How Much Money I Made From Side Projects In 2010 - <AUTHOR> http://pseudocoder.com/archives/how-much-money-i-made-from-side-projects-in-2010

<comment><USER3> This is very inspiring! Matt, for your next post(s), in addition to the monetary costs I'd like to hear about how much time you put into maintaining and supporting these projects. I can imagine that with a couple of thousand users you could easily spend a lot of time answering support emails.

<comment><USER4> You'd be surprised how easy it is to support web applications, if you work on killing the issues which continue to cause support requests. (BCC had something like 75k trials in 2010. My support load is typically well under an hour a week.)

Maintenance in terms of "Making sure stuff doesn't break" also doesn't have to take a lot of time. January was a _bad_ month for me, and that only took about one hour of firefighting and one hour of (hopefully) preventing the next firefighting.

<comment><USER5> Wow, that's shockingly low! I'd have guessed at least a few hours a week in answering customer emails.

</comment></comment></comment><comment><USER4> Hat's off, that was some fantastic growth last year. If you're ever in the mood for chitchatting, I also sell to your market and know a few things about a few things.

<comment><AUTHOR> That would be great.

I actually emailed you in the beginning of '09 after reading about your site in Bob Walsh's MicroISV book. You took the time to send a lengthy and detailed response which was very appreciated.

<comment><USER4> Heh, I saw that when I searched right after posting the above comment. My thought was "Oh goodness, there is totally egg on my face if he has already emailed me and it slipped through the cracks."

</comment></comment></comment><comment><USER6> Is that market averse to monthly subscriptions? Charging $5/mo. Could triple your revenue and turn a side biz into the main stage. And 5 bucks is a latte a month.

I recall patio11 speaking about marketing to the educational market but not sur if he covered recurring subscription revenue vs. Flat annual rate or not.

</comment><comment><USER7> Nitpick - I think you mean "revenue" not "earnings". Nice article though - very inspiring.

<comment><AUTHOR> You're right. I fixed it.

<comment><USER8> Thank You

</comment></comment></comment><comment><USER9> Nice article Matt.

I taught high school CS for ten years and can tell you from personal experience that you are scratching at the surface of a very promising market. Most schools hand out the traditional lesson plan books at the beginning of the year during faculty meetings and in-services. They are a pita to fill out and maintain and frequently change year to year if you are worth your salt

However, I believe your sales would increase dramatically were you to target administrators and department chairs instead of individual teachers. $20 per instructor is well within their annual budget and they are very open to ideas that make day-to-day operations smoother.

Making it possible for parents to view the lesson plans would enable you to engage entire districts without much difficulty.

Well done.

<comment><AUTHOR> Any tips on the best way to approach admins or department chairs?

<comment><USER9> Start local. Work with a couple of elementary schools and a couple of high schools. Ask them to beta the product in exchange for feedback. Help them load it on their server and start with a small group.

And then make it work for them. You have a good product.

Most schools have a curriculum director (or someone in that capacity) in charge of coordinating classes, adding and dropping courses, etc. They usually interact with everyone from admins to teachers.

Principals are the decision makers but asst principals do a lot of the implementation.

You'll be able to cold call with no problem. And now's a good time of the year to lay the ground work for 2011-2012.

Here's the key: be functional and very useful. Schools are up to their eyeballs with the latest wiz-bang gadgets.

Your product may qualify under some kind of Federal Grant. Many schools have part/full time people whose job it is to manage grant applications. They'd be able to help you as well.

<comment><AUTHOR> Thanks, great advice.

</comment></comment></comment></comment><comment><USER10> Hey Matt, out of curiosity, why do you want to avoid this blog post showing up in Google searches?

Thanks for these posts, by the way--I find them patently inspiring. It's nice to know I'm not the only developer with a million ridiculous project ideas. Keep up the good work!

<comment><AUTHOR> I've been going after some big schools and entire districts lately, so I worry that they'll be less enthused if they knew I was just one guy doing this on the side.

<comment><USER11> Would love to hear about how you market to school districts/large school units.

I built a product (back in 2008) that was aimed at the education sector for students and teachers to use to study in groups, but alas it never got much traction with large groups like I intended. But it was heavily popular with international users from (mainly) Europe.

I had pretty much 0 luck marketing to school districts or schools, just a few classrooms.

It seems the school district market is a hard nut to crack that I've been wondering how one can angle on..

<comment><AUTHOR> Going forward I'm also listed in the Google Apps Marketplace in the EDU section ([http://www.google.com/enterprise/marketplace/viewListing?pro...](http://www.google.com/enterprise/marketplace/viewListing?productListingId=6528+15556554624571304041)), which has gotten me a few inquiries.

<comment><USER11> Awesome, so good SEO and a platform where people are _looking_ for this type of thing.

Thanks a ton for the tips Matt!

</comment></comment></comment></comment></comment><comment><USER12> Thanks for the inspiration. I needed it.

</comment><comment><USER13> FYI: Matt, your "redacted" links on the 2008 and 2009 versions of this article still link to the site in question. The Twitter link on the 2009 article actually links to the Twitter account in question, too.

</comment><comment><USER14> Very, very inspiring. I love posts like this (as we all do) because it's a good way to benchmark my own projects and gives me hope for future projects. When I finally round the numbers up (hopefully later this week) I'm going to make a post detailing the financials of my little 4-hour profitable project (<http://news.ycombinator.com/item?id=2176771>)

</comment><comment><USER15> As I see it, both your renewal rate and the number of free users are high enough to launch a promotion (e.g.: $10 instead of $20 for the first 12months).

</comment><comment><USER16> If you haven't already, I recommend you read what patio11 says here (and on their blog), they are in a very similar market with similar customers.

