If We Go One Attempt Every Ten Seconds, We're Under The Radar - <AUTHOR> http://bsdly.blogspot.com/2012/04/if-we-go-one-attempt-every-ten-seconds.html <comment> X-Istence Before fail2ban was available my friend and I had our own little script which to this day still works perfectly. If we get 3 failed login attempts with the wrong username we ban the IP address, we allow up to 10 failed login attempts for a username that exists.

I've never locked myself out, nor have any of my users. At that point it doesn't matter how fast they are coming either, for the uptime of the script it keeps track of the IP addresses.

One thing we did add was a negative counter, so that if you logged in successfully you basically got a -1 added for your IP address, so if you were to log in successfully 100 times, now you have 110 times to guess your password before being locked out, which honestly hasn't been an issue yet.

I do find it funny watching the log from my script and seeing how many hosts we have blocked. Last time when the uptime on my box was almost 2 years, I had blocked almost 5000 IP addresses. Do note that I block them completely from SSH, and severely rate limit them to any and all other ports.

<comment><USER3> In reply to funkah's dead comment:

> Doesn't that provide information about which usernames are valid, though? Or > does that turn out not to matter?

Yes it does. A targeted attack would be able to get information out of that. A giant botnet spamming authentication attempts? They apparently don't even notice if their connections are being dropped, never mind the difference between valid and invalid usernames.

<comment> X-Istence Sure, it provides information, but if you find a username you have 7 more tries left before you get kicked out... so the chance of you actually getting a password that works is tiny.

</comment></comment></comment><comment><USER4> Being the enlightened hacker that I am, I use SSH keys for all of my ssh'ing, and I know a fair number of sysadmins that require ssh keys, so I kind of thought it was more or less default nowadays. I guess I was wrong, so what is the reasoning behind allowing password access to your servers? I guess if you have a fair number of non-technical users, keys might be too hard to deal with? But scripts can make the process fairly painless. I'd be interested to hear from someone who does manage more than a couple machines.

<comment><USER5> One use case: have your sysadmin login with a one-time password instead of trusting his SSH key to an internet cafe in Elbonia.

<comment><USER6> Huh? Your private key never gets transmitted.

<comment><USER7> You have to trust the PC at the internet cafe in Elbonia. That's the machine that runs the ssh client, and that's the machine you physically type your one- time-password into... or disclose your private key to.

<comment><USER8> This can easily be solved by a ssh proxy which serves no other purpose but to allow key-based login to a more important server.

</comment></comment></comment></comment></comment><comment><USER9> One thing I've never understood is the point behind denying root login if you're enforcing key-based auth

The administrator then has to do one of a) remember/manage a root password for su b) remember/manage a user password for sudo c) use passwordless sudo

What is the advantage?

Or is it just a hang-over from the telnet days where capturing the connection header was simple and thus preventing root login stopped the capturer from getting the root password at the start of the session?

<comment><USER10> The admin should be logging in as a standard user with sudo access and using sudo for any administrative tasks anyway. This minimizes how much code is running priviledged, it also allows his actions to be audited because they're all logged.

Additionally, if he's using key-based authentication, that key should still be encrypted so it can't be stolen and used by someone with unauthorised access to his filesystem. So he still has to remember the password to unlock his key when he fires up ssh-agent.

</comment></comment><comment><USER11> Lots of mentions of fail2ban here - would like to add a quick plug for OSSEC (<http://ossec.net>).

You can configure it to block brute-forcers, scanners, and other rapscallions, but it also provides a bit more power - rootkit checking, configurable file- change checking (i.e., don't alert me to md5 changes in my custom log files, but if /bin/su changes, holler!), and a bunch of out-of-the-box alerts for common services (apache, mysql, sshd, postgresql, etc etc - <USER2> <http://www.ossec.net/doc/rules/index.html> for the full list).

Also, you can configure alerts/blocks for your own events - if you have a custom app, this can be really, really useful. For example, if you see a certain Redis error more than X times in X seconds, sound the guards!

</comment><comment><USER12> If anyone else has this issue please install fail2ban. It basically does a 'tail -f' on your logs and blocks addresses based on your rules. For example, if there are 6 failed login attempts in a 24/hour window, block them.

<comment><USER13> Be careful, though, I had it installed and blocked myself for a few minutes when mistyping my password. I've switched to SSH keys completely since, but be careful not to set too low a limit.

<comment><USER12> 100% agree. We run some high traffic ssh bastion hosts with fail2ban. We use fail2ban, ip block white lists, and good syslog monitoring for easy troubleshooting.

</comment></comment></comment><comment><USER14> If you use pam_cracklib[1] or disable password based login for ssh, the only worry left over is working log rotation.

[0] <http://www.deer-run.com/~hal/sysadmin/pam_cracklib.html>

[1] [http://lani78.wordpress.com/2008/08/08/generate-a-ssh-key- an...](http://lani78.wordpress.com/2008/08/08/generate-a-ssh-key-and-disable- password-authentication-on-ubuntu-server/)

<comment><USER15> I've had password auth disabled for many years, and it's quite liberating. Only a handful of times in all those years have I wanted to log in and not had a key handy. None of those times it was critical. It's interesting to listen to people give excuses about why disabling passwords is nice but won't work for them. None of them hold water, of course. Carrying physical keys for my house, car and office is a real pain. But I'm used to it and it's well worth what I get in return. So it is with ssh keys, but more so.

</comment></comment><comment> mike-cardwell "apt-get install denyhosts". Job done. No configuration required.

<comment><USER16> Many software distributions are deprecating tcp-wrapper which denyhosts depends on.

I've migrated to fail2ban which supports iptables and can monitor services other than ssh.

</comment></comment><comment><USER17> For personal servers with just a handful of nonobvious usernames, the simplest solution seems to be updating sshd's _PermitRootLogin_ and _AllowUsers_ settings. I just updated all my servers. Non-western names FTW.

</comment><comment><USER18> Standard response to SSH "bruteforcing" articles: use SPA or port knocking to hide sshd. Use key-based auth and disable passwords/root login. Use the AllowUsers setting to restrict which accounts can login.

</comment><comment><USER19> I've been running SSH on a non-standard port on multiple machines for close to 10 years and haven't got a single attempt to log in that wasn't legit. Got quite a few of those over ESMTP though.</comment>


How We Got to Now - <AUTHOR> http://video.pbs.org/program/how-we-got-now/ <comment><AUTHOR> It's kind of a California startup version of Connections (with James Burke).</comment>


Merry Christmas HN - <AUTHOR> no new news here, fellows :) just want to wish everyone a great christmas and a happy new year.
looking forward for 2015 - hope many succeed in their plans for next year.
greetings from germany and thanks for this awesome community. <comment><USER2> Merry Grav-Mass

[https://stallman.org/grav-mass.html](https://stallman.org/grav-mass.html)

</comment><comment><USER3> I don't celebrate Christmas, but thank you for the kind thoughts. May everyone within and without the HN community prosper everyday.

</comment><comment><USER4> Merry Christmas everyone :) Got lots of good advice from HN this year. Hope I can implement them in 2015.

</comment><comment> at-fates-hands Merry Christmas to all the HN faithful. It's been quite a year and I'm already looking forward to 2015.

Everybody stay safe over the holidays!

</comment><comment><USER5> Greetings and Merry Christmas from Louisiana.

</comment><comment><USER6> Merry Christmas HN. All the best for the coming new year. I wish you all the success available!

</comment><comment><USER7> And happy belated Hanukkah.

</comment><comment><USER8> Happy/Merry [whatever your particular culture celebrates] everyone.

</comment><comment><USER9> Happy Kwanzaa.</comment>


As seen on Hacker News: A poignant tragedy - <AUTHOR> http://i.imgur.com/qL01m.png

<comment><AUTHOR> For those who don't know 'losethos': he's a guy who has been hellbanned from HN for a few years now.

Linked is a submission of his from quite a while back -- soliciting help.

 _Do you think I should seek investors? The fact that there is absoluetly zero buzz, makes me pesimistic. No emails, nothing._

He sounds very reasonable here... he's talking about something non-technical, and he's voicing sentiments of emotional pain -- I think there is a serious ethical issue of how HN has handled things here.

There he is... asking for advice, but he's not even allowed to do that. No-one can see anything he says, no-one can hear his call for help.

I do recall seeing him on other forums a few years back, and his touch on reality, apparently, has only been dwindling since then. It just breaks my heart that things had to be this way -- that he was taunted for "wasting his time" writing a 64-bit operating system, instead of being treated with kindness and respect, with the same dignity that everyone deserves.

<comment><USER2> Read some of his comments, he's hellbanned because he's literally completely insane, as per the website - god told him to build an operating system, etc.</comment></comment>


Net Neutrality Is Dead – Long Live Common Sense - <AUTHOR> https://go.forrester.com/blogs/net-neutrality-is-dead-long-live-common-sense/ <comment><USER2> The Telecom/ISP that stays neutral will get all the business. Any company that throttles services are greedy. Going to a social media domain vs a streaming service domain has zero difference on how the underlying technology of the internet works.

Common sense was out the window in this article when it was written.</comment>


Apple Isn't Even Bothering To Lie Anymore - <AUTHOR> http://www.techcrunch.com/2009/10/06/apple-isnt-even-bothering-to-lie-anymore/

<comment><USER2> Here's the problem. The author says:

"But unless someone actually forces Apple to play by the rules, why should they?"

What rules? It's their damn phone. They can do whatever they please with it... and it really is true, if you don't like it, you don't have to use it. When you're selling a product, you get to make the rules (to the extent that they aren't illegal or dangerous). What are these "rules" that he says Apple is not following? Whose rules are they? His?</comment>


Scenes from D-Day, Then and Now (2014) - <AUTHOR> https://www.theatlantic.com/photo/2014/06/scenes-from-d-day-then-and-now/100752/?single_page=true <comment><AUTHOR> The picture I found most interesting was that of the soldiers sitting in landing craft. I had always thought that landing craft were loaded just before the landing where soldiers would disembark from some larger ship. The photo implies that they drove or were towed across the channel in those craft. That any man was not sick from that voyage would seem miraculous.

