. Straight lines don't > exist in the human form and are extremely rare in nature, so the human touch > in the logo is that all the lines and forms all have at least a slight > curve.

This reminds me of the design team that tilted the Pepsi logo 10 degrees to show Pepsi was "leaning towards the future." [1]

Is there a rule that says you can't run a company if you see through these sort of lines as utterly laughable?

1\. [http://www.cbsnews.com/8301-505123_162-42740470/pepsis- nonse...](http://www.cbsnews.com/8301-505123_162-42740470/pepsis-nonsensical- logo-redesign-document-1-million-for-this/)

<comment><USER20> The good (well...) news is that the curved lines can't even be seen, when the logo is shrinked :)

<comment><USER19> As a corollary, that must look unnatural and dehumanizing. :)

</comment></comment></comment><comment><USER21> Well done - for a multi billion dollar company, spending a weekend on your logo is about the right ratio of time to value. Looks good enough to be acceptable, can be reused in all the sub projects. Done, now lets get on with real product improvements.

Move on folks, nothing exciting to see here

</comment><comment><USER22> The main problem with this logo is that it sends conflicting messages. On one hand it wants to be funky (differently sized letters, tilted exclamation mark), but on the other it oozes conservative, with its square and straight typeface and lack of color. Overall, 'conservative' clearly beats out 'funky', with the few creative touches clobbered into submission. The larger Y and O, supposed to add dynamism and 'fun', are not different enough to pop and convey that idea. This is particularly jarring with the larger O next to the smaller one at the end - only different enough to confuse, not to send a message.

What's worse is the execution is poor and sloppy. It has no synergy. Notice the horizontal lines in the A and the H at strange 'close-but-not-equal' levels, neither tying into anything else in the logo. The flat foot of the larger Y sets one baseline, but the flat feet of the A and H define another, neither being referenced anywhere else in the logo.

Perhaps I just don't get it. Maybe the amateurism of it _is_ the message, in which case it comes through loud and clear.

</comment><comment><USER23> Geeking out. Another phrase that makes me want to bite my arm off.

<comment> saint-loup And yet, Neal Stephenson made an interesting distinction between "geeking out" and "vegging out":

"To geek out on something means to immerse yourself in its details to an extent that is distinctly abnormal - and to have a good time doing it. To veg out, by contrast, means to enter a passive state and allow sounds and images to wash over you without troubling yourself too much about what it all means."

[http://www.nytimes.com/2005/06/17/opinion/17stephenson.html?...](http://www.nytimes.com/2005/06/17/opinion/17stephenson.html?pagewanted=all&_r=0)

</comment></comment><comment><USER24> The CEO and an intern redesign a $25b company's logo during the weekend. That's news!

Minor nitpick: the logo is looking like a 1-bit alpha GIF on Chrome, due to the downsizing: [http://cl.ly/image/183U1t0l1u3e](http://cl.ly/image/183U1t0l1u3e) (FF on the left)

</comment><comment><USER15> I've designed a few logos in my time. All I see here is post-rationalisation, the last bastion of the cowboy designer trying to justify their costs.

</comment><comment><USER25> Other than GuiA's (currently-on-top) comment, almost everything I've read here is disgustingly negative.

"She's a micromanager, she should be 'CEOing' instead of designing, she's a terrible designer, she should spend time with her kids (!!), she has hubris to say she can design something, it's all about her, she's destroying the craft of design, the wafts of Denning - Krugerism are pluming out."

I just... come on, people!

</comment><comment><USER26> I like how marketing people try to come up with explanation of BS things they do...

<comment><USER27> You can justify almost anything in design, it's so subjective and the person who gets paid the most always has the final say on what's "right" (except for a few unicorns that allow they're designers ultimte freedom)

</comment></comment><comment><USER28> This seems to be really well intended, but this is the outcome when you put a data-geek into charge of design instead of a true artist.

If they had just launched a design contest on a freelancer, they would have had a multiple times better results. Why not try a golden-yellow "Y" on a blue background for instance. Think different, play with the colors.

Design has to come from the heart and really reflect the personality of the company and show the LOVE! This yahoo logo still looks very stoic and still like from the 90s, urgs.

Designing is simply not a data-driven approach, it is the complete opposite.

</comment><comment><USER29> If the logo hadn't changed in 18 years, what exactly had this logo design team of 4 been up to for so long?

<comment><USER30> Working from home of course

<comment><USER31> Not anymore!

</comment></comment></comment><comment><USER9> Design by consensus = bad, really bad. If the CEO wears the designer boot and conditions the final art I think it's one of the biggest mistakes they will do. Right now, that logo to me looks like more or less those logos you can find on logotypes websites for 30 dollars.

The logo on smaller sizes looks pretty crap. Just check it. The logo is only interesting on certain situations, that's why a good logo isn't just drop some non-straight lines in illustrator on a weekend.

Bezels? That's so 90's.

</comment><comment><USER32> Watching this video:

[http://www.youtube.com/watch?v=agRxG- X_TEQ](http://www.youtube.com/watch?v=agRxG-X_TEQ)

The pure typeface design is truely amazing and beautiful. The bevel and depth completely ruin the entire logo though. Yahoo should have gone with a flat design and a solid fill of their trademark purple color and called it quits.

</comment><comment><USER33> > I'm not a pro, but I know enough to be dangerous :)

May I present the new Steve Jobs, everyone.

</comment><comment><USER34> Love the boldness. Going against flat is bold - and ugly.

It reminds me of a book I had in the 90s which showed 5-click Photoshop tricks, there was a golden bevel trick in there (and marble, and shadows, and stamping).

</comment><comment><USER35> So, yeah, with all of this media around the new Yahoo I decided to attempt to re-embrace Flickr as a place to host photos. My old Yahoo email address account was long since gone, so I tried to sign up for a new account. On entering my Google Voice phone number (which I use as my official number everywhere, because it makes it way easier for me to switch carriers without worrying about number porting) as my mobile number their verification routine informed me it wasn't a valid mobile number... STRIKE 1.

So I get past that by entering my current actual cellphone number (which, again, I consider 'unofficial' since it may change 6 months or a year from now whereas my Google Voice number will not), which I had to go look up because I did not even know what it was... Annoying to have to do that, but not the end of the world.

I start uploading a set of 70 full sized photos to my first 'set' on Flickr over my not-so-fast DSL line. About an hour in to the upload, flickr informs me my login has timed out and the upload can't continue. Worse, not only did my overall upload not complete, but NONE of the photos in that upload show in my account despite the fact that the overall upload was about 50% done. STRIKE 2 through 71.