</comment><comment><USER17> Great post. Do you have some sort of referral scheme whereby current users can recommend the product to their coworkers and get a discount if someone signs up? I think that could help you grow it if not, your existing users spend all day alongside your target users - give them a reason to talk about it!

<comment><AUTHOR> I did a few years ago, but it went poorly. Might have just been my implementation. Either way I removed it.

</comment></comment><comment><USER18> nice post. really. I bet if the UI of the sites were refreshed for something more intuitive, easier on the eyes, and a better layout (rsstalker) - i bet you would see an increase in signups.

<http://planbookedu.com/> \- seems to have a better design than the others. The UI of a site really is important to me, and how I perceive the company or outfit, not sure if that is a good thing, but its important. You will attract the more web-savy peeps - <USER2>

<comment><USER16> This service might not be targeted at web savy folks

<comment><USER18> you know, I thought of that, as I work for a company that targets the "IE" crowd, but regardless, I think good UI goes a long way, regardless of your target audience.

</comment></comment></comment><comment><USER19> Matt, What caused the signups and new orders to go up compared to an year ago? Other than AdWords, are there any strategies that worked well for you?

<comment><AUTHOR> Most of the traffic still comes from Google search, so I'd say a combination of user interest in this type of thing and being near the top for most of searches.

As far as features I added sharing which allows teachers to generate links that they can send to other teachers and embedding which allows teachers to put their planbook right in their website.

Nothing revolutionary, but both helped w/ SEO and increased visibility with target customers.

</comment></comment><comment><USER20> So you have spent 100k in adwords and over the years you haven't earned that amount back?

Or did I mis something?

<comment><USER21> Pretty sure they are presenting a hypothetical situation where the revenues mentioned are worthless, implying that revenues are not the whole picture.

<comment><AUTHOR> Yes, exactly.</comment></comment></comment>


Apples.com Domain Auction - <AUTHOR> http://www.ebay.com/itm/apples-com-/180936762801 At $650,000 so far <comment><AUTHOR> Typed it on accident going to apple.com</comment>


Knowledge-Based Trust: Estimating the Trustworthiness of Web Sources [pdf] - <AUTHOR> http://www.vldb.org/pvldb/vol8/p938-dong.pdf

<comment><USER2> Am I reading this wrong, or could this potentially be used to censorship information on the web?

<comment><USER3> What this is about is trying to extract apparent facts from a network of documents and using those facts to evaluate the reliability of the documents.

So I guess it depends on what you mean by "to censorship". Do you mean "not generally send people to a document reasonably expected to be untrustworthy"?

<comment><USER2> While this could be used by a search engine to promote "reliable" data, there is potential that it could be used to hide some information that are generally considered reliable but are in reality false. I.e recent discussion about vaccination - while most scientific literature agrees that it's a good idea, some of it disagrees with that.. This algorithm could be used (on purpose or not) to hide that less popular information from the public.

<comment><USER3> Yes, it's possible for any attempt to evaluate the reliability or trustworthiness of a source to arrive at incorrect conclusions. This is possible for both human and machine processes.

At the same time, it's simply unreasonable to expect any given person using a search engine to consume and reliably evaluate all available information on a topic. The cost in time is too high, and the person will often lack the required expertise.

With these in mind, do you have an alternative proposal?</comment></comment></comment></comment>


Scala native (comming soon) - <AUTHOR> http://www.scala-native.org/ <comment><USER2> I'm not very well informed, but this probably has to do with the Dotty platform. Based on the Dependent Object Types calculus [1], which Martin Odersky says is the ultimate essence of Scala's types:

> [...] new foundation of Scala and languages like it. DOT features path- > dependent types, refinement types, and abstract type members. Proving the > DOT calculus type-safe has been [...]

Now, as Scala currently runs on the JVM, questions abound: What is native here? Will this compiler emit JVM bytecode? x86? LLVM? Also, what about GC? Or is the compiler getting bootstrapped, but we stay in JVM land? Are there opportunities to plug it seamlessly to the Truffle/Graal initiatives?

[1] [http://www.cs.uwm.edu/~boyland/fool2012/papers/fool2012_subm...](http://www.cs.uwm.edu/~boyland/fool2012/papers/fool2012_submission_3.pdf)

</comment><comment><USER3> I was curious to learn more, but this seems to be one of those sites where you can't learn anything without turning on JS and/or images. Or there is no simply no content there but "coming soon".

<comment><USER4> Nope, you've seen it all.

There's a link in the coming soon to a talk schedule by some guy. If like me you're not particularly into Scala, just curious about it, you just wasted a click.

</comment></comment><comment><USER5> So there is going to be a native Scala compiler?

</comment><comment><USER6> ok</comment>


Show HN: Klublr – the fully integrated platform for sports group organizers - <AUTHOR> http://klublr.com/en/ <comment><USER2> After I read the first few sentences I thought this could be the tool I want to start using right now.

From the main page I got an idea that the tool is about sport events and rich notification system (in case of reminders and reschedules I assume). I have moved recently and I'm looking for hobby groups that occasionally meet and play sports like soccer or basketball. Is this something Klublr could help me with? Is it possible to list events publicly there?

My Facebook login failed with exceptions and some SQL codes. The chat support window comes in non-English language, while the rest of the page is in English.

If you want feedback from more people, you can try [https://usability.testing.exchange](https://usability.testing.exchange) (disclaimer: I am associated with it).