<comment><USER2> Many were terribly sick during D-Day, for sure. The army issued sea-sickness pills before the attack. Still the ride was so terrible many threw up during the crossing, and were already very weak before they got out on the beach. Saving Private Ryan had this kind of scenes iirc. And reportedly yet many more suffered side-effects and got killed because they had trouble staying awake.

</comment></comment><comment><USER3> The picture of the dead German soldier and the contemporary family left me a string impression.

The one with three soldiers and then the photo of the young woman styled as a bikini ad was tasteless

</comment><comment><USER4> The article is from June 2014.

<comment><USER5> Thanks. Added the year above.</comment></comment>


Wasserstein GAN – Depth First Learning - <AUTHOR> http://www.depthfirstlearning.com/2019/WassersteinGAN <comment><AUTHOR> Hi all, we have a new DFL guide, and we are especially proud of this one. James Allingham and his group made an especially superb curriculum for understanding WGAN. We highly recommend earnestly studying with this at hand. Check it out at [http://www.depthfirstlearning.com/2019/WassersteinGAN](http://www.depthfirstlearning.com/2019/WassersteinGAN).</comment>


EU Court Bans Privacy Shield Data-Transfer Pact - <AUTHOR> https://www.bloomberg.com/news/articles/2020-07-16/eu-court-bans-privacy-shield-data-transfer-pact <comment><USER2> I think it's worth noting that this is really primarily the work of Max Schrems and his NGO "NOYB" (None Of Your Business) [1] who have been working for years and years on this.

I remember that after they brought down "Safe Harbour" the introduction of "Privacy Shield" really looked (to me) like "seriously they're just trying to rename it and that's all?!" The goal of "Privacy Shield" was clearly to keep legal what had already been (bad) common practice.

I really hope that this time the EU does not cozy up with the US in the same way again and actually puts some privacy _protection_ legislation into place that deserves the name.

Edit: I want to point out that I was by no means the only one finding the reboot of safe harbour to be a bad joke. Members of the European Parliament are on the record back in 2016 as saying that Privacy shield risked being taken down by the courts in exactly the same way that safe harbour did.

Edit 2: NYOB also hosts a full copy of the ruling [2]

[1]: [https://en.wikipedia.org/wiki/Max_Schrems](https://en.wikipedia.org/wiki/Max_Schrems)

[2]: [https://noyb.eu/files/CJEU/judgment.pdf](https://noyb.eu/files/CJEU/judgment.pdf)

</comment><comment><USER3> "privacy shield" \- A shield to protect privacy or to protect from privacy?</comment>


Top Software Companies on the Inc. 5000 - <AUTHOR> http://www.inc.com/inc5000/list/industry/software

<comment><USER2> Wow: Squarespace, 712% growth, $5.4 million in revenue. 28 employees. In 2009, they did $2,219,101 in revenue and had 8 employees.

<comment><USER3> Something's a bit funky with Inc's page. It states 2009 revenue as both $5.4 million (the current section) and $2.2 million (the previous rankings section).

</comment></comment><comment><USER4> Yay! The company I'm at made it (albeit not in the software category): <http://www.inc.com/inc5000/profile/blurb>

(edit: and we're hiring! <http://www.blurb.com/join_us>)

</comment><comment><USER5> Super-excited that IMVU is on the list too. :) <http://www.inc.com/inc5000/list/industry/media> We're also hiring! <http://www.imvu.com/jobs/index_eng.php>

</comment><comment><USER6> We have a nice round number: #400! <http://www.inc.com/inc5000/profile/elc- technologies></comment>


Anti-social Punishment - <AUTHOR> https://www.lesswrong.com/posts/X5RyaEDHNq5qutSHK/anti-social-punishment <comment><USER2> Just to share anecdata - I grew up in Malaysia but am generally based in Australia, and have noticed a vein of this tendency in the Southeast Asian culture (not covered in the study).

It's only a small percentage, but there really is a type for whom public goods are a concept which only have a flimsy existence. Instead they hold the belief that the smartest people are the ones who try to grab the most for themselves, to an insane level. It doesn't really matter how much the damage their lack of cooperation does, and they get a personal satisfaction from "winning" or "being smart". If punished for that behaviour I would expect retaliation - they were just trying to do the smart thing after all!

Some extreme examples - I heard about uni students who upon graduation took out credit cards, bought a bunch of nice things, then moved home for good and skipped out on the bill. And they clearly didn't desperately need the money as they were medium rich overseas students. One guy I knew personally (who was eventually kicked out of our student group) would do stuff like grab giant stacks of napkins from restaurants and take home rolls of TP from public restrooms. So gross!

The people I met who had this tendency all had a poorer or working class family background, but were all middle class or higher now. My theory is this might be something to do with intergenerational experiences in these poorer countries that (1) the commons will definitely not look after you, and (2) if you didn't have enough you and your family might literally starve to death. And so the right thing to do is look after yourself first at all costs. Looking after the public good might feel like a luxury or foolish behaviour under these circumstances.

<comment><USER3> This behaviour is also found in Denmark. It is not constrained to poor countries.

<comment><USER2> Fair point, I'm sure it exists everywhere. Free riding is never going to completely disappear (psychopathy seems to be evolutionarily stable after all). But when you look at the outcomes of the Public Goods with Punishment game in the link, there's definitely more free riding happening in the poorer countries studied. Maybe weak institutions and proximity to starvation result in a greater percentage of this behaviour in the population? The causality is tricky to figure out though.

</comment></comment></comment><comment><USER4> It's a fascinating experiment, but I don't buy the author's explanation for anti-social punishment. He's talking about punishing "rats/narks" (which is also a big social taboo here in USA), whereas all punishment in the experiment is completely anonymous.

I think a more plausible explanation is status envy. Someone who is publicly altruistic, is likely to gain compliments and plaudits from others. This would then boost their status, and bring down the relative status of others. This is likely to engender status-envy on the part of others, and they act upon their status-envy by inflicting punishment on the do-gooder. It's worth mentioning that I've personally seen such behavior here in America as well, especially when wealthy individuals or corporations engage in altruistic acts.

<comment><USER5> > especially when wealthy individuals or corporations engage in altruistic > acts

I've found that rather than status envy, its cynicism towards the intentions of the person. If they believe the purpose of the altruism is to gain social standing rather than an actual belief in solving the problem they're likely to disparage them. For example - when a company spends $50k to send a sick child on a vacation and then puts down a $50 million marketing spend to show off what they did. It feels like 99% of politics in the US has the same problem.

That sort of leads to the question - what is an effective way to communicate that you want to be an effective do-gooder, without triggering the cynicism? Is attention truly orthogonal to people believing that you have good intentions? I'd argue not, but its been lost. It seems like we don't have many cultural heroes anymore. Einstein comes to mind - Bill Gates perhaps (though certainly not in the 90s)..

<comment><USER6> > _what is an effective way to communicate that you want to be an effective > do-gooder, without triggering the cynicism?_

A more important question, I believe is: is there a way for such method to not be immediately perverted by those seeking to exploit the status bonus? I can't imagine there is; it seems to me that every honest signal that brings goodwill is soon coopted by scammers and marketers.

<comment><USER7> I think communicating your do-gooder status in a hyper connected society is highly over rated. Its like trying to figure out who is the best ant in the ant-hill. Not because there is some value to it to the ant hill, but because the data allows us to count and rank things.

We have all this data pouring in and so have ant rankings. But if Bill Gates gets hit by a bus tomorrow world history isn't going to change much. Wasn't the case in a less connected world in the past.

</comment></comment></comment></comment><comment><USER8> A quote from the comment section:

 _I 'm surprised nobody proposed : "This person is promoting a social norm more stringent than my current behavior, I'll whack him."._

The part about promoting social norms is accurate. Interestingly enough it translates to other areas of life making people fear things like "the promotion of homosexuality".

I guess societies that in the past were forcefully transformed tend to be conservative.

<comment><USER9> Interesting last point: who where a sizable liberal faction in Roman Empire around the year 300? Answer: early Christians, the same group with fanatical penchants who mercilessly eviscerated the Alexandrian mathematician/philosopher Hypatia. Under Constantine, Christianity became a recognized religion of Rome, with Constantine one of its chief advocates. Curiously, who are the most conservative block today?

<comment><USER10> > the same group with fanatical penchants who mercilessly eviscerated the > Alexandrian mathematician/philosopher Hypatia.

IIRC, that's a bit of a myth. According to Wikipedia, she was murdered due to a political power struggle in Alexandria:

[https://en.wikipedia.org/wiki/Hypatia#Death](https://en.wikipedia.org/wiki/Hypatia#Death):

> Socrates Scholasticus presents Hypatia's murder as entirely politically > motivated[95] and makes no mention of any role that Hypatia's paganism might > have played in her death.[95] Instead, he reasons that "she fell a victim to > the political jealousy which at that time prevailed.

This is also interesting:

> ...Hypatia['s] sudden death not only left her legacy unprotected, but also > triggered a backlash against her entire ideology.[146] Hypatia, with her > tolerance towards Christian students and her willingness to cooperate with > Christian leaders, had hoped to establish a precedent that Neoplatonism and > Christianity could coexist peacefully and cooperatively.[147] Instead, her > death and the subsequent failure by the Christian government to impose > justice on her killers destroyed that notion entirely[147] and led future > Neoplatonists such as Damascius to consider Christian bishops as "dangerous, > jealous figures who were also utterly unphilosophical."[147] Hypatia became > seen as a "martyr for philosophy"[147] and her murder led philosophers to > adopt attitudes that increasingly emphasized the pagan aspects of their > belief systems[148] and helped create a sense of identity for philosophers > as pagan traditionalists set apart from the Christian masses.[149] Thus, > while Hypatia's death did not bring an end to Neoplatonist philosophy as a > whole, Watts argues that it did bring an end to her particular variety of > it.[150]

> Shortly after Hypatia's murder, a forged anti-Christian letter appeared > under her name.[151] Damascius was "anxious to exploit the scandal of > Hypatia's death", and attributed responsibility for her murder to Bishop > Cyril and his Christian followers.[152][153] A passage from Damascius's Life > of Isidore, preserved in the Suda, concludes that Hypatia's murder was due > to Cyril's envy over "her wisdom exceeding all bounds and especially in the > things concerning astronomy".[98][154] Damascius's account of the Christian > murder of Hypatia is the sole historical source attributing direct > responsibility to Bishop Cyril.[154]

And the ideologically-motivated myths seem build from there.