Yeah, nice-ish logo, even with the bevels, but until Yahoo fixes their shit, who cares? My impression of the company is actually much worse now than it was a couple hours ago when I was pretty much neutral on them. Needless to say my flickr experiment is over and I'm not likely to be signing up for any Yahoo services anytime soon.

</comment><comment><USER36> It's obvious they missed the easiest way to simplify and modernize the logo... Drop the exclamation mark! Remember when Marissa had the TM removed? Nothing screams 90s more than an exclamation.

It takes courage to innovate. Ford, "They wanted a faster horse". Jobs, "They wanted a phone with a physical keyboard". Yahoo? The "new" logo doesn't signify that anything has changed.

</comment><comment><USER37> Without thinking about who did this, the bevel is plainly ugly. I wonder if no one in the entire design team could tell this to Marissa Mayer?

<comment><USER38> Uh yeah I'm sure they did. Except who do you think gets the final say in the decision? Hint: It's not the designers.

</comment></comment><comment><USER39> Before reading this I felt the logo resembled the Google logo quite a bit in terms of the complexity of the font and the use of bevels, and felt like Marissa was involved and wanted to go for a familiar feel to that of Google. I feel its more likely after reading this considering who level in input.

</comment><comment><USER40> Seriously, 31 comments about (a really mediocre if you ask me) LoGo? I'd only wanted to know how did it cost, out of curiosity... Because at eLance you can get a better one at 75USD without ruining a weekend (not joking).

<comment><USER41> I think you should publish this brilliant $75 logo for us to critique :)

</comment></comment><comment><USER42> I love the fact that the CEO and an intern can work together on a project at Yahoo.

</comment><comment><USER43> Are they A/B testing the logo without the exclamation? About one out of 10 times I load yahoo.com the little animated ! never happens and the logo is left without the exclamation. Could just be bad code, though.

</comment><comment><USER44> Until today, I believed Marrisa Mayer was all hype... she is a lady of attention to details - yahoo needs no other person her at this moment..

About the Logo, it seems so 90s.. normal people will be bored and you cannot explain the hyperbole's and the geometrical symmetry of the logo.. Yahoo needed a story that common man could understand - they have missed the train by designing a very technical logo.. I may be wrong, yahoo needs to attract technical people.. or I may be right with all the business happening at the consumer side.. they needed to balance - but they failed to do it..

<comment><USER40> > [...] they have missed the train by designing a very technical logo.. I may > be wrong [...]

You may be correct though. What does __the LOGO __has to do with what _Yahoo!_ will achieve is beyond me.

I like logo stories: Makes you think that if Nike didn't had the _Just do it_ logo, it would have failed (and some kids in Eastern Asia wouldn't have to work their ass out for my Nikes).

</comment></comment><comment><USER45> Does anyone else here thinks the logo is much more feminine ? It's more elegant, and the mix on bold and thin lines inside the letters reminds me a bit of fashion magazine logos ( think vogue).

<comment><USER46> That's my reaction as well. The person who described it as "Macy's" was spot on. My immediate reaction when looking at it is a department-store makeup counter.

Which is good branding, considering how one of Yahoo's strongest points is that they go after female market segments that geek-driven companies often fail to capture. They're chasing women. Not just women, but _decidedly non- geeky_ women.

Remember that Yahoo's logo was originally red, not purple.

</comment></comment><comment><USER47> Well, I like the bevel. It may not be flat but it does an excellent job in the context it's supposed to be used in - go check out yahoo.com.

That favicon could definitely be reworked though.

<comment><USER48> The favicon hasn't been updated yet.

</comment></comment><comment><USER49> That Yahoo! brand, as represented by their logo must be quite an asset given how it is all over their CEO's blog as well as their corporate blog[1].

Ironically their corporate blog isn't loading at the moment because [http://ajax.googleapis.com](http://ajax.googleapis.com) isn't responding. (Edit: - seems ok now)

[1] [http://yahoo.tumblr.com/](http://yahoo.tumblr.com/)

</comment><comment><USER50> It seems weird to me that they went through so much trouble focusing on tiny details and then making the logo on the homepage so small that you can barely see them. I'm pretty ignorant of design theory though - can anyone recommend any reading materials (general, logo specific or other) that would provide a good introduction?

</comment><comment><USER51> Focusing on the logo is a detraction from the vast array of truly positive changes that have been implemented over the past 6 months -- by some very talented teams I might add.

No question the whole site is on the move. To where or what, I dunno. But my interest is piqued and the overall experience feels tighter. If that makes sense.

</comment><comment><USER5> [http://i.imgur.com/qv1WDrS.png](http://i.imgur.com/qv1WDrS.png)

Anything will be better than this. My guess is that they're fully aware that the bevel makes a lot of people think of the 90's. To me, the message is "stability" and "experience".

</comment><comment><USER52> I have a feeling that final results - people like the logo most similar to the old one - were anticipated at yahoo, and entire logo testing situation "fabricated" to state "you liked us all this time, and we're just reminding you of that".

</comment><comment><USER53> Its not a logo I would have made, but its different and it doesn't look _bad_. I appreciate the explanation she gave about the different aesthetics that went into it and how they tried to give it some deeper meaning then just a font on a white background.

</comment><comment><USER54> Looks like they spent more time making a video about the logo than the new logo itself.

</comment><comment><USER55> I hate the bevel but looking at it on the Yahoo website when the logo is crushed into the top right corner the bevel makes it pop out a little more and be more noticable when it is that small the bevel pretty much disappears.

</comment><comment><USER56> Wow, the comments here about working on weekends are shocking. Rome wasn't built in a day and companies aren't built with 9-5 jobs.

This is sad and hypocrite. Every start up I know works hard, long and hacker news should know better

</comment><comment><USER57> Logo is nice, it feels more modern. Chiseled bevel is a matter of opinion and would probably get removed on smaller scales (hopefully). I'd like to see them redesign their front page though. It's incoherent.

</comment><comment><USER58> I'm not a designer and know nothing about logo design, so let me ask: Is there an objective way to evaluate a piece of design such as this new logo? Or does it just come down to personal like/dislike?

<comment><USER59> Well, what you can do is ask people who have worked with logo design, won awards for logo design etc.

Of course, these people may be biased, but at least they have more experience in evaluating logos than others. So in general, if many of them like it there's a good chance it's actually good.

The other thing you can do is to look back. In 10, 20 years, it might be more obvious whether a logo was successful or not. But again, that may be influenced by the success of the company.

I think saying that it all comes down to personal taste is bit misleading, because that personal taste is generally shared by a large part of the population.

<comment><USER58> _" Well, what you can do is ask people who have worked with logo design, won awards for logo design etc."

"Of course, these people may be biased, but at least they have more experience in evaluating logos than others"_

This just raises the question of how these experts evaluate a logo.