Good luck!</comment>


This Scientist Explains Why Israel's Iron Dome Is Overrated - <AUTHOR> http://www.defenseone.com/technology/2014/07/this-scientist-explains-why-israels-iron-dome-overrated/89132/ <comment><USER2> If the whole situation weren't so horrible, the fact that Color Red partnered with Yo to push out rocket notifications would be comical.</comment>


Bat bomb - <AUTHOR> https://en.wikipedia.org/wiki/Bat_bomb <comment><USER2> If you want to read about the world's scariest saint: [https://en.wikipedia.org/wiki/Olga_of_Kiev](https://en.wikipedia.org/wiki/Olga_of_Kiev)

<comment><USER3>
      Now Olga gave to each soldier in her army a pigeon or a
      sparrow, and ordered them to attach by thread to each
      pigeon and sparrow a piece of sulfur bound with small
      pieces of cloth. When night fell, Olga bade her soldiers
      release the pigeons and the sparrows. So the birds flew
      to their nests, the pigeons to the cotes, and the
      sparrows under the eaves. The dove-cotes, the coops, the
      porches, and the haymows were set on fire. There was not
      a house that was not consumed, and it was impossible to
      extinguish the flames, because all the houses caught on
      fire at once.

...but no explanation for the spontaneous combustion of the cloth-bound sulfur.

Sounds like it was probably a closely-kept, obfuscated military secret like Greek Fire:

[https://en.wikipedia.org/wiki/Greek_fire](https://en.wikipedia.org/wiki/Greek_fire)

<comment><USER4> Certain chemicals will spontaneously combust when wrapped in cloth. They absorb into the cloth, and the increased surface area exposed to the air lets them react with oxygen faster, producing heat. The cloth also insulates it so the heat slowly builds up until it gets hot enough to combust.

This is why keeping oily rags are a fire hazard.

<comment><USER5> Super glue does this if you put it on cotton wool.

I found this out as a child by accident and set fire to the desk in my bedroom...

To be fair that desk caught fire quite a few times.

<comment><USER6> Hehe, same here. And then my Dad would come in calmly pointing out that this house might come in in handy as a place to live in the future as well.

He once really stalled on us, we were stuffing an empty 7.62 cartridge with explosives and he very clearly explained that while he though we shouldn't make fireworks at least we shouldn't use metal parts.

We continued with a small plastic tube and a couple of hours later it went off in my hand. I love my Dad for a lot of reasons.

<comment><USER5> Now that's how it should be! Good for you.

We weren't blessed with such weaponry in the UK. About all we got was 12 gauge shotgun cartridges and anything we made ourselves. The latter included ANFO so we made up for it through chemistry. This was 25 years ago; doing this now would get you chucked in prison in 2 seconds flat.

</comment></comment></comment></comment></comment></comment><comment><USER7> this is where I got my hn name from. I've actually spent a lot of time at dugway. One of my favorite parts about it is the german counterpart of they japanese village mentioned in the article, the German village. There's still a few building (still in use!) out there that were modeled after European villas so the army could test weapons during ww2.

</comment><comment><USER8>
      By that time it was estimated that $2 million had been spent on the project. It is thought that development of the bat bomb was moving too slowly, and was overtaken in the race for a quick end to the war by the atomic bomb project.

I can just see the conversation now.

A: "So what are you working on?"

B: "Well, we're harnessing the nucleic forces to create a destructive force hitherto unknown to man. How about you?"

A: "Um... bats"

B: "What?"

A: "We attaching firecrackers to bats."

B: "OK, um great!"

A: "Yea..."

</comment><comment><USER9> The reality is that the atomic bomb wasn't scary because it could destroy a city, it was scary because it could do it with just one drop.

America had already flattened 20+ cities before Hiroshima and Nagasaki, but instead of bats, they used large non-atomic bombs. The bats sound cool, but actual bombs were a little bit more dependable.

<comment><USER10> > they used large non-atomic bombs

America was dropping napalm on Japanese cities filled with civilians[1]. Firebombing was a popular tactic in the 1940's.

[https://en.wikipedia.org/wiki/Napalm#Military_use](https://en.wikipedia.org/wiki/Napalm#Military_use)

<comment><USER11> Well, USA was using white phosphorus in "cities filled with civilians" in Iraq in 2004 (Fallujah), which is more like "is using".

So when talking about scary stuff like incendiary weapons it's better to not to try and fool yourself with words like "yeah, past was _dark_ , but now it is 2014, we have all these conventions and stuff, and even in times of war people know limits of humanity, so worry not". Humans are wicked animals.

<comment><USER12> According to Wikipedia, USA signed part of "Convention on Certain Conventional Weapons" which bans white phosphorus in incendiary weapons in 2009 under Obama administration.

<comment><USER13> I think the problem is that it's still one of the most effective smokescreen generating compounds out there, so militaries are hesitant to ban it entirely and not have it available for that use.

But, just because it's not marked 'incendiary' on the side of the munition doesn't mean it can be used (both purposefully or accidentally) to horrible effect on people.

</comment></comment></comment></comment></comment><comment><USER14> I clicked the See also: [https://en.wikipedia.org/wiki/Anti- tank_dog](https://en.wikipedia.org/wiki/Anti-tank_dog)

I'm kind of bummed out from that one.

<comment><USER15> Wow, this sounds like a total clown-car operation:

 _Out of the first group of 30 dogs, only four managed to detonate their bombs near the German tanks, inflicting an unknown amount of damage. Six exploded upon returning to the Soviet trenches, killing and injuring soldiers._

and later...

 _Another serious training mistake was revealed later; the Soviets used their own diesel-engine tanks to train the dogs rather than German tanks which had gasoline engines. As the dogs relied on their acute sense of smell, the dogs sought out familiar Soviet tanks instead of strange-smelling German tanks._

</comment></comment><comment><USER16> This is one of those were reality defeats fantasy. Bat bombs sound a lot more like an orcish weapon than a real thing.