<comment><USER9> Agreed. Emotive contemporary documentaries and cinema paint Hypatia as an early feminist martyr for science but actual records of the political/social dynamics surrounding her death are sketchy.

</comment></comment></comment></comment><comment><USER11> I wonder how much of this result is self-perception. For instance, people in Denmark are constantly told what a trusting society they live in, and that that trust is part of the reason why they are so wealthy. So a researcher comes by with an obviously contrived game, and the Danes play like they are supposed to.

For the same reason I wonder about the periodic happiness survey that makes headlines each year.

<comment><USER12> Self-perception of norms _is_ culture, surely? Society is, after all, socially constructed.

<comment><USER11> But the question is how do people play the game when they're not playing a game?

Pretty hard to answer.

You'd have to look at some sort of natural experiment and adjust for a bunch of factors.

<comment><USER13> Agreed. All 'commons'-style games are inherently iterative to infinity from the point of view of most actors, and that has game-theoretic implications that aren't really present in a lab, to say nothing of the fact that communication is a constant backdrop for all of them in the real world.

</comment></comment></comment></comment><comment><USER14> So how would one attempt to do good (start a business/charity/what have you) in such an environment? I can feel my part of the United States inching slowly to this kind of social norm, is there anything regular people can do to counteract this?

<comment><USER15> The US used to stylize itself a high trust society.

I'm not sure how much that was a fantasy dependent on horrific repression's from slavery to Jim Crow, and how much it actually adhered even amongst groups of people that weren't based on racial exclusion.

Regardless, I worry for US culture. Trust in institutions seems to be at an all time low; institutions take generations to build, we won't get them back easily or quickly.

<comment><USER16> > Trust in institutions seems to be at an all time low; institutions take > generations to build, we won't get them back easily or quickly.

So what? I see nothing wrong with reliance on government being replaced with reliance on more local entities (i.e. one's friends, neighbors, church congregation, local government, etc) which is what happens in the near term when trust in higher level authority collapses. If the state doesn't think the feds will give them money for roads then they'll figure out a way to build it themselves. If the community college doesn't think they'll get federal grant money they'll get the state to give it to them or fund-raise it themselves.

Sure, if the federal government just stopped handing out SSI checks, highway dollars and research grands tomorrow it would suck a lot for a lot of people in the short term but in the long term you'd see towns and states running their own programs to compensate. Something always creeps in to fill the vacuum.

Edit: JFC people, I'm not advocating for some sort of near-anarchy where the only government is local. I'm saying that government action should always be performed on the most local level possible and I see no problem with an erosion of trust in Federal government as a means to that end.

<comment><USER17> >*I see nothing wrong with reliance on government being replaced with reliance on more local entities..."

But then you just replaced one government with another. Worse, the one you replaced it with has fewer abilities. How does it get fuel for logistics. (ie - the food pantries get food from where? The federal government is gone, so the oil tankers don't dock anymore and the pipelines aren't full anymore.)

Sure, Chicago would be golden, it's on lake Michigan. But what happens if you live in Arizona? Where does your water come from?

Who helps if a hurricane guts Miami FL?

Who helps if a tornado guts Norman OK?

Etc etc etc.

Our way of life just doesn't support hyper local governments doing whatever they want, and hording resources from other hyper local governments. We, for better or for worse, are set up on the premise of bountiful energy, and through that energy, bountiful access to resources. That's just how we survive currently. No one has the stomach or the constitution to go back to being local farmers.

<comment><USER18> > *Our way of life just doesn't support hyper local governments [...] No one > has the stomach or the constitution to go back to being local farmers.

Er... guys, your American states are as large as European countries (the largest ones being in the range of France, Germany, Spain down to UK, the smaller ones in the range of Switzerland down to Belgium). As bit less populated (and even that is not really a drawback since it typically means more available resources per inhabitant), but otherwise... why wouldn't they be able to support themselves? Furthermore, having different governments/countries does not block the flow of goods.

<comment><USER17> OK. I'm going to assume that you aren't American.

Imagine a European country...

a lot of space right?

Now imagine it's in the middle of a desert. Literally.

OK, do you have that picture in your head? Great!

Now... imagine that it's _ALSO_ landlocked.

If you've followed along to this point, then I want you to answer the following question in as honest a fashion as you can:

How many, "resources per inhabitant", would that nation realistically have available?

Continuing with our thought experiment, imagine there was no federal government to provide the structure for, say, Texas, to share its energy resources with other states...

now, ask yourself why Texas would continue to give Idaho free energy resources? Should Texans continue the charitable practice, in exchange for a few Idaho potatoes? There are just better markets for those resources. And I wouldn't blame Texans one bit for availing themselves of the opportunities those markets present.

Governments, and common sense, can, and _do_ , block the flow of goods.

What I'm trying to point out, is that I don't think you've thought this whole thing through.

</comment></comment></comment></comment></comment></comment><comment><USER15> The toy games described, the variance in different countries, and especially the explanation of the psychology that might be at play here is startling.

I am excited to be able to add this to my toolbox of ways to understand public goods and their interplay with the surrounding culture.

<comment> 52-6F-62 My thoughts exactly. Except I'm excited/not excited. It's bittersweet, if that's appropriate.

It was definitely a compelling read, and I'm sure I'll end up thinking about it often.

</comment></comment><comment><USER19> I don't think the explanation covers it.

Wanting to punish people who cooperate with the state (because the state just takes everything away) doesn't imply wanting to punish people who cooperate in the contrived example game where the game does not take anything away. Unless OP means to imply that people can't mentally separate the machinations of the state from the rules of a game, I don't think the explanation is satisfactory. (Although I don't have a better explanation myself).

<comment><USER20> _Unless OP means to imply that people can 't mentally separate the machinations of the state from the rules of a game_

Yes, I think that's exactly it. Lifelong behavior is internalized, subconscious, and incredibly persistent.

<comment><USER21> Agreed -- humans aren't reassessing the utility of a given pattern of action (e.g. group cooperation vs. selfish behaviour) every time they engage in it, they are building mental heuristics that permit quick decisions without re- evaluating the priors (system 1 vs. system 2 thinking, if you will).

Under that model, it's expected that humans would have a similar attitude to group/commons cooperation in a game as they would in their real-world interactions.

Taking the next step from this observation -- I wonder how much meta-level discussion would be required to break this tendency? Could we apply such meta- level discussion to the real-world, too, and improve cooperation in the societies where these old strategies perhaps don't apply as much now?

</comment></comment></comment><comment><USER22> You'll notice that many such systems deteriorate into a sub-optimal equilibrium because humans naturally have an "us" vs "them" or "me" vs "everybody-else" world view. You'll note that such experiments require the participants to be strangers.

I imagine this has an incredibly strong evolutionary origin, but I think it's interesting to note.

<comment><USER6> What's also interesting is that if you put a large enough bunch of strangers in a room and get them to play a game (or even do some work), they'll quickly divide into groups and start showing the "us vs them" dynamic.

</comment></comment><comment><USER23> Original paper here: [http://www.umass.edu/preferen/You%20Must%20Read%20This/herrm...](http://www.umass.edu/preferen/You%20Must%20Read%20This/herrmann- thoni-gachter.pdf)

The explanation in the linked article isn't fully convincing, IMO. The paper speculates about several more explanations at the end, and has some more data to support them, e.g. people seemed to be punishing low-contributors in an effort to make them contribute more.

If only the experimenters had conducted some interviews...

</comment><comment><USER24> Robin Hanson wrote about similar experiments in 2010: [http://www.overcomingbias.com/2010/07/looking-too- good.html](http://www.overcomingbias.com/2010/07/looking-too-good.html)

As others here have suggested (e.g. jpfed, Tade0), it seems that extreme generosity can be regarded as establishing an undesirable behavior standard. The post suggests a workaround, if your productivity/generosity greatly exceeds others: under-report your output and give credit to others.

</comment><comment><USER25> I suspect sexual selection is partially to blame for this behavior subliminally. People who are "better" are a threat to finding good mates and a source of envy and thus despised.

</comment><comment><USER26> While reading I kept thinking that cooperating in the game has a tendency to equalize everyone in terms of savings. If everyone has very little, someone with something may feel he's a bit ahead and cooperation would effectively erode that savings. This is of course just speculation on my part but it's what came to mind. Kind of like how people making a bit above minimum wage (even in the US) resent the idea of raising minimum wage because in some ways it puts them at the bottom.

</comment><comment><USER27> I took part in this experiment. It was about 12-15 years ago.

The test was administered by the department of Economics of the University. They put flyers around the campus for volunteers, who would then get to keep any money they earned. Such experiments attracted students that wanted to make some money. Most students did not bother to participate .

The screenshots in the supporting material match what I saw on the computer screen. We were given the instructions and had some time to digest the rules. I calculated that the best reward would come if all were cooperating and I hoped that everyone else would figure it out. In that way, our group of four anonymous participants would get away with some extra money.

I was willing to cooperate, although I come originally from a country that did abysmally bad in this test.

During the first two rounds, I would put all funds into the pool. The rest of the group did not pick up the signal, did not put any funds or they put just a little. The game would work if everyone put all they funds in the pool, and in that case we would earn even more from the "bank". On the third round, I did not put any funds in the pool. I noticed though that some of the others players would persist in putting some small funds in the pool, as if they did not figure out what was going on.

Before reading this post, I thought that the experiment I took was rigged and you were playing against three computer players who on purpose were not cooperating.

During the next set of rounds with punishments, I did not contribute and neither did most of the others. There were some random punishments by the others which did not make sense.

Looking back, I can feel the inexperience of an undergraduate who could not understand that there could be a strategy that is beneficial to all.

Some comments said that communism can make people less willing to cooperate. I don't think so. The problem is the cultural attitude of the society, which transcends communism.

<comment><USER28> Just wanted to say thank you for taking the trouble to sign up to offer your first hand experience! It's both beautiful and little sad that your summary of the main finding (antisocial punishment) is "There were some random punishments by the others which did not make sense".