I understand that academic art criticism [1] has developed frameworks for evaluating works of art - genre, cultural impact, relationship to preceding works, etc. But a logo isn't art - it is almost entirely functional and used for (mundane?) concerns like brand identity. I can appreciate that some logs have existed for long enough that they have a historical context (e.g. Coca- Cola) but I don't see how this helps evaluate its primary purpose.

Any graphic designers want to comment?

[1] [http://en.wikipedia.org/wiki/Art_criticism](http://en.wikipedia.org/wiki/Art_criticism)

</comment></comment></comment><comment><USER60> The current animated, 3d logo on the frontpage reminds me of BonziBuddy: [http://en.wikipedia.org/wiki/BonziBuddy](http://en.wikipedia.org/wiki/BonziBuddy)

</comment><comment><USER61> Is it just me or her tumblr is timing out frequently with packet drops.

</comment><comment><USER62> Let's give some feedback about the logo here: [http://usersnap.com/yahoologoreview](http://usersnap.com/yahoologoreview)

I don't like it.

</comment><comment><USER63> Nice. I like this one much better than the other 30 choices they presented to users.

*actually I didn't watch the video all the way to the end where it shows the bevel. Yuck. Why?

<comment><USER64> I'll say this again and specifically on this comment since it spells out "30 choices" while others just hint at it -

There were no 30 choices. This was always the final logo. The 30 prior "logos" were a "whimsical" way of getting users used to the idea of change. None of those 30 logos were done seriously...

</comment></comment><comment><USER65> Couldn't she get her full name as a Tumblr username?

<comment><USER66> Its even odder: she did get her full name ([http://marissamayer.tumblr.com/](http://marissamayer.tumblr.com/)). However, it includes a comment that points to [http://marissamayr.tumblr.com/](http://marissamayr.tumblr.com/) (it says Please see marissamayr.tumblr.com for my blog.). No autoredirect, no link nothing. Quite odd.

<comment><USER67> Flickr

Tumblr

Mayr

<comment><USER68> So much more makes sense now, like why I feel like their use of Tumblr for the corporate blog is purely perfunctory.

</comment></comment></comment></comment><comment><USER69> It's great that she's actually using tumblr. It shows that she's likes her product enough to use it herself.

<comment><USER70> Or that she has to justify a billion dollar purchase to her shareholders and using it is one way to do so.

</comment></comment><comment><USER71> Like the form. Hate the bevelling.

Am I just following the braying "flat is the new shiny-lickable" herd here?

</comment><comment><USER72> Anticlimactic. It's like their old logo, only more boring. Why does Yahoo exist?

</comment><comment><USER73> Is that Empire of the Sun?

<comment><USER74> Yep, track is called 'Alive' [[http://www.youtube.com/watch?v=IPKAwJKGSDc](http://www.youtube.com/watch?v=IPKAwJKGSDc)]

</comment></comment><comment><USER75> time you spent on something != quality of the result

</comment><comment><USER76> It looks like it should be on a bottle of perfume.

</comment><comment><USER77> That Vogue girl is doing to Yahoo on behalf of Google what Stephen Elop did to Nokia on behalf of Microsoft.</comment>


"We got geeks": Inside Google's ugly war against the homeless in LA - <AUTHOR> https://pando.com/2015/06/22/we-got-geeks/ <comment><USER2> the security guard sounds overeager ("Everyone in there makes over $1 million" \- really?).

Not having been to skid row, but if it's like the tenderloin (and I've heard it's worse) you know the streets are totally overrun with vice.

The notion that private corporations enforce social control is not novel. What's new is this pattern of tech companies going into sketchy neighborhoods and 'cleaning them up'. In San Francisco Twitter got a tax break for 'revitalizing' the area. Part of the tactic is patrols by 'Business Improvement District' officers.

I think Google must have known what they were getting themselves into. Probably got a tax break for their 'sanitizing' effect. This being said, it's disingenuous for them to not acknowledge the problem and point their 'brilliant minds' to research being done.

There's a need for more evidence-based policy on homelessness. Services and transitional housing are good ideas. For Google to quarantine a two-block radius doesn't help solve the larger issue at all.

At the same time, the issues of skid row are not just 'lack of sidewalk space for tents'. The concept of a "sanctuary encampment" is developing, but I'm not sure that designating the neighborhood 'tent-friendly' is productive for anyone considering the amount of drugs there.

It's also not really fair that low-income apartment renters need to live in such a chaotic area in order to afford a bed.

Kicking homeless people out of a peaceful off-the-grid settlement might seem cruel, but I have slightly less sympathy for their plight at the urban core. Making these neighborhoods sanctuaries is not a solution unless the broader support network is there (stuff like mental health, finance, and drug support), which it's not.

For Google to kick out these people may be slightly counterproductive to society's larger homeless issue, but not dramatically so.

<comment><USER3> You don't address the issue of assault and battery on people. It's a felony.

Also, people don't need your or Google's or my approval to use a public sidewalk. Whether or not we think it's a good idea, it's none of our business.</comment></comment>


Corona Helper - <AUTHOR> Hello all,
Lots of people are having problems due to the corona virus. There are lots of people who are willing to help and are attempting to organise on makeshift facebook groups. I was hoping that something could be done to connect them more efficiently so we can all get through Corona.
Here is an idea for an app:
* On one side a user can post their need (such as: I am out of pasta/nappies and there are none in the store. Could someone check on my grandma, I have a burst pipe but there is no one around to help) along with their location. * On the other side people who are willing to help can post their location and info such if they have a car or extra supplies * Both users will post if they have been exposed to Corona or not. (this could go on for 12-18 months so people can show if they already have immunity etc) * The users can message each other. * This can be implemented worldwide using post codes/zip codes etc. * Some things like safeguarding and protecting vulnerable people from exploitation will need to be worked out - but I'm sure solutions can be found.
To build this we will need: * Backend Developers (Python/Ruby etc) * Frontend (Javascript) * iOS developers * Android * UX * DevOps * A project manager * Anyone else with skills they can bring to the table.
I've set up a discord server https://discord.gg/YQgZvfr - please join if you have some time to spare and would like to help.
(if you could upvote and comment on this post to keep it bumped it would be most appreciated). <comment><USER2> How is this different from Craigslist and other similar sites?

> _I have a burst pipe but there is no one around to help_

In that case you should hire a plumber, the plumber needs money to live too. Probably s/he is working less because non-emergency repairs are getting canceled. (One of my friends just delayed repainting the house for later.)

> _(if you could upvote and comment on this post to keep it bumped it would be > most appreciated)._

Asking for upvotes is discouraged here, and usually make user flag the post instead.