</comment><comment><USER17> These were featured in a great series of books about bats by Canadian author Kenneth Opel called Silverwing [0]. Many fond memories of reading this book as a kid.

[0] [http://en.m.wikipedia.org/wiki/Silverwing_(novel)](http://en.m.wikipedia.org/wiki/Silverwing_\(novel\))

<comment><USER18> From the original article:

 _The book Sunwing written by Kenneth Oppel was inspired by this plan._

</comment></comment><comment><USER19> I inspired this article creation - it fell into the "exploding animals" category, mainly because I originally wrote the exploding whale article on Wikipedia.

</comment><comment><USER20> Don't forget the pigeon guided missile.

[http://en.wikipedia.org/wiki/Project_Pigeon](http://en.wikipedia.org/wiki/Project_Pigeon)

[http://www.youtube.com/watch?v=mnKyOfNuSoo](http://www.youtube.com/watch?v=mnKyOfNuSoo)

</comment><comment><USER21> "Think of thousands of fires breaking out simultaneously over a circle of forty miles in diameter for every bomb dropped. Japan could have been devastated, yet with small loss of life." \- Dr. Lytle S. Adams

I guess Dr. Adams wasn't counting the actual bats here.

</comment><comment><USER22> I have a feeling Alfred Hitchcock would've had a field day with this one...

</comment><comment> guard-of-terra This weapon seems to mainly target civians and therefore should not be.

</comment><comment><USER23> it's a shame

</comment><comment><USER24> obviously batshit crazy

</comment><comment><USER25> Oh... [http://img2.wikia.nocookie.net/__cb20111123184929/batman/ima...](http://img2.wikia.nocookie.net/__cb20111123184929/batman/images/6/65/Bat_bomb.jpg)</comment>


A little idea to resolve special m:n relations a bit different with MySQL - <AUTHOR> http://www.xarg.org/2010/09/resolve-many-to-many-relations-a-bit-different-with-mysql/ An approach to resolve many-to-many relations without an additional table. <comment><USER2> So, you break First Normal Form, require some text-processing code to be put into your queries, and lose the benefit of indexes, all in order to avoid creating another table?

For the love of God, _why?_</comment>


New Construction Robot Lays Bricks 3 Times as Fast as Human Workers - <AUTHOR> http://www.archdaily.com/779906/new-construction-robot-lays-bricks-3-times-as-fast-as-human-workers <comment><USER2> Respectfully as someone who has laid brick if I laid bricks that bad I'd be faster than that, mortar is splooging out everywhere. The advantage isn't the speed (it's not very fast), but rather robots don't have to be paid, and they don't get tired.

</comment><comment><USER3> [https://news.ycombinator.com/item?id=10860357](https://news.ycombinator.com/item?id=10860357)</comment>


Show HN: A List of Common Serverless Errors - <AUTHOR> Hi all, we created a list of some of the most common Serverless Framework AWS errors. We've used these docs internally to help a lot of people debug their issues. And we hope it'll be helpful to the community!
https://seed.run/docs/serverless-errors/
It's also available publicly on GitHub, so feel free to submit PRs with edits or any new issues to add to the list.
Thank you! <comment><USER2> You guys really offer up some of the highest quality (and yet understandable to noobs) material. Kudos!

<comment><AUTHOR> Thank you!

</comment></comment><comment><USER3> Here is the link:

[https://seed.run/docs/serverless-errors/](https://seed.run/docs/serverless- errors/)</comment>


Failures in NIST's ECC standards [pdf] - <AUTHOR> https://cr.yp.to/newelliptic/nistecc-20160106.pdf <comment><USER2> And yet unfortunately, LibreSSL still doesn't support any safe curves ( [https://safecurves.cr.yp.to](https://safecurves.cr.yp.to) ) like Curve25519. Nor the ability to choose between multiple curves for the 99% of browsers that only support the NIST curves (only the most recent Firefox nightlies and Chrome support it.) The former landed in OpenSSL 1.1.0, and the latter in 1.0.2, whereas LibreSSL is a fork of 1.0.1. And after Dual EC DRBG, it is negligent to trust more curves that the NSA has tampered with.

The curve has been out for a long time now, and it really doesn't take much code to do this. Here's a recent implementation of it that I wrote, which runs in constant time and is based in part off curve25519-donna-c64 and with some help from MerryMage:

[http://hastebin.com/raw/lutiloyaxa](http://hastebin.com/raw/lutiloyaxa)

As you can see, most of the work is just simulating a 256-bit type efficiently. But they should already have the field element types in their signify code (which uses Ed25519), so they'd only have to write the first 86 lines of that code.

At this point, I've pretty much given up hope of being able to use the even nicer Curve448 within the next five years with TLS. I'm unaware of any TLS libraries or browsers that support it.

<comment><USER3> OpenSSL supports ECC X25519 since august this year.

Apple uses 25519 for iCloud encryption as well as encrypting AirPlay and wireless communication with various accessories.

X25519 Is also supported in Chrome [https://www.chromestatus.com/feature/5682529109540864](https://www.chromestatus.com/feature/5682529109540864)

<comment><USER2> > OpenSSL supports ECC X25519 since august this year.

"The former landed in OpenSSL 1.1.0"

> X25519 Is also supported in Chrome

"only the most recent Firefox nightlies and Chrome support it"

> Apple uses 25519 for iCloud encryption as well as encrypting AirPlay and > wireless communication with various accessories.

I was referring to its use in HTTPS/TLS, but that's good to hear! :D Hopefully they'll add it to Safari soon.

<comment><USER3> Wasn't contradicting you, just adding a bit of info. Does firefox actually supports X25519 now? I haven't seen it in the builds (it's also not on the reference list i use). I know Edge is going to support it by the end of the year, no clue on Safari yet.