Reading the supplemental materials ([http://science.sciencemag.org/content/sci/suppl/2008/03/06/3...](http://science.sciencemag.org/content/sci/suppl/2008/03/06/319.5868.1362.DC1/Hermann.SOM.pdf)) it looks like the difference in "reward" for a cooperative strategy was on the order of $10 USD. Does that seem about right?

</comment></comment><comment><USER29> I have the feeling that it has something to do with the fact that being too cooperative makes live easy for the non cooperators. There must be many equilibria and some cultures stay at some middle level, they don't aim at the most productive ones out of fear not to be pushed into the least productive.

Imagine being a cooperator with an evil dictatorship: [https://www.lesswrong.com/posts/X5RyaEDHNq5qutSHK/anti- socia...](https://www.lesswrong.com/posts/X5RyaEDHNq5qutSHK/anti-social- punishment#TB6L54XEXry3qWCxT)

</comment><comment><USER30> Reminds me of the Ultimatum Game experiment[1].

1: [https://en.m.wikipedia.org/wiki/Ultimatum_game](https://en.m.wikipedia.org/wiki/Ultimatum_game)

</comment><comment><USER31> Disclaimer: tangent/speculation ahead :-)

"how people from different societies deal with cooperation and punishment"

Whenever I read some writing from Sustrik I wonder how related it is to his experiences in the nanomsg/ZeroMQ debacle [1].

Similarly, maybe I'm completely wrong but when I learned about Hitjens' "The Psychopath code" [2], and because of the timing, it was hard not to make a guess whose psychopath Hitjens had in mind :-).

I'm kinda curious to know how deep did the grudge between these two Software Engineers / Philosophers go.

1: [http://hintjens.com/blog:112](http://hintjens.com/blog:112)

2: [http://hintjens.com/books](http://hintjens.com/books)

</comment><comment><USER32> Not sure if that game is really measuring a cultural effect in a relevant manner. Is that really cultural after all?

On top of this, it is really difficult to see if the politics translate this cultural selfishness or altruism well into policies that are doing what is expected.

</comment><comment><USER33> It's a good time to remember that the replication crisis in social science still exists even if when a result confirms your preconceived notions, and that the bulk of the article is speculative brainstorming of hypotheses, not research.

</comment><comment><USER34> "Why do you have to make us look bad?"

</comment><comment><USER35> Could someone summarize this for people with reading difficulties (and for karma)?

<comment><USER14> Most Americans want to punish people when they harm the public good, but some cultures (especially former Communist countries) punish people that _help_ the public good for some reason. There's more speculation on why that is in the comments, but as always be careful reading those.

<comment><USER36> I'm eastern european so I hope you don't mind me chipping in my opinion as a reply to you.

I just simply don't trust the 'public good', aka the government. When I'm looking at my payslip, 46% goes to the state in the form of taxes. Out of all that's left, no matter if I save or spend, at least 19% of it will go to the government again in the form of VAT. A lot more if I want to become an entrepreneur or buy something big like a house or a car.

I pay a lot in taxes. A lot of people pay a lot in taxes, yet things have always been the same. Add in the political scandals that happen pretty much on a weekly basis: money siphoning or laundering, weird law bills, election fraud etc. and it's easy to see why people are distrustful of the government.

</comment></comment></comment><comment><USER37> Was surprised by the Melbourne result given the city is one of the most multicultural places in the world which you would assume give it a median result.

Done in 2008 so the current housing price blowout wouldnt explain everyone being totally out for themselves. Maybe tall poppy syndrome or the anti-dole bludger (freeloader) mentality would account for it?

</comment><comment><USER38> Those graphs could be so much clearer without the key, instead just have a straight line linking the data line with the name of the country, ordering the country names appropriately to avoid too many crossing lines.

</comment><comment><USER39> If you find this surprising you should check out "The Ugly Indian" TED talk.

[https://m.youtube.com/watch?v=tf1VA5jqmRo](https://m.youtube.com/watch?v=tf1VA5jqmRo)

</comment><comment><USER40> This article made me go back and play with [https://ncase.me/trust/](https://ncase.me/trust/) my favorite society simulator.

<comment><USER41> My only complaint about this presentation is the lack of forgetfulness and recovery of old strategies. In a word, it ignores context.

A world with only tit-for-tats effectively becomes a world of always-cooperate once the knowledge that defectors are a thing disappears from visceral collective memory.

And as an inevitable aftermath of that, the world of always-cooperate invites the return of always-cheat. Which invites the arrival of tit-for-tats.

However, the presentation's conclusion remains the same: viable actions in the world we inhabit are largely--but not totally--defined by the contexts that everyone brings to the table. And in most contexts, it pay out more to forgive than to retribute in the long run.

</comment></comment><comment><USER42> Voting for Trump might be an anti-social way of punishing those do-gooder liberals.

</comment><comment><USER43> Hm I thought that conclusion was interesting, they should try this in any US ghetto then, instead of just Boston for their check-the-box US representation.

I think it would have similar outcomes as the Ostblock countries, and less similarities with "The West and its strong rule of law"

<comment><USER17> I think it would be even further along the axis of cooperation. I happened to be in Detroit for some work in the late 90's. I took the opportunity to do some volunteering and saw some really weird things. Like farms that were basically squatting in collapsed buildings out in certain areas of the city. Basically, "secret" farms, that were secret to no one in the area, and nearly everyone was using. (Both planting and harvesting.) How anything got coordinated was beyond me? That said, one thing they _did_ have a handle on was who had done what, and people would argue when one of the "freeloaders" for lack of a better term, came along.

(I know. They were _ALL_ freeloaders, as it was _HIGHLY_ doubtful in my mind that any of them owned that property. But you know what I mean.)

I didn't really know the terms "pro-social" punishment, and "anti-social" punishment. But these guys were _FIRMLY_ in the "pro-social" punishment camp. And I got the very real sense that you just didn't mess with that.

<comment><USER44> Another way to look at it is that none of them were freeloaders, as all (or most) of them were making constructive use of the property.

</comment></comment></comment><comment><USER45> From Martin Sustrik a-la ZeroMQ.</comment>


YouTube's Demonetized Categories Revealed in JavaScript Source - <AUTHOR> https://www.youtube.com/watch?v=n3H8D2LrLHc <comment><AUTHOR> Basically they scraped 800k videos and found that in the javascript init data there was an "excluded_ads" key that gave them clues as to why a video was demonetized. After this video and another were made Youtube has now removed that key from their videos pages</comment>


Ask HN: What could happen if you accidentally leak your company's source code? - <AUTHOR> One of my colleagues has accidentally shared the source code of the project of one client for a few days on his personal Github. This project is worth several millions. When our company noticed, they dismissed him.
Does anybody know what can happen to him now?
Do you know if the customer sues our company, our company might sue him?
This has been a mistake, our company knows, and the client knows too, but I feel really worried for him.
Has anybody had any experiences with these kind of situations? Should he search for a lawyer? <comment><USER2> Depends: Did the "project" include lots of JavaScript? If so, there is probably nothing to worry about, the company will be bankrupt/liquidated soon anyway.

If we are talking about actual real software, like for example a missile guidence system written in ada, then there is also nothing to worry about: for normal humans it is utterly worthless and the chinese already have a similar system

</comment><comment><USER3> This is usually covered by business insurance. Company would need to claim gross neglectance or intent to make it personal. If your collegue was a contractor/freelancer (without business insurance) it would be worse. Then again if there was no damage calculated there's to claim to make. To be sure if possible get in writing there was no damage.</comment>


Ask HN: Opinion of thinking of startup ideas vs. not thinking of startup ideas? - <AUTHOR> Paul Graham states that not thinking of startup ideas leads to good ideas. Whereby, one develops a way of thinking of ideas unconsciously. Thus, the idea of working on side projects because they're plain interesting.
The other alternative is to constantly think of startup ideas. PG warns against this mode of thinking.
What is HNs opinion on thinking of startup ideas, vs. not thinking of startup ideas. There are many examples of successful companies using the latter strategy, but are there examples of successful companies using the former idea?
Overall, which is the more viable strategy? <comment><USER2> I just try to read a lot, absorb all kinds of ideas from all sorts of places - articles on HN, books, Youtube videos, Wikipedia articles, conversations with strangers at coffee shops, whatever... and then think about stuff and let the ideas pop out whenever / wherever they do. Some of the ideas I have might be good startup ideas, or not. Who's to say? I find a few from time to time that seem appealing enough to at least write down, or email to myself for future reference.

 _shrug_

</comment><comment><USER3> imo solutionism is only sustainable if you have a source of free money

<comment><USER4> Solutionism is a belief in the power of technology, in the most general sense of any applied knowledge, to eventually solve all problems. While any particular solution may create new problems, those are in turn solvable. (If you mean something different by the word, let me know.)

If you believe solutions exist, you can think of lack of money as just another problem to which there must be a solution. Indeed, any problem you care about probably requires solving several other problems before you can address the main problem. Getting money is just another step in the giant yak-shaving project.</comment></comment>


Half Life: Escape from City 17 (Part 3) - <AUTHOR> http://www.indiegogo.com/projects/half-life-escape-from-city-17-part-3

<comment><USER2> For another live-action re-enactment of Half Life 2, I suggest Freeman's Days [1]. Turn on captions if you don't understand Russian.

There are also a few short high production quality sketches based on HL2 as well, like the "gravity gun" from "corridor digital" [2].

[1] [http://www.youtube.com/watch?v=prkxiQsbu3M](http://www.youtube.com/watch?v=prkxiQsbu3M)

[2] [http://www.youtube.com/watch?v=5yCGRy_dR30](http://www.youtube.com/watch?v=5yCGRy_dR30)

[3] [http://www.youtube.com/results?search_query=half+life+2+live...](http://www.youtube.com/results?search_query=half+life+2+live+action&oq=half+life+2+live+action)</comment>


They want to hire me. What should I do? - <AUTHOR> http://mweser.de/help-they-want-to-hire-me-what-should-i-do/ <comment><USER2> Find out why the other programmer left. He left knowing full well that it'd leave the company in the lurch, and that's a pretty bad sign because it means that they've upset him enough that he doesn't care about hurting them.

Giving some basic armchair analysis, I'd assume that the mathematician gets a lot of kudos for his 'genius' inventions, and the programmer is treated like a second-rate code monkey who's just there the aid the oh-so-godly mathematician. If this is the case, then it's obviously not worth joining, but make sure to find out why the other programmer left.