</comment><comment><USER3> Just launched [http://mycoronahelper.com](http://mycoronahelper.com)</comment>


AIGrant: Get $5,000 for your open source AI project - <AUTHOR> https://nat.org/aigrant-get-5-000-for-your-open-source-ai-project-1118dd7db083 <comment><USER2> Hi HN! I'm happy to answer any questions. I'm also open to feedback if there are suggestions.

I was inspired to try this experiment by Nadia Eghbal's grant program: [https://medium.com/@nayafia/5-000-no-strings- attached-9e7b95...](https://medium.com/@nayafia/5-000-no-strings- attached-9e7b95d33e50)

<comment><USER3> Could you put like-minded people in touch who submit similar projects?

<comment><USER2> This is a great idea. Maybe I'll create a slack for everyone who applies.

</comment></comment></comment><comment><USER4> What I find surprisingly appealing is, the open source heroes that I grew up with, nat friedman in this case, are pushing towards AI / deep-learning. It feels as if "hackers", who previously flocking towards open-source software are gravitating towards AI, stats, machine learning etc.

I am open to scurry along and move to this new place where the cheese is.

<comment><USER5> [http://course.fast.ai/](http://course.fast.ai/)

Super good stuff.

edit: now, without https.

<comment><USER6> Is this legit? Throws a security error in Chrome.

<comment><USER5> Hey you're right. But yes, it's legit, without the https it also works.

I'll drop them a line to warn of this, thank you.

</comment></comment></comment></comment><comment><USER7> What if applicant personally doesn't have any previous experience with AI- related technologies. But has a strong affinity towards learning them. Also If he/she has a really good idea.Will it be okay? or the ones with previous experience will be preferred?

<comment><USER2> Lack of experience in AI is not necessarily disqualifying. I'd like to see some evidence that the person applying is capable of doing the thing they are setting out to do, though.

That could be experience shipping open source software, a relevant math background, a track record of being great at explaining algorithms, or something else I'm not thinking of right now.

<comment><USER7> thanks!

</comment></comment></comment><comment><USER8> I just submitted my application. Would it be possible to add a notification that the application has been successfully submitted? Perhaps that is not possible with the package you are using.

<comment><USER2> Good idea, tonight maybe I'll write a script to email people a couple times a day.

<comment><USER3> Could you make the responses editable post submission?

<comment><USER2> Done!

</comment></comment></comment></comment><comment><USER9> Has anybody looked at ThoughtTreasure? Since Nat is willing to accept updates to Open Source Software, this amazing code base would be a good start of AI related stuff. It really could use a better user interface to its databases, for example. Or a tie to WikiData. There are several good things that could be added to it.

[https://en.wikipedia.org/wiki/ThoughtTreasure](https://en.wikipedia.org/wiki/ThoughtTreasure)

</comment><comment><USER10> @Nat: Any thoughts on a project using AI to do real-time noise reduction, signal identification, and signal extraction in a controlled environment?

To get an idea of what a more complex version would look like, which is closed source, see:

[http://cyphercorp.com](http://cyphercorp.com)

</comment><comment><USER11> Great initiative! Always good to see more support for open-source and for AI tooling.

</comment><comment><USER12> Are you looking for more academic/business/cloud cases, or would advancements in game AI be an option as well?

<comment><USER2> Open to all these things; game AI sounds great.

</comment></comment><comment><USER13> Kind of a loaded question, but what do you mean by 'AI' other than developing an algorithm that makes a computer look 'smart'?

</comment><comment><USER14> Very cool!

</comment><comment><USER15> Mind doing the same for hardware projects using an open source OS?

A pal I know could use half of that just to set up the legal structure of his outfit.</comment>


Phoenix is pushing Windows into a VM, permanently - <AUTHOR> http://www.technologyreview.com/computing/22643/

<comment><USER2> It would be really handy to have VM software just "built in" to the BIOS and chipset. You could do some things at this level that are just impossible at higher levels, because you know some of the hardware you're sitting on at dev- time.

I don't know about the rest of the features of this thing, but the "virtualization at the firmware level" thing has potential.

<comment><USER3> So much potential in fact that mainframes have worked that way since the 1960s ;-)

<comment><AUTHOR> Now coming to a laptop near you ...

Microsoft also seems to be heading that way, now. Perhaps too late - they have an extremely heavy 'backward compatibility' load, carried so far (maybe too far) on a single code base.

</comment></comment></comment><comment><USER4> Yay. Now we have an OS hard-coded into the BIOS. Why is this a good thing?

What does this buy over simply putting a flash chip on the motherboard and letting the OS treat it like another peripheral, perhaps with a pre-installed slimmed linux distro?

</comment><comment><USER5> This has the potential to be very cool. Basing it on Linux would dovetail nicely with the FSF's Campaign for Free BIOS as well:

<http://www.fsf.org/campaigns/free-bios.html>

I'm sure there would be something proprietary in it that would ruffle the feathers of rms, though.

</comment><comment><USER6> The article doesn't address it but what effect does this have on hardware visibility to the guest? (How) can Windows still get unfettered access to e.g. the video chipset or other expansion devices?

</comment><comment><USER7> It's like going back to the days when ROM BASIC was built into every "microcomputer." Only this time they're going for a full OS instead of just BASIC.

</comment><comment><USER8> I guess the question I have for this is very similar to the question Bill Gate's mom asked him when he said he was working on personal computers.

Why would anyone want this?

</comment><comment><AUTHOR> Title borrowed from here:

[http://linux.slashdot.org/comments.pl?sid=1233739&cid=27...](http://linux.slashdot.org/comments.pl?sid=1233739&cid=27959723)

which summarizes well the potential of this "OS in ROM, with hypervisor for VMs" approach.</comment>


Are packets duplicated in live video broadcast? - <AUTHOR> If 10 users are being served a live video broadcast stream of 1mbps bitrate by a server, does the server require 10mbps bandwidth or is 1mbps enough?
Since the server is serving exactly same data to multiple clients, does it send multiple copies of same packets with different destination addresses or does it send a single copy of a packet with a list of destination addresses?
If the commonly used protocols doesn't support this, are there any not so widely used options? <comment><USER2> You can't send a packet with a list of destination addresses.

There is multicast, where clients can register "I'd like a copy of all packets to $address please", but it doesn't work on public internet. It's used by some providers for TV streaming inside their networks though.

There's also peer-to-peer approaches, where clients share the data they receive with other clients, similar to Bittorrent.

The most common approach is individual streams from the servers to the clients though.

<comment><AUTHOR> Does youtube use multicast?

<comment><USER2> No. As I said, multicast generally doesn't work across networks you don't control (and also needs special clients, can't be used with browsers).

</comment></comment></comment><comment><USER3> What you could do is send your stream from your source machine to a streaming server, and then have the streaming server send that out to the clients.