But anyhow if you want to have a full list of software that supports Curve25519/X25519(DH) as well as other open crypto standards IANIX has an upto date list [https://ianix.com/index.html](https://ianix.com/index.html)

<comment><USER2> Oh okay, in that case my apologies for the misunderstanding ;)

Firefox is said to support it in the nightly releases, but not yet in the official releases. This is the last time I checked about a month ago (I no longer use Firefox.)

</comment></comment></comment></comment></comment><comment><USER4> I can also tell you that cryptography libraries are complete piles of failure if you want to run on an embedded device.

C++ is a non-starter. Non-open licenses are non-starters since nobody will review the library. GPL libraries are radioactive legally. Opinionated libraries are wonderful--unless you have to interoperate (see NaCl and libsodium). Dynamic allocation is death in embedded (looking at you libgcrypt and your stupid s-expressions garbage).

And, if you want some hardware acceleration, your choices are ...

Zip. Nada. Zilch.

And then everybody wonders why security in IoT sucks.

(Botan is probably the least bad. It's C++, but they went out of their way to provide a C API and even have Python bindings in the source(!). Unfortunately, it's lots of atomized C++ classes and inheritance to trace through for what looks like not a lot of gain. It's not immediately clear how to inject hardware acceleration either.)

<comment><USER5> Fellow embedded engineer here.

I think the ARM MbedTLS (former PolarSSL) isn't that shabby. WolfSSL is pretty ok too. And then there are things like TweetNaCl by Schwabe et al that works really well in embedded space.

HW acceleration for ECC is very rare in MCUs, but quite a few sports AES with a couple of modes, typically CTR and CBC. Bigger ones (based on Cortex-M4) may even support AEAD modes like GCM.

<comment><USER4> > And then there are things like TweetNaCl by Schwabe et al that works really > well in embedded space.

I stumbled on TweetNaCl by accident. It's _amazingly_ useful.

But, it's like it's being kept hidden. It's not at all easy to find when you are digging through crypto libraries looking for stuff. That's so terribly unfortunate because there are so many other libraries that are so amazingly difficult to port and use.

</comment></comment></comment><comment><USER6> djb's papers always make for good reading. I wish more papers were written as straightforwardly as his.

</comment><comment><USER7> There's a previous discussion about this somewhere (it's from earlier this year, written for a NIST summit on next-generation elliptic curve standards).

I can offer a quick cheat sheet:

* The NIST ECC problem everyone is aware of is that the seeds used to generate the curves have totally unknown provenance. Pretty much everyone agrees that's a problem; it's not really a live issue. Whatever the next curve standard is, it won't have this problem.

* NIST's ECC standards included an ECC-based PKRNG, which is a CSPRNG based around a public key operation rather than a hash or cipher. Pretty much everyone agrees that the only practical reason to use a PKRNG is to allow the holder of the secret private key to extract the state from people's RNGs and predict their random numbers; it's a form of key escrow. It was very bad that NIST standardized a PKRNG.

The meat of the paper is about Curve25519 and Ed25519, Bernstein's competing curves. These constructions are basically responses to the flaws of the NIST standards:

* The NIST curves are misuse-prone. When receiving ECC parameters from your counterparty, there's a validation routine you must perform precisely, or else an attacker can trick you into performing a computation using your secret on an unexpected and insecure curve. This attack is very simple to perform and pretty spectacular: you can use it to remotely suck the private key out of a remote server. There are some variants of the attack (oversimplifying: there's the generic problem of not doing validation, and the more sophisticated problem of how you send coordinates, and whether protocol details like this can allow attackers to force attacks onto related-but-insecure "twist" curves).

* The NIST curves are difficult to implement without timing leaks. That's what the Montgomery Ladder stuff is about: it's an algorithm that's simultaneously constant-time, efficient, and _simple_. NIST's curves are difficult to work with in these terms, and Bernstein's aren't.

* The NIST curves have a naive design with respect to modern computer architecture, and so it's easier to generate fast curve software with other curves (like Curve25519; the 25519 refers to the structure of the prime field it works in, and that prime field was chosen to be efficient to compute on in software).

* NIST originated DSA and ECDSA, the two most popular public key signature protocols. DSA/ECDSA sucks. A lot. They rely on random nonces and blow up _spectacularly_ if those nonces are biased; it's become a bit of a sport in ECC research to get practical attacks out of extremely small nonce biases (a problem that's easy to have).

* Modern signature schemes have a bunch of nice features that DSA signatures don't; they're bulletproofed internally against attacks that could isolate weaknesses in specific parameters (the hash used, the nonce and the key), the math is tweaked so that things like modular divisions that are hard to do in constant time are replaced with multiplications, and the system is hardened to make it difficult to launch batch attacks (attacks where it costs only marginally more to attack 1000 signatures than to just attack 1). The next NIST signature standard should be like those nice signature systems, not DSA, which, again, sucks.

The paper is worth reading! I think it's a little easier to read with the roadmap. :)

<comment><USER8> Interesting reading w'r't' DSA from this past week: [http://eprint.iacr.org/2016/961](http://eprint.iacr.org/2016/961)

<comment><USER9> I think that paper is "submission worthy" itself.