<comment><USER3> There is a lot of speculation here. There could be plenty of plausible reasons as to why he would leave the company e.g. a better offer from elsewhere, family reasons.

<comment><AUTHOR> My feeling is that there was nothing bad going on with his decision. He lives quite far and had to travel every day two times about 2h, which i suppose is the main reason. However, your questions and concernes are reasonable and i will try to ask him.

</comment></comment></comment><comment><USER4> You need to decide if you want to be a PIG or a CHICKEN.

First decide that. Then decide what you need to be what you prefer. Then ask for it.

Nice thing about being a PIG here is that you can be reincarnated.

<comment><USER5> Since you were apparently needlessly downvoted I'll add some context.

[http://en.wikipedia.org/wiki/The_Chicken_and_the_Pig](http://en.wikipedia.org/wiki/The_Chicken_and_the_Pig)

<comment><USER6> The above post makes sense with this context, but I wouldn't say it was needlessly downvoted. A post doesn't stand on its own when it throws around uncommon metaphors without explanation.

Personally, I'd prefer of posts/articles all explained their metaphors and acronyms before using them. This is Hacker News, not Enterprise IT News. For example, the article tosses out USP and CI which I don't believe are very common terms either. They should be spelled out.

<comment><USER7> Continuous Integration is pretty common, but I have no idea what USP means.

<comment><USER8> USP is Unique Selling Point.

There's lots of technologists on HN and lots of business types, and only a subset of each understand the other's lingo. People should try and explain their lingo when they use it, for the benefit of the other camp :)

<comment><USER9> For people with government / federal contracting experience that aren't familiar with the 'USP' jargon (as I wasn't, once), the appropriate federal term is "key differentiator".

</comment></comment></comment></comment></comment></comment><comment><USER10> You have two problems, it seems. First, you need to figure out what you want to do. E.g. do you want to join them or stay with your current arrangement. Nobody on this forum can help you decide that. But make your due diligence on the company before you make up your mind (For one thing - figure out why that other guy left).

Assuming you do prefer to join them, you need to figure out what your price is. You seem to be afraid to make unreasonable demands, as you are in a position of power here. I would suggest that you take the approach of calculating what you believe your value is in terms of money per time unit (monthly, hourly, whatever). The difference between that number and what they can pay you should then be considered investment into the company and you should get compensated for that somehow. Most likely through equity.

Calculating your value is a much more objective task and therefore less fraught with tactics, feelings and whatnot. Just remember to calculate your value for the company in the current situation. In this case, your value is clearly very high, so it would only be fair to factor it in.

</comment><comment><USER11> > attractive salary

I guess you really mean "hourly rate", because salary means being employed.

> i have my own two-man company > They offered shares and assured immediate > budget for another developer

This sounds like an aquihire. So calculate what your own company is worth, add how much you earn within one year by staying your own boss, and round up to a lumped sum. Ask for this money in cash, and not in stocks, ask for same in stocks in addition, and add a good salary.

Their alternative is to continue paying you a hourly rate. But its your decission if you give up your freedom to become a wage slave again.

<comment><AUTHOR> sure "hourly rate" is correct.

I think such an "aquihire" ist not currently possible. They would certainly need to either sell a couple of systems or get VC. But hey, didn't i just write that i should stop thinking for them, too? I may take this into account talk it through.

<comment><USER11> I guess your 2nd man in your own company is (nearly) a close friend. So you betray him, if you leave without him. You might talk with him, what he thinks about it.

<comment><AUTHOR> of course i already talked to him. That's one of the reasons that i cannot guarantee more than 3 days/week. With two days i could keep my own thing up and running - but obviously progress or growth is more or less impossible then.

</comment></comment></comment></comment><comment><USER12> It's not your job to come up with the compromise. Tell them exactly what you need and let them counter. If they want you to stay around in some capacity bad enough you may get everything you ask for or at least a really good counter offer for you to consider.

<comment><USER13> Yeah, a logical middle ground is to stay freelance until they start actually getting sales instead of handing out "betas" (freebies).

</comment></comment><comment><USER14> Consider what your next best alternative is and bid at an amount that makes it definitely worthwhile for you to give that up.

It doesn't matter if that's _i get everything and you get nothing_ in your opinion, because you are giving the company a the choice to decide whether your offer is worthwhile or whether they have to go for their next best alternative.

</comment><comment><USER15> Interesting, if confusing post. Things are simpler than they seem, the complication is pricing the unknown.

Basically if I told you "I am from the future, this company is going to change its industry in a fundamental way, all the early people from here are rich and influential in the industry. Many have gone on to found new companies of their own and become richer and more famous."

You might take your existing practice, wrap it up, and jump in with both feet knowing that the "future" is assured.

If I say, "Hi I'm from the future and this company doesn't exist in that time, it tried really hard, floundered around and kept missing opportunity after opportunity. Eventually it ran out of money and everyone was laid off with no severance."

Now you say, you know I'll just stay a consultant as long as the checks don't bounce.

I've got really sad news for you, you can't.

The outcome is controlled by things that may contributed to by your negotiation, but probably won't directly depend on that negotiation. The absolutely best you can hope for is to learn something from the experience and to have fun doing it. Everything else is up to things you cannot control.

So sit down and decide if you want to work on this project full time, to commit to it and making it a success. Figure out if you will learn enough and get enough experience to make it worth while. There are obvious things you do like verify they folks are not crooks, and that they are telling you the truth. Ask questions about the future the company, its funding etc.

Since you are starting from a position of keeping your existing clients serviced, it sounds like you'd rather be a consultant than a full time employee. Listen to that if it is where your passion lies.

</comment><comment><USER16> If you really want to keep your consulting business, this is a great opportunity to bring on another person.

</comment><comment><USER17> Hey dude! went through a similar situation. Had a great relationship with them (startup), never doubt their word, the product was landing clients and valuation was awesome. Things didn't go as expected. Still have my business though it has come out damaged.

What I've learned: Don't ignore the signs, I never got to know why the previous developer dropped out. Ensure that you have a voice in every decision. Work with them, get to know them through rough times. Go over their metrics, are the clients really happy, is there any structural issue? Startups bullshit all the time.

Don't take any decision under pressure. If you have too, make them sign a contract that would protect you and you're current assets, that's what you're bringing into this enterprise.

</comment><comment><USER18> Freelancers (i am one myself) often have a fear of binding themselves to a single company for a longer period of time. This can be good or bad. When i got interviewed by a top european startup their HR thinking was like "Freelancers are more risky, because they might get bored quite fast and leave". Thats true to some extent, on the other hand i personally like the idea to really go deep on a project for 2-3 years instead of jumping from project to project.

In your specific case i wonder:

\- Would this be a project that you would want to work on for next couple of years even if it doesn't take off immediately ?

\- why did the other programmer leave if the company seems to be so well off ?

\- how good is the salary really ? If they had money, wouldn't they find good people in Hamburg quite easily ?

<comment><AUTHOR> To your first question: I had the exact situation with one of my former clients. The product didn't take of but still, i support them and if changes have to be made on their product i am still the one who does it. I guess, i would treat this new customer the same. This is basicly one of the reasons that i cannot assure more than 3 days - i sometimes want / need to work for my previous customers.

Second: my feeling is that there was nothing bad going on and the reason that he left is that he had to travel 2h twice every day. But i certainly will check that.

Third: I don't like to compare salaries but i think it is beyond avarage in this town. The problem is, that Hamburg is not quite the tech city, it is really hard to find good devs here.

<comment><USER18> hm sure? I believe Hamburg is probably one of the biggest places for startups in germany behind Berlin and i personally know quite a few awesome devs from HH. More web/mobile orientated though, you seem to be more into .NET based stuff.

</comment></comment></comment><comment><USER19> I had to make a very similar decision about a year ago. I came to the same conclusion: they could count on me just as much as a freelancer than as an employee, and I'd rather keep my options open rather than get tied to a single company, because I have my own, unrelated plans in the works.

I suppose one could make the argument that I'm going to miss out on a huge pay-day if I'm not that sort of committed. I am balancing the likelihood of that occurring + the likelihood they'd expect unreasonable overtime from me versus the likelihood that I'd find that my own way and the likelihood I'd be fine working overtime for myself. Freelancing is the only way I know how to maintain my work-life balance.

<comment><AUTHOR> >Freelancing is the only way I know how to maintain my work-life balance. my biggest "fear" is to be stuck there for years... so your way is currently my best option i guess.

</comment></comment><comment><USER20> Just remember, if you only give them three days like this, they will replace you ASAP. Sounded like they were over a barrel and you were fine without them, you should have offered to work full time for double the pay or some other super high price.

</comment><comment><USER21> Tell them what you'd like to have happen and see what they suggest in response. Since they like you already, they are unlikely to respond to hearing what you'd like by telling you to get lost. :)

</comment><comment><USER22> "When I'm not deep-in-the-zone ahead on a project writing awesome code, ..."

wow, that's some self confidence.

</comment><comment><USER23> Fir...tech world problem</comment>


How to start, publish and fail in 3 weeks - <AUTHOR> http://www.gamasutra.com/blogs/RohanWadsworth/20140124/209301/How_to_start_publish_and_fail_in_1_week.php <comment><USER2> You will find priceless info on how to master the business side of the mobile app industry on the Mobile App Flipping Podcast, at blog.appFresh.us

</comment><comment><USER3> The free version of your game does some funky things after a round of playing.</comment>


Hedge funds braced for second stock market plunge - <AUTHOR> https://www.ft.com/content/e1e1c3ef-1849-46bc-a472-2af8c0aabe5b <comment><USER2> > Paul Singer's Elliott Management, which has $40bn in assets, wrote in its > most recent letter to investors that since the impact of the economic > downturn is greater than that of the 2008 financial crisis, "our gut tells > us that a 50 per cent or deeper decline from the February top might be the > ultimate path of global stock markets".</comment>


Ask HN: When does the Apple-AT&T iPhone Contract End?  - <AUTHOR>

There is quite a bit of hooplah today about the new iPhone OS release. I've been searching for an article stating the month and possibly the day when the contract will end between apple and AT&T, but I only find articles that say sometime 2010.<p>So do you know when the Apple-AT&T iPhone contract ends? <comment><USER2> Most likely June 2010 is what I've read several places.