This is how live-streaming on YouTube or twitch.tv works.</comment>


Big Data in Little China: Why the Future of Big Data Is Made in China - <AUTHOR> http://blog.traintracks.io/big-data-in-little-china/?hn=true <comment><USER2> Probably not a coincidence that it's happening in a country that fully embraces mass surveillance and censorship. I'm sure those are big _incentives_ to improve such technologies.

<comment><USER3> Author here - The massive growth of big data talent is not spurred by the government, but by the fact that the Chinese market place is many times bigger than the provincial markets that Silicon Valley often ends up targeting. Within a year of launch,our client Tantan would have accounted for a very hefty percentage of ALL the traffic that Mixpanel disclosed that their clients were recording.

The data is bigger here because the market is bigger here, and the internet is more modern here. If you haven't walked a day in the shoes of a Chinese person with WeChat and Alipay, you haven't seen the future of the internet.

It's time for Silicon Valley to catch up.

<comment><USER4> This is a tangential argument we're having, but the CCP, while perhaps not spurring it, is at least reveling in it, and most definitely encouraging it and helping it along where it can. Anybody who thinks otherwise is willfully ignorant or woefully naive about the CCP. Nobody benefits more than the Chinese government. Big brother would be proud.

But government involvement is not the main point of your article. I think it's a great illustration that no matter how much marketing jargon the and kool-aid we peddle, we still can't escape basic economic principles.</comment></comment></comment>


10 years of Ruby security disclosures analyzed - <AUTHOR> https://dependabot.com/blog/the-latest-dependency-version-is-probably-the-most-secure <comment><USER2> Hey, Grey from Dependabot here. Happy to answer any questions people have about the data or the analysis we've done.</comment>


How to Apply Deep Learning to Drone Imagery - <AUTHOR> https://medium.com/nanonets/how-we-flew-a-drone-to-monitor-construction-projects-in-africa-using-deep-learning-b792f5c9c471 <comment><USER2> Hey guys, we are building [https://nanonets.com/drone](https://nanonets.com/drone) We were working with a customer from South Africa to monitor construction progress using drone imagery and wanted to share case study based on our experience here. Hope it helps!</comment>


Starbucks, monetary superpower - <AUTHOR> https://jpkoning.blogspot.com/2019/08/starbucks-monetary-superpower.html <comment><USER2> 15 or so years ago, my manager at WalMart Stores Information Systems Division was previously a programmer on one of the many finance related teams. Specifically, she worked with gift cards, and one time I asked her how different state laws affected how much money WalMart could recover from those cards. She was _delighted_ to elaborate!

I don't recall the particulars of the answer, but it was eye-opening. She said that they had a team of lawyers whose job was to (try to) keep track of all of the laws, all over the world, that had any bearing on this topic. Not only was it state and federal law, but also county and even city law. (And territories...and military bases....etc.) There were some stipulations about where the card was bought AND where the card was used, if in different jurisdictions. Many of the laws were contradictory. In some cases, none of the money could be reclaimed, and would revert to different local funds. There were effectively _endless_ permutations.

She and her team had to decide what of all of this they would model with code. They could not model all of it, so there was a hybrid of some actions being taken with the code, and the code outputting reports that humans would use to make decisions about actions.

It was eye opening to consider how legally complex many such 'simple' things, like gift cards, are when implemented on a wide scale.

<comment><USER3> > It was eye opening to consider how legally complex many such 'simple' > things, like gift cards, are when implemented on a wide scale.

To the armchair HN community who ask "why does it take 1k engineers to run <insert random silicon valley app that operates at global scale>". Here is your answer.

Note - to be fair, yes many of these team are indeed bloated and work on projects that are a result of NIH syndrome, where "buy vs build" decisions just automatically default to "build". Ask anyone at Amazon if they enjoy working with the code on their custom internal ERP system and you'll know what I'm talking about.

<comment><USER4> > _To the armchair HN community who ask "why does it take 1k engineers to run > <insert random silicon valley app that operates at global scale>". Here is > your answer._

I think the usual question isn't why a random SV app yas 1k engineers, but why does it have < 100 engineers and 2k+ administrative and sales&marketing people.

The answer is the same, but let's be clear: this is not an engineering job. It's legal and sales job.

<comment><USER5> I don't think many really say that about monsters like Amazon. It's usually these very limited in scope and functionality like Twitter that boggle the mind.

</comment></comment></comment></comment><comment><USER6> One use of Starbucks gift cards not mentioned in the article: cashing out foreign currency.

"When you're leaving a foreign country and still have some of the local currency, take it to a Starbucks and load it onto a gift card. You can use the card later in the UK, USA, Canada, Australia, Mexico, and the Republic of Ireland."

[https://lifehacker.com/put-leftover-foreign-currency-on-a- st...](https://lifehacker.com/put-leftover-foreign-currency-on-a-starbucks- gift-card-1833095163)

<comment><USER7> So they don't charge any explicit foreign exchange fees, but

"Currency conversions are based on currency exchange rates applicable on the date of the Transaction." Well can't they just use a super advantageous measure there? There's no pinning to any external rate in the language.

<comment><USER8> yes, they absolutely can. but they don't. They aren't trying to run a forex business, they're trying to sell coffee so they charge a fair rate.

it's not going to be the best rate possible, but it's probably a better rate than anybody else at the airport will give you.

<comment><USER9> > yes, they absolutely can. but they don't.

[citation needed]

> They aren't trying to run a forex business

Right. Particularly, they aren't trying to sell services to people price shopping for forex, is an incidental convenience provided to a customer base that literally isn't even checking prices.

Why you'd assume that the rates will be especially favorable is unclear.

<comment><USER8> i'm not assuming anything. when i use my canadian starbucks card in the US i have always been given a fair exchange rate.

</comment></comment></comment></comment></comment><comment><USER10> _As for Wayne, while he may earn an implicit interest return in the form of Starbucks points, by forgoing a card payment he 's giving up on the associated cash-back or airline points._

I don't agree with this. While merchants pay interchange fees based on the value of card transactions (plus a flat rate per transaction IIRC), as a cardholder rewards are earned only as a percentage of the total purchase, and are _not_ influenced by the number of transactions.

So I earn 4% back on the value of all my Starbucks transactions, regardless of whether the purchase is made via the app or my card. I am willing to forgo a couple pennies in interest on my rolling $15-20 balance to have the convenience of mobile ordering.

If you use the system efficiently, I see it as a net value add as a customer.

<comment><USER11> Yep. And you're still getting any special merchant-specific rewards the card company might offer you. I just reloaded my Starbucks card using my Amex, and Amex had a promo that offered a 10% credit back on Starbucks purchases, up to $5.

So I threw $50 on my card, I get 10% off the coffee, and earn back a bit on the Starbucks reward points.