</comment></comment></comment><comment><USER10> [https://www.reddit.com/r/crypto/comments/3zu3ls/failures_in_...](https://www.reddit.com/r/crypto/comments/3zu3ls/failures_in_nists_ecc_standards/)</comment>


What are the best contemporary alternatives to Vault for secret storage? - <AUTHOR> Googling around, it looks like there's Vault... and most everything else is just storing PGP encrypted files in Github or stuff like that. Is there a good list of all top products in the secret management area, or a good recent comparison of features?<p>Thanks HN! <comment><USER2> Zip it up with bogus name followed by Bcrypt or in a Truecrypt/VeraCrypt volume uploaded into Dropbox or whatever. You get benefit of proven solution for critical part, esp Truecrypt since NSA hated it, with easy usability and cost/storage/availability of 3rd party storage.

<comment><AUTHOR> I should have added that this is for enterprise use, and the main use case is providing secrets to services when provisioning new hosts / containers or updating said secrets.

Your comment sounds to me as something that would work well for personal use, as a password manager replacement.

<comment><USER2> Yeah, that's a lot more complex. I'll leave others to this one.</comment></comment></comment>


Seat Belts and Airbags - <AUTHOR> http://www.shopify.com/blog/3563692-practical-ecommerce-advice-seat-belts-and-airbags

<comment><USER3> Hey Everyone,

I'm the author of the post - feel free to ask me any questions!

<comment><USER4> What are some examples of "seat belt" and "airbag" changes you see shops making?

<comment><USER3> Here's a few examples:

"Seat Belt" Changes: \- Making sure photos are all cropped/uploaded at the same resolution so collections look tidily aligned. \- Taking product photos that are clean, simple, and well-lit... great product photos don't require a DSLR, just a bit of preparation, and the time to make them look good is worth it. \- Setting up Google Analytics to start collecting data on visitors.

Airbag Changes: \- SEO. Getting traffic is great, but if the site isn't compelling people to buy it's a wasted effort. \- If you're not a capable designer, trying to make extensive changes to your site's layout can be extremely time-consuming and won't necessarily make your site look better. \- Trying to round up hundreds of products for a brand new business. Keep things simple in the early stages and build out your product lines as you grow.

Those are just a few.

<comment><USER5> It would be great to add those to the post itself. (Good article, btw -- it was a nice way to make the concept of "most bang for the buck" more concrete.)

<comment><USER3> There's a pretty good chance they'll become a future post or two - <USER2> challenge with posts like those is that you don't necessarily want to come down too hard on people that are chasing airbag solutions - it's a company blog and at the end of the day they're our customers too.</comment></comment></comment></comment></comment>


FCC threatens carriers with 'regulatory intervention' over robocalls - <AUTHOR> https://thehill.com/policy/technology/429867-fcc-threatens-carriers-with-regulatory-intervention-on-robocalls <comment><USER2> Particularly sucks for me because I'm on a kidney transplant list so may get a call any time of a potential match and they didn't specific which number will call me. So basically I end up answering all these unknown number robocalls in case I miss one of these matches.

<comment><USER3> I'm so sorry, but that's seriously the ultimate tease. Every phone call is a "MAYBE ITS MY NEW KIDNEY?!" and instead you're greated with "Your cars EXTENDED WARRANTY is about to expire, please press 1 now to speak to a representative about your cars EXTENDED WARRANTY"

<comment><USER2> To be honest, I still have a couple years wait on the kidney but there is a non-zero change of a perfect match that gets to the head of the line. And I certainly don't want to miss that.

I do have a trick in dealing with the calls though. I answer the line but say nothing. Humans will always say something if there is silence for a while. Robocalls will just hang up. And I notice if they hangup, the chance of future calls are lower.

<comment><USER4> > To be honest, I still have a couple years wait on the kidney but there is a > non-zero change of a perfect match that gets to the head of the line. And I > certainly don't want to miss that.

I got curious, and scanned [https://www.organdonor.gov/](https://www.organdonor.gov/) to see how one gets notified when an organ is available. I didn't see any information after a few minutes of poking around the site.

When a kidney does become available, what is the process by which you'd be notified? Do they make one phone call, and if you don't pick up, they call the next person on the list? Do they broadcast a message to you & everyone you know via every possible telecommunications & social media channel you've provided, and then give you N minutes to reply with "hey, I'm on my way to the hospital now!"

<comment><USER5> there's no way they'll give up after a single phone call. but the transplant team and the person potentially receiving the transplant only have one hour to respond to a notification of an available organ before UNOS moves on to the next person down the list. edit: mind you, this is not a straightforward yes/no - the transplant center needs to make sure that this particular organ donation will work at that particular time etc. - so there's a lot of factors involved.

my stupidest (but i guess not entirely invalid) fear is that i'm listed as the primary contact for my dad in need of a kidney, and i basically can't go to any shows using yondr or any similar situation where i won't be near my phone for a while. or at least make sure that other people that will be contacted too know that i will not be available to pick up.

edit: i guess i didn't answer the specific question though! at least the center where my dad is listed - they have a bunch of contact numbers for us and i have their numbers in my address book plus a request on my voicemail msg to call me twice to bypass DND if necessary. and my dad's renal case manager knows to text/email/call me too and her direct numbers are whitelisted in my phone, always. the 1 hour limit means we (the patient/family) will have less than 1 hour to respond.

i also do believe that the center that gets the notification from UNOS also gets pinged if UNOS don't hear back at all whatsoever (like, a confirmation of the notification at minimum) within 10-15 minutes of the original notification. something like that. basically there's not really a situation where a single missed call will make or break it (unless literally someone is unreachable for the whole time.)

<comment><USER4> I'm gonna track down some people who can comment on how organ availability actually works. Who knows. Maybe there's a solution that could be wired up so you can go see a movie without worrying about whether or not a kidney suddenly becomes available.