[http://www.businessinsider.com/apples-contract-with-att- is-d...](http://www.businessinsider.com/apples-contract-with-att-is-done-in- june-analyst-2009-11)

<comment><AUTHOR> It looks like you're right, thanks. I want an iPhone badly, but really don't want to support AT&T. Currently i am on Verizon and would love either iPhone or Nexus One unfortunately neither are available. Since my contract is already up, I may jump ship in june. Thanks Again!

</comment></comment><comment><USER3> In Canada, Rogers had a monopoly on the iPhone from July 2008 until November 2009, when TELUS and Bell were allowed into the market. So a 16 month run. Very different from the US.</comment>


Tabulator – Complex JavaScript Tables, Simple Code - <AUTHOR> http://tabulator.info/ <comment><AUTHOR> The latest 4.8 release comes with a load of great new features including a Horizontal virtual DOM for handling tables with large numbers of column, RTL language support and ESM Module importing.</comment>


HiFive1: A RISC-V-based, Open-Source, Arduino-Compatible Development Kit - <AUTHOR> https://www.sifive.com/products/hifive1/ <comment> TD-Linux I looked over the Chisel source code and the barebones datasheet [1]. This chip has a couple of unique features:

1\. It doesn't have any onboard NVRAM (same limitation as the open-v). However, it does have a directly memory mapped quad-SPI peripheral and icache, which is a great alternative and might be better for applications that require a large amount of data. Note that an icache would still be required even if it had onboard NVRAM, because of its speed. You could also make swappable game cartridges, for example.

2\. It has enough RAM and speed to run Opus.

3\. The rest of the peripheral set is pretty barebones, no analog like the open-v has. No I2C or I2S without bitbanging, either.

4\. The boot ROM has peripheral information stored in it. You might be able to have one binary that boots on different types of cores using this.

[1] [https://dev.sifive.com/documentation/freedom-e300-platform-b...](https://dev.sifive.com/documentation/freedom-e300-platform- brief/)

<comment><USER2> I'm worried this leads to the zoo of random hardware that we see on ARM, which makes supporting Linux distros on ARM such a PITA.

It would be better if the basic hardware — serial ports and such — was in a standard location for all RISC-V machines, and all the rest of the hardware was discoverable at runtime (like PCs, mostly).

<comment><USER2> The parent comment has proven oddly controversial going down to 0 and up to +5 and back down again. So let me try to do better and clarify what I mean. For context, I am maintaining Fedora on RISC-V: [https://fedoraproject.org/wiki/Architectures/RISC-V](https://fedoraproject.org/wiki/Architectures/RISC-V) .

On a PC, there is a serial port at a standard location. It's not "discoverable", but every PC you care about has one at the same address, and it's incredibly easy to use with a tiny bit of assembler. You can always print messages, even in the earliest parts of early boot.

On non-PC platforms (I've used ARMv7, ARMv8, POWER) there's a zoo of serial ports. There are at least a half dozen different bits of hardware, on different ports, self-describing, not discoverable at all, or mentioned in device tree in multiple different ways. Some even require PCI so needing ugly hacks to output early boot messages.

Critically, if you get the wrong serial port, you _cannot see any boot messages at all_. There's no way to tell what's going wrong.

So I think, for serial ports, the PC approach is definitely, clearly better.

For other hardware, it should just be self-describing. PCI and USB are the model examples here. And in fact, why not just use those?

<comment><USER3> I agree on the serial port thing. That's one device which I think should be architecture-standard. I can't imagine bringing up firmware or debugging a kernel without a low-level system serial port. It also makes remote management a lot easier, because the remote console can hook into that in a standard fashion.

</comment></comment></comment></comment><comment><USER4> 320 MHz core clock is very impressive, compare to <= 200 MHz typical of Cortex-M3/4 impls. However at this freq, flash (instruction) readout becomes the bottleneck. While Cortex-M chips typically include some on-chip flash acceleration, this chip instead went for external flash + I-Cache. The new Cortex-M7 chip STM32F7 has both flash accel and I-Cache. It remains to be seen whether this chip can sustain real-world workloads at 320 MHz with 0 wait state. Even at 200 MHz it has the potential to replace proprietary fixed-point low-end DSP chips.

<comment><USER5> Modern non-volatile RAM technologies (like XPoint) would be perfect for chips like this. Much faster than flash and usable as RAM.

</comment></comment><comment><USER6> I like that 3.3V and 5V I/O is supported, so many Arduino shields assume 5V and so "compatible" boards like the ST Nucleo boards aren't actually compatible.

</comment><comment><USER7> For someone who has no idea what RISC-V is but loves making things with Arduino, what new things could I do with this?

<comment><USER8> Agree, for some who has no idea what RISC-V is, which I'm guessing is more than 50% of visitors, the "why" on the page needs to sell me on why RISC-V is better or at least better for certain things.

<comment><USER9> If you aren't interested in architecture, there's probably no particular reason for you to buy this at this point. RISC-V is just getting started, so there aren't huge practical benefits yet. In the long run, we'd obviously prefer to use open-source unencumbered hardware, which is the point of the RISC-V project.

<comment><USER10> If RISC-V really takes off and you're a first mover writing the low-level stuff for it then the early mover advantage is a good investment.

</comment></comment></comment></comment><comment><USER11> 320mhz clock speed but only 16KB of RAM.

RISC-V is appealing but if I'm stuck at 32KB or less of RAM I'd stick with the Parallax Propeller which has 8 parallel 100mhz cores.

<comment><USER12> I'm not sure that's the whole story - specs read:

Memory: 16 KB Instruction Cache, 16 KB Data Scratchpad

I'm wondering if it's possible to combine that or dice it in some way? On top of that, the program resides in SPI flash (128 Mbit -> 16 meg).

EDIT: ok - the above makes no sense, so yes, on 16K on-board RAM (and the other is for cache).

Short of more info, I'd be willing to bet that some of that flash can be set aside (or used like) variable space (albeit at a slower speed), and the on- board memory is more for high-speed stuff (and you'd have to swap things in/out - though likely they'll have a library for all of that - maybe).

If all of that is true (or close to the truth) - well, I don't know if it would be better than the propeller or whatnot, but it certainly looks interesting...

EDIT:

Reading the infosheet on the processor:

[https://dev.sifive.com/documentation/freedom-e310g-0000-manu...](https://dev.sifive.com/documentation/freedom-e310g-0000-manual/)

It does seem like the flash can be used for data and program space - and it appears like it can be read/written to from the cpu - so it's kinda like the flash storage on the Arduino. I would imagine it can be used similar - although slower - as variable memory (given a proper lib); and "paged" into the faster on-board 16k RAM.

<comment><USER13> You're correct, you can access the 128MBit SPI Flash as any other read-only memory mapped memory -- you can execute out of it or load data (you can also write to it but need to use a seperate channel, it's not directly memory mapped to write).

You're also correct on the sizes of the ICache and Scratchpad. You can execute code which resides in the scratchpad, but can't store data in the I-Cache.

<comment><USER11> Does the MCU expose address lines to wire in external RAM?

<comment><USER14> No. The only external addressing is through QSPI0, and that only has one chip select line hooked to it. They do make small amounts -- 512k -- of SPI RAM, but that on its own would make the chip boot process interesting.

</comment></comment></comment></comment></comment><comment><USER15> Two points: a short question and a longer theory about why only 16KB.

The question: how viable is an open-source, publicly-auditable secure boot implementation? Not TPM theater or whatever, but a hardened hardware configuration that could be used to implement _truly_ verifiable boot.

(If anyone from RISC-V is reading this, I think there is a very noteworthy amount of money in building a _truly_ securely bootable reference design. Hopefully lots of people have already told you that.)

\--

Next, regarding why only 16KB RAM...

I'm very interested in the potential of open source ISA, but admittedly completely ignorant about chip design.

With this in mind, I have a theory that the manufacturers deliberately provided a ridiculously low amount of RAM in order to make it impossible[1] to run Linux on it and so keep it out of the mass market.

Considering the CPU is full 320MHz I don't think this is because they have some other product up their sleeve. Rather, looking at the fact that this is the first marketed product they have available that's an actual real chip (!!), I would expect that either the chip itself and/or the chipset likely has bugs in it. They've gone through many internal revisions, and now they feel comfortable with putting the chipset out there for public testing to get bugreports from the field.

My thinking is that applications that will play nice with 16KB of RAM will stress the CPU out significantly less than full Linux would, similarly to how doing basic tasks on a faulty x86 PC may work for years but compiling GCC will find broken bits in RAM sooner or later.

There's also the fact that such projects are also generally quieter as a whole than the thundering herd of people wanting to run Linux on things.

Don't forget, RISC-V has been nothing more than a bunch of VHDL for years, running on "perfect" FPGAs that don't require you to think about low-level electrical niggles and whatnot. If I'm understanding correctly, this is the first time a real RISC-V chip run has been done (?) and made available to the market.

Considering the success of ARM (or, more generically, the market sector of "little PCBs that run Linux"), RISC-V needs to stay competitive and attractive - and full Linux that constantly oopses in mm.c will make RISC-V look real bad real fast. I definitely want the ISA to thrive, and if my assumptions are correct capping the RAM makes an inelegant-yet-elegant sort of sense.

I expect RISC-V will be running Linux on real fabbed chips within the next two years.

[1]: Well, _practically_ impossible. If you don't mind 300KB/s RAM (yes, KB/s, not MB/s) there's always [http://dmitry.gr/index.php?r=05.Projects&proj=07.%20Linux%20...](http://dmitry.gr/index.php?r=05.Projects&proj=07.%20Linux%20on%208bit) :D

<comment><USER16> > how viable is an open-source, publicly-auditable secure boot implementation?

Depends if you trust your fab. I suppose you can take random samples and decap them at considerable expense, but then the public has to trust the auditor.

> I think there is a very noteworthy amount of money in building a truly > securely bootable reference design.

I disagree. I think there are two critical problems with this: firstly, getting the community to agree on what they consider "truly secure", and secondly getting enough people to buy a system that is (necessarily due to small production runs) slower and more expensive than comparable Intel or even ARM.