</comment></comment><comment><USER12> I've always thought that the main reason for Starbucks to push their card and reward program is to save on per-transaction credit card fees.

By my understanding, in the US, typical merchant fees to accept a card are a flat $0.20-$0.30 transaction fee, plus 2-3% of the total dollar amount.

The article mentions the interchange fee (the 2-3%), but for small purchases the transaction fee is more significant.

I assume the majority of purchases are individuals buying a single beverage. If an average drink costs $4, a $0.30 transaction fee alone is eating 7.5% of your gross revenue. That's an absolutely huge amount.

Even if Starbucks cards are bought/topped up with a credit card, that $0.30 fee is being amortized over $20+ worth of product instead of $4 worth.

I also figured this tied in with Starbucks' contract with Square some years back - as one of Square's value props is eliminating the per-transaction fee for credit cards. Not sure why that was cancelled, though.

<comment><USER13> This is a great example of a HUGE competitive advantage Starbucks has over regular merchants that's very unfair. Smaller merchants don't get the scale advantages here...

<comment><USER14> To be honest some of those smaller merchants can also make better coffee than Starbucks, and as such they can ask for slightly higher prices for said better coffee without their customers complaining.

<comment><USER15> No one goes to Starbucks for the high quality of their coffee. They go for convenience, maybe atmosphere (a safe comfortable place to hang for awhile), and such. But if you want great coffee, that is a trade off that doesn't favor Starbucks (like a burger conesuire at McDonald's).

<comment><USER16> >maybe atmosphere (a safe comfortable place to hang for awhile),

So I mean, coffee shops in general, yes. But at least in urban areas? Starbucks seems to be really well-designed to maximize throughput and profit; they have fewer seats, usually per cup of coffee sold than the smaller coffee places, and generally seem to be set up for 'to go'.

It's one of those things where if I look at it as an investor, I really like it, but if I look at it as a consumer, the opposite.

<comment><USER15> What urban areas? Seattle? No, downtown stores have seats, there are very few togo stores, heck the one near the library is pure plush seat forest (the one in Paris near the grand opera is like that also). You can't operate togo stores at all in China, where your sales volume is strictly limited by the amount of seating you have (unlike the USA). Tokyo has the best seating I've ever seen in a Starbucks, maybe NYC?

It really depends on the market, I guess.

<comment><USER16> mm. in santa clara, redwood city, san francisco and Los Angeles, Starbucks usually have few places to sit (compared to local coffee shops) - and are usually way busier (compared to local coffee shops) and usually don't offer mugs; they just have to-go cups (or bring your own mug) - while most of the nicer local places give you a mug by default if you say it's 'for here'

I mean, sure, they aren't 'to go only' \- but they are impractical places to meet or hang out compared to most smaller coffee shops, just because they seem to have a much worse (or, I guess as an investor, better) ratio of customers to seats; a lot of time there are more people in line for coffee than there are tables.

I'm not saying they don't have seating at all, just that they seem to be optimized in a thoughtful way to sell as much coffee as possible, making them superior (if you are an investor) but inferior if you want a place to meet up with other people or hang out, when compared to the locally run and less- optimized coffee shops.

</comment></comment></comment></comment></comment></comment></comment><comment><USER11> The part on "breakage" was interesting. I had recently searched my name on my state's unclaimed property bureau and found I had about $15 and change to claim.

I filed the claim form, and when I got the check, the checkstub said it was from an unused Starbucks account balance.

If last year they had $155 million from abandoned accounts that they could legally just pocket, I wonder how much they also had to send over to various states' unclaimed property offices.

<comment><USER17> Hey, I didn't even know about this. I just found $10 in my name. Thanks!

<comment><USER11> You're welcome! That ten bucks is like 1.5 Starbucks visits.

</comment></comment></comment><comment><USER18> The magic trick here is that Starbucks Rewards -- their "free" loyalty program -- requires using a Starbucks Card (virtual or physical) in order to make your purchases.

Under the old system (prior to ~Apr 2019) you had to make $150 in purchases annually to get "Gold" status, and then you got a free reward after every ~$62.50 in Starbucks spending. The new program has no minimum, and tiered rewards between $12.50 and $200 of spending.

<comment><USER19> You can get a virtual card in the app and "pay" with it by loading on the exact amount you need to pay with before checking out (or just buying it in the app). So it "needs" a card, but that's really just a weird thing they didn't abstract from the app, it's not actually an inconvenience (at least to me)

<comment><USER20> As far as I remember, there is no way to load an exact amount, so you always end up with some spare change in the app.

I assume that this is somewhat of an incentive to quite a few customers: That almost-forgotten balance almost feels like a discount towards the next purchase, not so much as a free loan to Starbucks.

</comment></comment></comment><comment><USER21> I keep wondering why people buy Amazon/Netflix Gift cards. Great, you converted 50$ into 50$ that can only be used on Amazon, and people may end up not using at all. This is also financing with negative interest rate.

<comment><USER22> If you don't have a credit or debit card it's one of the only ways to pay for the service, save asking to borrow a friend's card.

According to the FDIC, 6.5% of American households lacked a bank account _at all_ in 2017.[1]

[1]: [https://www.fdic.gov/householdsurvey/](https://www.fdic.gov/householdsurvey/)

<comment><USER23> But you could always go with one those reloadable debit cards, no? Though those usually come with a fixed setup fee of, say, $5

<comment><USER24> It's actually fairly hard to get money onto those without paying a fee (if you don't have a bank account). Most of the obvious ways to get money onto them involve "Visa ReadyLink", and that comes with a service fee from $2 to $5. If I recall correctly, some even have monthly fees if they get below a certain level.

Amazon gift cards can be purchased without a fee most of the time, and with less friction in the store then actually dealing with the service desk in the store that does ReadyLink.

<comment><USER25> >some even have monthly fees if they get below a certain level

If I receive one for some reason, I've learned to go straight to my computer and load it into my Amazon account.

</comment></comment></comment></comment></comment><comment><USER26> > But the only way to cash out of Starbucks balances is to buy a coffee--a > promise that Starbucks can always keep!

By the way this isn't true in California: by law all stored value and store- credit cards last for 10 years and can be cashed out.

<comment><USER27> But how does one cash them out?

<comment><USER28> You go to any Starbucks and ask the person operating the register to cash you out. They push the button designed to facilitate this.

</comment></comment></comment><comment><USER29> Not so sure it's due to "coffee addicts" so much as the fact that Starbucks gift cards became the perfect, generic, gift. How many times have you been on your way to X, needed to bring a gift, and just run into Walgreens?

<comment><USER30> Starbucks coffee and espresso drinks are "will do in a pinch" for me. I'd much rather frequent a local coffee shop with better espresso than what Starbucks serves.