<comment><USER5> the solution is my watch is always on and buzzes for calls :) and the center has a lot of different people to contact that can contact each other. (we have a little geographic redundancy here.)

but the reality of this is that, if you're on a transplant list, you basically won't be doing any significant/major travel or be unreachable for long periods of time.

i will say though, this depends on the organ i imagine. i think 1 hour is standard across the board, but lists/priority and other things change dramatically depending on which organ you need - kidneys are viable for longer than hearts, etc.

UNOS/OPTN is where you want to look for information on organ distribution - [https://unos.org/transplantation/faqs/](https://unos.org/transplantation/faqs/) "How does the matching process work?" and [https://optn.transplant.hrsa.gov/learn/about- transplantation...](https://optn.transplant.hrsa.gov/learn/about- transplantation/donor-matching-system/)

<comment><USER6> For hearts you only get one call and a few minutes to decide whether you are ready. If you don't pick up they go straight to the next person. My friend used a basic Nokia phone with a heart-wrenching message on it to prevent theft. (I'm not in the US)

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER7> Good + heavy $$$ punishments. My father had heart attack few weeks ago and my brother refused to pickup a call, because he was thinking that it was a robocall. It was a call from hospital in VA, they a left voicemail.

<comment><USER8> I think hospitals/police should really start texting a phone number first, before calling to contact a family member.

Just something like, "Please call such such hospital at this number to reach us. We need to get in touch with you. You can google the hospital name to verify before calling."

I get one robocall every day. Interestingly, not 3 or 5, but just about 1 a day.

<comment><USER9> Two problems with that:

1\. Many older patients don't use cell phones and are still on landlines.

2\. Current processes would have to change. Currently healthcare companies first have to ask if the person picking up the phone matches name & DOB. If not, they need to ensure the person is authorized to receive the health information. This is done for confidentiality reasons (e.g. "hi your husband tested positive to $STD… oops you weren't supposed to know that, oh well have a nice day and tell him to make an appointment with us.").

<comment><USER10> > Two problems with that:

> 1\. Many older patients don't use cell phones and are still on landlines.

> 2\. Current processes would have to change. Currently healthcare companies > first have to ask if the person picking up the phone matches name & DOB. If > not, they need to ensure the person is authorized to receive the health > information. This is done for confidentiality reasons (e.g. "hi your husband > tested positive to $STD… oops you weren't supposed to know that, oh well > have a nice day and tell him to make an appointment with us.").

Many healthcare providers now offer forms that allow you to specify the level of detail you would like for messages (typically the same form where you can add a verified contact who is eligible to receive medical information on your behalf). I was able to select something along the lines of "Leave the full details you are reporting, even if it is to a voicemail" though I can understand that that is not workable for everyone.

</comment></comment></comment></comment><comment><USER11> Under the theory that the economics of scam-spam calls only work out if good victims self select by not hanging up I have long considered it a civic duty to waste the scammers time.

In the past, I managed to keep a scammer on the phone for an hour or more simply by leaving it on speaker phone and making various "oh really, interesting tell me more" sounds while half paying attention. On more than a few occasions I eventually caused the scammer to either crack up laughing-- after I got tired of stringing them along and hit them with a devastating pun-- or freak out screaming at me.

But in the last two years I've _never_ been able to bait one out long enough for them to have scammed me if I had been an eligible mark and not for the lack of trying. The majority of the scam calls just end up hanging up before I ever get to a human, the majority of those that do make it to a human hang up as soon as they hear my voice. The majority of those that don't immediately hand up, do after a couple back and forth interactions.

"You've been selected to get $1000 back from the IRS for being a great taxpayer!" "Oh man, thats great!" <click>

"You've been selected to get $1000 back from the IRS for being a great taxpayer!" "Really? How did that happen?" <click>

"You've been selected to get $1000 back from the IRS for being a great taxpayer!" "Whos this again?" <click>

I'm wondering if they're now doing some kind of demographic profiling using my voice-- e.g. I don't sound enough like an aged or mentally impaired pensioner, or perhaps even have some kind of machine-learning time waster voice identification. ... or maybe there is some kind of meta-scam where someone is charging another scammer to handle these calls but aren't actually doing the work.

Regardless, I'd like to encourage all of you to do your civic duty and waste a scammers time. It can be done with very little effort on your part and it almost certainly protects real potential victims (even with my frequent hangups, my actions are almost certainly extending protection via false positives, if nothing else). I have confirmed that these actions have not increased or decreased the rate of scam calls I get relative to my SO who doesn't engage in this practice (because she simply does not answer unrecognized numbers at all).

<comment><USER12> > Under the theory that the economics of scam-spam calls only work out if good > victims self select by not hanging up I have long considered it a civic duty > to waste the scammers time.

I used to immediately hang up upon receiving these spam/scam calls, but they kept coming, and I decided to do this approach.

I once got a spam call from a "credit card rate reduction" scam and I was so pissed at being interrupted so I decided to play along. I gave them a fake credit card number (that checksums right with the Luhn algorithm, there's a website that generates such fake "credit card numbers"), fake expiration date, fake zipcode, fake SSN, and fake name. Of course, they were unable to charge that "card", so the first-level scammer escalated me to his boss (not kidding). The boss asked for my bank's customer service number -- I imagine so they could pretend to be me and try to finesse the bank into letting the transaction happen. I gave them some random police department dispatch phone number, and she places me on hold. She comes back on the line, _literally incandescent with rage_ after she called the number, and she screamed at me "I talked with the police department, they gave me your address, see you soon, bye bye" and hung up.

That caused the number of spam/scam calls i receive to go down noticeably. These people don't respect any sort of do-not-call lists but I think they _may_ place you on internal do-not-call lists if you waste their time and infuriate them enough.