If you're willing to trust a manufacturer you can buy secure-bootable ARM devices today with OTP key regions that boot Linux (e.g. iMX). So the market for the proposed "open" system is _only_ people who are willing to trust you but are paranoid enough to not trust one of the existing manufacturers.

<comment><USER15> All these points are very true; chains like these are unfortunately based on a root of implicit trust.

I make some counter-arguments:

Secure boot forms the trust basis that the device is definitively running the code you put on it without modification, so is arguably the most security- sensitive aspect of the system, in some ways more critically so than the kernel, network-facing daemons, etc. It is at least _as_ important as those components.

I'm confident a publicly-auditable open-source secure boot implementation would attract fairly reasonable academic interest from the security field and be hacked on (from theoretical design down to implementational edge cases) by the community until it was very very good.

That would help avoid this sort of thing - [http://www.cnx- software.com/2016/10/06/hacking-arm-trustzone...](http://www.cnx- software.com/2016/10/06/hacking-arm-trustzone-secure-boot-on- amlogic-s905-soc/) \- which is currently only an issue because vendor engineering teams are not perfect and there's no widespread collaboration. (There is, of course, also the likely truth that there are similar "vulnerabilities" in all commercial secure boot implementations. Think TSA007.)

The one issue I will acknowledge is that if such a reference design existed and was widely implemented, it would be a very good question as to which manufacturers had "accidents" in the manufacturing process near the secure- boot areas of the chips.

If I understand correctly, the other very major issue (which is kind of really ironic considering what I've just said) is that you have to sign NDAs to understand how the implementation works, and AFAIK even to just use it. So I (a random tinkerer) can't configure a "really trustworthily secure" Linux system, only a major manufacturer/system integrator/etc can. I understand this situation but from the standpoint of paranoid individual security it's crazy - security by obscurity, anyone?

If it is possible for me to play with OTP on iMX from a hobbyist perspective without shelling out for some NDA'd SDK, I'm tentatively interested for what it's worth.

<comment><USER16> imx53 is sort of possible to play with: [https://cache.freescale.com/files/32bit/doc/ref_manual/iMX53...](https://cache.freescale.com/files/32bit/doc/ref_manual/iMX53RM.pdf)

Boot documentation is chapter 7. References "high assurance boot" functionality in the onboard boot ROM, but doesn't give out docs for the ROM. On the other hand, it's not a large ROM so you could just dump and reverse- engineer it.

<comment><USER15> Interesting... but I find it really amusing that my propositions are to reverse-engineer the secure boot system in order to take advantage of it, and also the fact that the reverse-engineering process won't be that hard. For what I assume is a security-by-obscurity design... reverse-engineering should by definition be really hard I would think, at least at face value.

</comment></comment></comment></comment></comment><comment><USER17> So does it have a MMU? That would make it even more superior to Arduino boards.

<comment><AUTHOR> It seems to me that an MMU is no good if the board doesn't have enough RAM to run a general-purpose operating system, as opposed to a bare-metal program or a real-time OS like a microcontroller usually uses.

<comment><USER18> > It seems to me that an MMU is no good if the board doesn't have enough RAM > to run a general-purpose operating system, as opposed to a bare-metal > program or a real-time OS like a microcontroller usually uses.

For a realtime operating system at least a Memory Protection Unit (to use the word that ARM introduced for this limited form of an MMU) is very useful since it can easily make the OS much more reliable if a process cannot write to memory adresses of the kernel or other processes.

EDIT: Or is such an MPU implied by the support for "Privileged ISA Specification v1.9.1"?

<comment><USER19> > is very useful since it can easily make the OS much more reliable if a > process cannot write to memory adresses of the kernel or other processes.

If you make use of memory safe systems programming languages on bare metal, like Ada, SPARK, Rust, Oberon-07 than it isn't usually an issue, since the unsafe code will be quite constrained.

For example, [http://www.astrobe.com/boards.htm](http://www.astrobe.com/boards.htm)</comment></comment></comment></comment>


Google's New Patents Aim to Make Your Home a Data Mine - <AUTHOR> https://www.theatlantic.com/technology/archive/2018/11/google-patent-bedroom-privacy-smart-home/576022/ <comment><USER2> So it begins.. No surprises though, I mean if you didn't think Google would mine your personal devices for their own interests, what planet have you been living on?

</comment><comment> tonic-music Disgusting. Another reason to delete your Google account.</comment>


The Marissa Mayer turnaround - <AUTHOR> http://www.guardian.co.uk/technology/2013/mar/25/yahoo-work-life-balance

<comment><USER2> What turnaround? She may be making people work more but what is she making them DO exactly? From my admittedly limited perspective her direction looks wrongheaded. I can see more possibility for a truly modern high tech media company to uplift traditional media (They could pick up where google reader left and extend RSS to the next level for example,building relations with publishers) than competing as a more or less direct competitor to google. Competing with google in the US without a revolutionary take on search and/or hardware is like entering an ass kicking contest with a porcupine. I may have got completely the wrong impression of her strategy here as Im not associated with any company mentioned so I have to rely on media channels but it does sound like she is trying to recreate google in yahoo.</comment>


OpenSpiel: A Framework for Reinforcement Learning in Games - <AUTHOR> https://github.com/deepmind/open_spiel <comment><USER2> the tl;dr:

* C++

* with python bindings

* implement your game actions and state in C++

* then can pump the state and legal actions into an algorithm (that you write)

* has some implementations for some algorithms (minimax, monte carlo) & games (tic-tac-toe, chess, backgammon)</comment>


Tesla – How to Enable Developer Mode and Other Secret Modes - <AUTHOR> https://fn.lc/post/tesla-model-3-modes/ <comment><AUTHOR> Post can also be accessed via IPFS [https://gateway.ipfs.io/ipns/Qmea45XwFtdwaCGAPLRMxFmoUP5YLnk...](https://gateway.ipfs.io/ipns/Qmea45XwFtdwaCGAPLRMxFmoUP5YLnknc2WGCGQ3HnDP6f/post/tesla- model-3-modes/)

I've spent a lot of time digging into the Tesla software and hardware. Let me know if you have any questions! :)</comment>


Timeout: Ruby's Most Dangerous API - <AUTHOR> http://www.mikeperham.com/2015/05/08/timeout-rubys-most-dangerous-api/ <comment><USER2> If you're looking for an HTTP library with an advanced timeout API that doesn't use Timeout/timeout.rb (but instead uses an asynchronous I/O layer), check out http.rb:

[https://github.com/httprb/http](https://github.com/httprb/http)

<comment><USER3> Is there any real alternative to celluloid/event machine? I've seen enough of EM's implementation to be skittish using it. Ruby's async story is in a dire state if people are seriously using Timeout today, and it doesn't look like you could plausibly write an alternative AVOIDING event machine. Thoughts?

</comment></comment><comment><USER4> I've found this list particularly helpful when tearing the stdlib Timeout out of legacy projects - [https://github.com/ankane/the-ultimate-guide-to-ruby- timeout...](https://github.com/ankane/the-ultimate-guide-to-ruby-timeouts)

Not comprehensive, but covers a surprising number of gems.

</comment><comment><USER5> Naive question from a Python programmer: Does this problem come from Ruby not having a standardized exception-safe way of freeing resources (like Python's `with`)? Or is there a de facto standard way to do that, and some libraries just forget to use it?</comment>


Ask HN: Aspiring developer seeks professional advice - <AUTHOR>

Quick backstory:
1. I'm from the UK, when I was doing A levels, I was performing as a musician all over the UK, which made a ton of money (relatively) at the time for me, and I thought it'd last forever. It didn't. I let my A level grades totally slip, and...
2. In this time I've built and sold several online businesses which I won't detail in order to stay anonymous, but let's just say I take my self-education very seriously and have developed serious entrepreneurial balls. I spent all the damn money and let my nut run out. My fault.
3. I'm screwed, 20 years old, and have bad A levels..what do I do? I'm damn good with computers, dabbled in it from time to time and thoroughly enjoyed it, so I'll do Computer Science as a degree and go into being a programmer, with the added benefit to my future employers of being a pretty good copywriter - who gets results analytically.
4. Damn I have bad grades. I can only get into london met university, which doesnt have an excellent reputation.
I'll have to make the best of this situation no doubt, but my biggest question to you is, if you were in my situation, with a stellar track record for a 20 year old, but bad academic prospects, and being in the first year of a degree with THE bottom-rated university of the UK..
what would YOU do, in order to get into a career as a developer? <comment><USER2> find me on twitter @ze_fi let's talk further</comment>


Show HN: Anyfetch – Get relevant information directly in your inbox - <AUTHOR> http://anyfetch.com/

<comment><AUTHOR> Hi! I'm Robin, an engineer at Anyfetch. Ask us anything. We're pre-launching the product and we would like some HN feedback!

<comment><USER2> Can you say more about how you got the idea people want to be scheduling meetings? I find I often want to bail out of meetings, not encourage them.</comment></comment>


TrollingMotors.net Auction Follow-Up - <AUTHOR> http://www.ecommercefuel.com/store-sale-follow-up/

<comment><USER2> OP here. Happy to answer any questions on the process, the auction or the closing.

And thanks for submitting, akcreek!

<comment><USER3> Do you feel the reverse auction approach left money on the table? I know you got a bit of push back on the price from those looking for a "deal" but you have a potential sale at your top price.

</comment></comment><comment><AUTHOR> Follow up from: [https://news.ycombinator.com/item?id=6733680](https://news.ycombinator.com/item?id=6733680)</comment>


PineBook Pro (open source ARM laptop) - <AUTHOR> https://wiki.pine64.org/index.php/Pinebook_Pro <comment><USER2> Thanks to Alyssa Rosenzweig and the Panfrost team for reverse-engineering the Mali GPU.

We can start moving out of the Intel/AMD backdoors and start to equip ourselves and our communities with trustworthy computers : ARM-based for now, RISC-V-based for later.

<comment><USER3> What assures the trustworthiness of this RK3399 platform?

<comment><USER4> The same thing that "assures the trustworthiness" of every other computer ever made: nothing. What is the purpose of asking a question so vague as to be unanswerable?

<comment><USER3> It's not "so vague as to be unanswerable". It's an explicit response to the implication that non-Intel/AMD systems somehow lack backdoors. What's the absolute proof that this laptop (or some future RISC-V based one) lacks a backdoor?