I think Starbucks makes more money these days from its sugary cold drinks than its hot coffee/tea/espresso.

<comment><USER31> For me too.

Starbucks is train station or airport "ehh, what did I expect?" coffee.

<comment><USER32> It's the McDonalds of coffee. Rarely surprising in either a good way or a bad way.

</comment></comment></comment></comment><comment><USER33> >Keep in mind that each payment made through the Starbucks app is a payment that isn't made by credit card. Since each credit card payment will cost Starbucks 1-2% in interchange fees paid to the card networks and banks, the company saves a lot of money by guiding customers to its payments app

Most of those gift cards are purchased by credit card as well. This point is incorrect.

</comment><comment><USER34> Out of curiosity, the author mentions a possible alliance with another companies (McDonald for example) that would share savings, breakage, and data.

Anyone would know if this kind of idea is behind or maybe related to Facebook Libra?

<comment><USER35> What's to know there? Obviously Libra will rack up loads of data on people's spending. Obviously any kind of financial middleman organization these days immediately invests money that it gets from clients for virtual bucks. (I'm surprised to learn that PayPal is limited in this regard, but maybe this report isn't the Singapore PayPal which serves European accounts?)

</comment></comment><comment><USER36> This is mind blowing. I never thought about this while ordering coffee through Starbucks app. It's following the same model as Robinhood.

</comment><comment><USER37> Back in 2012 I found an exploit [1] that let you fabricate card balances. They fixed it 2012, but in 2015 another person found the same issue [2].

I have no idea why they would not be using transactions, and make the same mistake twice. It really does make me wonder how much FAKE money is inside of that BILLION DOLLAR pot.

I also found similar issues in 2017 for their Thailand division. But this is at least understandable as Thailand operates its own Gift Card system.

[1] [https://chadscira.com/post/556999d91cb00914380006ee/Re- Starb...](https://chadscira.com/post/556999d91cb00914380006ee/Re-Starbucks- unlimited-coffee) [2] [https://sakurity.com/blog/2015/05/21/starbucks.html](https://sakurity.com/blog/2015/05/21/starbucks.html)

</comment><comment><USER38> > each of these companies could simply pursue their own independent stored- > value liability programs. But wouldn't an alliance be better?

Obviously it woudln't. He even provides the evidence why not. People top up their starbucks because they need coffee every day - it's basically a subscription , but they dont buy the same stuff at walmart every day - and the cost levels are widely different. Something similar happens to virtual credits for different games - Experts will tell you that it is better to have a separate economy for each game rather than one unified economy - and you should not even allow players to pay each other. Same reason why stock photo sites want you to buy credits for each one of them, or why each newspaper wants a separate subscription. The "Breakage" breaks up when the economies are unified.

</comment><comment><USER39> These and amazon gift cards are indeed a medium of exchange.

<comment><USER40> They can also be used for money laundering, as a result.

<comment><USER41> How would you launder money with starbucks cards? Sure, you can transfer balances with them, but that alone doesn't help you launder money.

According to the treasury dept:

>First, the illegitimate funds are furtively introduced into the legitimate financial system. Then, the money is moved around to create confusion, sometimes by wiring or transferring through numerous accounts. Finally, it is integrated into the financial system through additional transactions until the "dirty money" appears "clean".

I don't see how starbucks cards can be used in any of those steps.

<comment><USER42> Basically anything that is directly exchangeable for cash or useful goods and services is useful for money laundering, I would imagine.

If you can fill one with stolen CC details and then either cash out in a store or sell for a discount, that's a pretty basic launder, no?

<comment><USER43> Being able to cash out a gift card seems like an interesting way to get a cash advance on your credit card, without paying cash advance fees. Surely the credit card companies are on to this, and prevent it somehow?

<comment><USER41> There's a list of goods[1] that are classified as "cash-like" and are treated like cash advances when you purchase them. They don't really try too hard to crack down on this though, because there's little point. After all, you can always get a cash advance for free by going into a store and offer to pay for someone's purchase in exchange for cash (and a little discount).

[1] [https://help.barclaycard.co.uk/brochure/spending_transaction...](https://help.barclaycard.co.uk/brochure/spending_transactions/cash- like-transactions)

</comment></comment></comment></comment></comment></comment><comment><USER44> It's always annoyed me that buying a Starbucks coffee through their app (to skip the line) requires pre-loading a virtual card from your credit card, _minimum $10_ even if it's for just a $2.50 coffee.

Unlike most other apps (e.g. McDonald's) that simply run each transaction through Apple Pay.

Just by virtue of using the app, I'll always have some leftover money Starbucks will one day keep. (I'm not aware of any way to revert a balance back to cash.)

<comment><USER45> > (I'm not aware of any way to revert a balance back to cash.)

If you can get the balance under $10 and stop at a store in California, they'll exchange it for cash.

[https://www.dca.ca.gov/publications/legal_guides/s_11.shtml](https://www.dca.ca.gov/publications/legal_guides/s_11.shtml)

</comment></comment><comment><USER8> >Since each credit card payment will cost Starbucks 1-2% in interchange fees paid to the card networks and banks, the company saves a lot of money by guiding customers to its payments app.

i'm not sure this is true. they're definitely saving something on the interchange, but not 1-2%. reloading your starbucks card is done by a credit card payment, so they're still paying that percentage fee one way or another.

<comment><USER46> Yeah the savings would be on the flat rate (Stripe charges $0.30, who knows that Starbucks pays). Grocery stores, convenience stores, etc, are also not selling Starbucks gift cards for free.

</comment></comment><comment><USER47> Shameless plug, If anyone's building one of these cards, I made a wallet microservice ([https://github.com/sudhirj/notecase](https://github.com/sudhirj/notecase)) for a movie ticket site I work on (justickets.in)

It'll let you track recharges, spends and balances for your customers, we use it for nearly a million customers.

<comment><USER47> Docs are here [https://notecase.docs.apiary.io](https://notecase.docs.apiary.io)

</comment></comment><comment><USER17> Just today, I uncovered an old gift card from a dept store called Rich's, which apparently became part of Macy's. I have no idea how old the card is, but it has a year 2000 logo on it.

The card has a 800 number on it to check its status. So I called it and entered the card number. It was unrecognized. :-(

It was probably a $50 holiday gift to me at some point.

I wonder whose pocket that money ended up in?

What a racket gift cards are.

</comment><comment><USER48> The best way to go about this is to use your credit card to reload your starbucks balance, get points on the card and from the starbucks purchase.

Relatedly they've tried to sell me on the starbucks credit card but it's a 1-2% difference in rewards. (nto that I spend quite enough on coffee for it to come out to much, but it's the theory of it that's fun)

</comment><comment><USER49> My Starbucks app is still linked to my credit card. So they must still pay the interchange fee...

Also why would Starbucks form an alliance with McDonald's? They compete in the same market. They both sell coffee and breakfast sandwiches... Would be a bad idea for sbux.

</comment><comment><USER50> Yep -- Starbucks and similar typically hold these in big banks, who pay interest on the deposits.

They're called "brokered deposits" in finance, and they have all kinds of restrictions. Banks like them because they have predictable stability to lend against.

</comment><comment><USER51> Canadien income tax law lets you give 2 tax-free gifts of up to $500 value. Can't be cash.

So, smart employers will celebrate the new year and some other random holiday with $500 in gift cards.

</comment><comment><USER52> Yes, they also dodge tax in dastardly ways and as such I'd rather not be one of their users.</comment>


Zuckerberg Moves Up The Forbes 400 List. Net Worth Now $2 Billion - <AUTHOR> http://www.techcrunch.com/2009/09/30/mark-zuckerberg-net-worth-2-billion/ <comment><USER2> I find it really hard to take these lists seriously.

How many billionaires (or even millionaires that you know) keep the fact close to their chest? There's probably a lot of quite rich people out there who are more than happy to let you think someone else is richer than them.

Keeps the vultures and losers away from them and lets them get on with enjoying life.

In fact I'm certain there's quite a few people to go to extensive lengths to stay OUT of lists like this.

EDIT: Oh and paper money does not count until you execute your trade. Just ask anyone who was "rich" before the crash.

<comment><USER3> it is also really hard to keep your net worth a secret when it's in billions.

I challenge you to give some examples of people who've got that rich (legally) yet kept it a secret.

<comment><USER4> I see a flaw in your challenge...

<comment><USER3> or perhaps your self confidence proves my point?

<comment><USER4> Sorry, I should have explained myself.

The literal interpretation of the challenge is a paradox. The contradiction is that a secret is no longer a secret once revealed (hence my comment).

I don't think that is what you were trying to convey. You do raise a valid point, but without any supporting evidence, it is thoroughly unconvincing. The absence of X is not enough to conclude that X does not exist ( _especially_ when X is being purposefully hidden, as in this case).

NOTE: I am not disagreeing with you. I don't know whether or not secret rich people exist.

</comment></comment></comment></comment></comment><comment><USER5> Good for him. He's created something incredibly valuable that I use frequently for personal and professional reasons and has managed to keep the site growing and functional.

This is a cool achievement and if he's worth $2B then so be it.

</comment><comment><USER6> Has anyone ever been rated a billionaire before based on a VC valuation alone?

<comment><USER7> Looks like Larry and Sergey were rated as worth $1B each by Forbes in 2004. (List was published in February, Google IPO happened in August) <http://bit.ly/549cO>

</comment></comment><comment><USER8> That must feel good, but it doesn't buy him much yet.

<comment><USER9> Unless of course he has borrowed against his stock, like many people did during the first bubble. I would hope that he would have the intelligence to not get over extended and count his chickens before they hatch.

</comment></comment><comment><USER10> congratulations.</comment>


Xerox Printer Beacons And The Importance of Documentation - <AUTHOR> http://labs.opendns.com/2014/05/01/xerox-printer-beacons/ <comment><USER2> I can not believe xerox didn't register these domains up front. Such negligence.

<comment><USER3> True, but I do wonder about the programming. If I read this correctly I'm supposed to add "XeroxDiscoverySuperNode1" to my existing DNS for internal queries to a McAfee ePO server. So, I would get XeroxDiscoverySuperNode1.mydomain.tld for a query. How does that default back to XeroxDiscoverySuperNode1.com?

<comment><USER2> Good question. Maybe a lot of clients with a misconfigured dns search suffix set to "com"? Maybe there are similar requests flying out to org/net/fr/whatever?

<comment><USER3> It just seems like one of those "maybe I shouldn't do this query" moments. Requiring something other than just a TLD should be a basic check.

</comment></comment></comment></comment><comment><USER4> Reading the blockquotes is next to impossible without highlighting the text. Is #E1E1E1 really the best color for text set in a light font with a white background? (for reference `lightgrey` is #D3D3D3)

<comment><USER5> We're fixing that now. bug bug.

</comment></comment><comment><USER6> I'm loathe to be the guy that complains about someone's CSS, and as far as I know I never have on HN, but this time I must break my silence. The quoted text is literally unreadable on my machine in both Chrome and Firefox, tested on two different monitors. (EDIT: kind of readable on Android Chrome, but I'd still immediately close the tab and move on.) It looks exactly like a comment on HN that got downvoted to oblivion (only with a white background). I seriously cannot imagine that anyone looks at that and says, "yeah, that's readable, publish it".

That said, I obviously didn't read the article and have nothing further to add. :-(

<comment><USER7> [https://www.squarefree.com/bookmarklets/](https://www.squarefree.com/bookmarklets/)

An oldie, but still useful.

Alternatively, use e.g. Web Developer extension to disable all CSS on the loaded page.

Things like this are a good part of why I insist that the browser do, first and foremost, what the user wants, rather than the designer or whoever.

<comment><USER6> Thanks; cool list of goodies. I assume the Zap bookmarklets were what you were prescribing for this particular problem.

If I really care about the content, I fire up Safari and use the Reader button (works well for "you've exceeded your free views" overlays, too). In this case I didn't care that much (I fired up two other browsers and a mobile device only out of idle curiosity about whether it was specific to one browser or just plain broke).

<comment><USER7> I've written some of my own bookmarklets, to e.g. change background color, font, leading, etc. Jesse's set was/is a good starting point.

In part, I liked/like this approach because it doesn't necessitate my sharing my browsing/reading list with a (or, yet another ;-) third party. Not that it would be particularly controversial; nonetheless...</comment></comment></comment></comment>


Ask HN: How to code and deploy PoS blockchain - <AUTHOR> Can anyone share practical advice or direction about how to learn to design as well as deploy a PoS blockchain. <comment><USER2> No, because so far no one has been able to make one.

<comment><USER3> Great answer. And the ones that were created which have bad initial distribution... they're safe to ignore, but bad distribution makes their security null.</comment></comment>


Reversing autism with a cancer drug - <AUTHOR> https://www.medicalnewstoday.com/articles/322274.php <comment><USER2> While i know that i dont have it anywhere near as bad as some i dont think id want it reversed at this point</comment>


Full Stack Python - <AUTHOR> https://www.fullstackpython.com/ <comment><USER2> Can you tell me how are you doing Front-End with Python?

<comment><USER3> They talk about Javascript in the book:

[http://www.fullstackpython.com/javascript.html](http://www.fullstackpython.com/javascript.html)</comment></comment>