<comment><USER5> That question isn't better. Of course there is no absolute proof. That doesn't mean the situation isn't significantly better then on AMD/Intel.

</comment></comment></comment></comment></comment><comment><USER6> Stefan Schaeckeler wrote an excellent review of the PbP[0]. The following excerpt might be interesting to some.

 _The Pinebook Pro is an open laptop but also a black box at the same time. It is not possible to debug early boot problems without a serial console cable._

The cable costs $6.99 currently and is a separate product[1].

Personally, the only reason stopping me from getting this laptop is the import tax. A quick search on the Pine64 forum revealed it to be around $100 for my country. Adding all the expenses, $350 for this machine is much more than what I can spend.

[0] [http://students.engr.scu.edu/~sschaeck/misc/pinebookpro.html](http://students.engr.scu.edu/~sschaeck/misc/pinebookpro.html)

[1] [https://store.pine64.org/?product=pinebook-serial- console](https://store.pine64.org/?product=pinebook-serial-console)

<comment><USER7> I think people interested in early boot logs are also able to build their own debug cables for $0.

<comment><USER6> I meant the cable is not included with the laptop.

</comment></comment></comment><comment><USER8> I had ordered one of the other models early last year and it did take 2-3 months before I heard that it was shipping, and then it was another 2-3 weeks before it arrived. Their packaging was good enough to protect it, being in a plastic case. I have no issues with the one I have and, pending seeing other's experience with this new model, will definitely consider one of these. Be patient, that's all I can say.

</comment><comment><USER9> This project is well-known enough to have had several big threads on HN:

[https://hn.algolia.com/?dateRange=all&page=0&prefix=true&que...](https://hn.algolia.com/?dateRange=all&page=0&prefix=true&query=%22PineBook%20Pro%22%20comments%3E10&sort=byDate&type=story)

...so the project wiki page is probably too generic to make a good HN submission. It would be better to wait for SNI (significant new information).

I wrote about this issue recently: [https://news.ycombinator.com/item?id=23071428](https://news.ycombinator.com/item?id=23071428)

</comment><comment><USER10> I ordered two of them (one by accident, LOL) two months ago. Haven't heard anything since. No order updates. Emails to their sales team have gone unanswered. Not sure if my case is typical but that might have been $450 I never see again …

<comment><USER11> I got mine in the UK a while ago and it did take a while to arrive, but I'm sure you'll be fine and get yours soon.

Got mine running Manjaro XFCE (installed on internal storage) and it's great. The screen is really nice.

<comment><USER12> Is it running the mainline/current stable kernel or is it something with out of tree patches that's behind?

<comment><USER4> The latter, but they're actively trying to get those patches upstreamed, which is more than most arm vendors do.

<comment><USER12> That's awesome. I've ordered the PinePhone and I know that's already mainline, so I trust them more than most other vendors to keep their word.

</comment></comment></comment></comment></comment><comment><USER13> It's worth mentioning they should be fully supported in OpenBSD 6.7, which came out this week. I haven't tried converting mine yet, but it's good to have options.

</comment><comment><USER14> Anyone with one can comment on performance?

Because the pro made me think "enough to be a dev machine" but the price suggests otherwise.

<comment><USER15> Whether ~$50-$100 ARM SBCs are powerful enough to make a dev machine for you depend on a lot of things. I wouldn't want one for my day job, but these would be sufficient for nearly all the coding I do on my free time.

It's in the same ballpark with Raspberry Pi 4. A bit more powerful.

<comment><USER16> Things that make an Rpi4 + 4GB memory unsuitable as a development machine: needing to use more than one webshit thing at a time (heavier versions of gmail, Jira, Asana, Slack), needing to use a heavy Java IDE, or needing to run more than one or two very small VMs locally. If you _do_ need those things but can offload them to remote VMs with X forwarding or VNC or whatever, then they're still fine.

A Pi4 is downright _spacious_ and plenty capable if you can avoid that junk. Which are also the same things making old 4GB laptops "too slow" for modern development, and even 8GB machines feel cramped.

<comment><USER17> Answer is don't load those.

I use a Jetson nano with 4gb RAM. Vim and Firefox has been fine for writing go and python.

</comment></comment></comment></comment><comment><USER18> I ordered one of these just a few days ago after months of being on the fence. Very excited for it to come, though from friends' experiences (and it appears many people in this thread) I expect a tantalizing wait.

</comment><comment><USER19> _> Only use one power input at a time, barrel jack OR USB-C_

This looks very problematic as user may not expect or not know if the device they connect to USB-C will provide power or not.</comment>


The Man with an Elephant's Nose - <AUTHOR> https://earlymodernmedicine.com/the-man-with-an-elephants-nose/ <comment><USER2> This reminds me a bit of Alejandro Jodorowsky's approach to psychotherapy[1], in which trauma and neurosis are resolved by performing an act related to them. For example, if conflict was left unresolved with someone who has passed away, he instructs talking over the problem at the grave, and then painting "peace" with honey over the tombstone. Most of his suggestions are quite outlandish I recall his cure for agoraphobia was having your friends carry you inside a sleeping bag to a plaza where they would simulate your "birth into the world".

[https://en.wikipedia.org/wiki/Alejandro_Jodorowsky#Psychomag...](https://en.wikipedia.org/wiki/Alejandro_Jodorowsky#Psychomagic)

<comment><USER3> I thought of course it couldn't've been _that_ Jodorowsky. I checked the link and realised of course it had to be _that_ Jodorowsky. Imagine living The Holy Mountain.

</comment></comment><comment><USER4> What a fascinating write-up!

The discussion seems to hint at something I've seen effective working with several family members succumbing to Alzheimers/dementia: when possible, play into the world as they see it. Something causes these folks to disconnect from a full reality, and being told you're wrong and being constantly corrected irritates/aggravates. There are limits to this, certainly, but I've found it easier to lean into it overall.

<comment><USER5> Yes! My dad had Alzheimers and got OBSESSED with his kindle somehow being broken. No reasoning could convince him it was working fine -- which it clearly was. I ended up just faking a call to "amazon kindle support" and two minutes later he was fine thereafter.

</comment></comment><comment><USER6> > _a fourth case described 'a certaine Gentleman' in a 'fooles paradise' who > was so utterly convinced that he was dead that he refused to eat or drink. > His 'frends and 'acquaintaunce', after a week were worried that he might > starve to death, so they arranged for some people dressed as shrouded > corpses to eat in front of him, and persuade him to join them in their > posthumous feast. The gentleman happily ate his fill and they managed to > slip him a sleeping draft, the sleep being credited with his subsequent > cure._

Sounds like Cotard's delusion: [https://en.wikipedia.org/wiki/Cotard_delusion](https://en.wikipedia.org/wiki/Cotard_delusion)

</comment><comment><USER7> Seems a bit like the mirror boxes they use to help phantom limb pain for amputees. I suppose, though, maybe the mirror boxes aren't purely psychology, but something to do with nueral pathways?

</comment><comment><USER8> Sounds like a case of Trombipulation to me.

[https://youtu.be/WaVzajICS-w](https://youtu.be/WaVzajICS-w)

</comment><comment><USER3> The combination of the font color and weight makes the article difficult for me to read. It could be my monitor so YMMV.

</comment><comment><USER9> Can we call this form of treatment "placebo therapy"? If not, how is it different than using placebo substances?

<comment><USER10> Why not? That would be in line with what these physicians were doing which was benign actions whose intent was to alleviate suffering.

It seems that the greater point is that instead of reacting to mental illness by telling people,"you are sick and mentally unfit", they are trying to alleviate stress and suffering in that moment and then getting people to rest. Many mental disorders can be aggravated by stress and lack of sleep so it may not be surprising that this provided tangible benefits to the individuals being treated in this manner.

</comment></comment><comment><USER11> Early medicine stories are always great!</comment>


It's not a bug, it's a puzzle - <AUTHOR> https://hackernoon.com/its-not-a-bug-it-s-a-puzzle-600a8734a9c6 <comment><USER2> The article repeats the urban myth:

        The origin of the word bug as
        it pertains to engineering goes
        all the way back to 1947 when
        Dr. Grace Hopper discovered a
        moth stuck in one of the relays
        of the Mark II computer.

It goes back further than that - there's a cartoon from the 1930s in which a prospective car buyer lifts the bonnet/hood and some moths fly out, with the voice-over saying "The engine still has a few bugs to be worked out."</comment>


Ads in Paid Apps Are Rude or The Internet's Preposterous Sense of Entitlement - <AUTHOR> http://blog.benmcredmond.com/ads-in-paid-apps-are-rude-or-the-internets-pr

<comment><USER2> If you want to make revenue from ads, then do so. If you want me to buy your app, don't also make me pay with ads. This seems perfectly reasonable.

<comment><AUTHOR> Why is this different than buying a newspaper — in the case I'm talking about, you're also getting a constant stream of new content, which you obviously don't with a newspaper. (I'm genuinely asking)

<comment><USER2> I don't buy newspapers and I canceled my cable when they started (in addition to putting commercials in my shows) putting _audible_ bugs over the shows I was trying to watch.

</comment></comment></comment><comment><USER3> I too have thought about how ads in paid apps seem "rude," but lately, I have begun to wonder if there is actually a middle ground. If you decide to sell your application for a low price when you know that users would be willing to pay much more, is there something wrong with using ads if you let the user know before they purchase? I am pretty conservative when it comes to buying mobile apps, and I think I'd be a lot more likely to pay for a $0.99 app with unintrusive ads, than pay $5.99 and never see ads.

</comment><comment><USER4> Ads are the last thing I want to waste limited smartphone screen real estate on. I'll happily pay to avoid ads, but there's no way I'm going to pay for something that forces me to wade through ads. If your app isn't profitable, raise the price.

<comment><AUTHOR> In this case I'm talking about apps where there is a constant cost to providing the app (i.e. it's a service) — rising the price doesn't fix the problem, a paid subscription would be the alternative.

</comment></comment><comment><USER5> It is not a sense of entitlement--- it is years of watching network television where the content (that cost millions) doesn't cost the viewer one red cent; it is all supported by advertisements.

<comment><AUTHOR> Which make a lot less money online...</comment></comment>