Couple months later, I got another "interest rate reduction" scam-call, and the guy doesn't waste time with the social-engineering; he straight-up opens by asking me for my credit card number and expiration. I decide to meet fire with fire, and I ask "what name do you show on the account", he replies "it's your name". I pointedly ask "can you read it out for me" so he yells at me: "don't waste my fucking time, you mother fuck" and hangs up. After I did so, I barely get any spam/scam calls at all -- maybe once every two weeks. It's pretty incredible how a little trolling saved me so much annoyance.

Reminder; __never give any personal information __to people calling about your credit-card /bank-account no matter who they claim they are. __Always HANG UP __and dial the number __as printed on your payment card __, these scamming shits always spoof caller-ID.

<comment><USER13> Where I am, there isn't really a problem with robocalls and not many scam calls, thankfully, but I still refuse to give out details over the phone, _especially_ if they rang me.

I'm still shocked at the amount of times I got legit calls from my bank that start off with _" please confirm your details"_. No, YOU confirm your details. I always tell them sorry, I have no proof that they are who they say, but they usually just say _" No problem, call us back on the number on the back of your credit card"_ or somesuch, which is fine. I just wish they said that right away and didn't ask to confirm details, since it makes scammers lives easier.

<comment><USER14> My good bank has a password. I actually usually can't remember what it is, but that's fine since it's their password and I'll recognise it when they say it. "Oh, that's right! You _are_ the bank"

But they never proactively asked me to set that up, it's just that I went around this "I can't authenticate to you first, so I'll have to phone you" loop and I pointed out it would work better with a password when I called them back and to my surprise they were like "Yes, we can do that, what password should we say?" and set it up immediately.

So, worth asking I guess?

<comment><USER13> Interesting. I'll have to try next time.

</comment></comment></comment></comment></comment><comment><USER15> Robocalls have made my telephone so useless as a telephone that I'm beginning to wonder if I even need a telephone number at all, just as I started wondering if I actually needed a house phone or cable.

<comment><USER16> In the US, house phones and cable are for being advertised to, cell phones and streaming are for contact and content respectively. That has been the case for at least a decade. I can receive calls from numbers that are not in my contacts but the notification is silent.

Now if only I were allowed to dispose of my mailbox I could have a home free of advertising. Yesterday I received an infuriating catalog from Restoration Hardware that weighed a pound and a half, all because I bought one awful product that fell apart in a few months and had to be recycled. It amazes me that we subsidize such obnoxious ads being delivered to every resident.

<comment><USER17> Cant you stick the wording "no junk mail" on your mailbox and be free of spam?

In Australia basically every mailbox has that on it and it is enforced by law.

<comment><USER18> I think the law is the opposite in the US. You legally can't refuse the things. Or at least the mail carriers are absolutely required to deliver it to you.

<comment><USER19> You can refuse most items:

[https://pe.usps.com/text/dmm300/508.htm](https://pe.usps.com/text/dmm300/508.htm)

Sections "1.1.2 Refusal at Delivery" and "1.1.3 Refusal After Delivery".

Here in Finland I think 97%+ of physical advertisement "mail" is non-addressed and the carriers of those respect "no ads" signs (no address => ad).

I think this might be different in US in that advertisement mail is usually addressed?

</comment></comment></comment></comment></comment><comment><USER20> So the article doesn't seem to mention any of the ongoing efforts to stop or reduce caller ID spoofing, such as SHAKEN/STIR. I'm not clear if that will do anything, and it's certainly far too little too late, but the industry is doing _something_.

On that note, does anyone know how SHAKEN/STIR is supposed to work? I understand that it basically sets up a PKI with JWTs in SIP headers, but from what I can tell there needs to be some sort of trusted CA which creates and signs these things, but I can't tell who that CA is or if there even is an agreed upon central CA.

I'd also be interested in any corrections/expansion on any of the things I said above, I really don't know much about it and would like to.

edit: after making this comment I did a bit more research, and it looks like[0] there will be per-country CAs that can issue certificates to owners of phone numbers within that country. I'm specifically curious about which CAs will be trusted in the United States.

[0]: [https://tools.ietf.org/id/draft-burger-stir-iana- cert-00.htm...](https://tools.ietf.org/id/draft-burger-stir-iana-cert-00.html)

<comment><USER21> Authority for the North American Numbering plan currently falls to the FCC, after the breakup of AT&T; they contract out administration, Ericsson got a 5 year contract in 2017, previously it was administered by Neustar (and Lockheed Martin, before Neustar was spun out).

I'd imagine Ericsson would spin up a new CA instance just for this. As the administratior, they keep the records of who phone numbers are assigned to, and where they've been ported.

My understanding is once a +1 area code is allocated to a country, that country's telecoms regulator manages further allocations (or contracts it out).

<comment><USER20> Cool, thanks for the info. Any idea what the timeline on creating that CA is?

<comment><USER21> No idea. I wasn't aware of this proposal (STIR), I just am aware of a lot of number allocation stuff. Does STIR have any support from telecoms companies and/or ITU? Or is it IANA only?

I see Neustar has a page that seems related: [https://www.home.neustar/atis- testbed/index.php](https://www.home.neustar/atis-testbed/index.php) ?

<comment><USER20> From what I can tell, the telcos are implementing it, or at least say they are:

* "Caller Verified is T-Mobile's implementation of the STIR and SHAKEN standards" [0]

* "Verizon reiterates both our commitment to deploying the STIR/SHAKEN call authentication technology" [1]

* "Sprint supports efforts to build the SHAKEN/STIR call authentication system" [2]

* AT&T doesn't seem to mention STIR or SHAKEN by name on their robocall page [3] but the FCC sent them a letter thanking them for their "commitment to implement a robust call authentication framework in 2019" [4]

* "Comcast is proud to be at the forefront of efforts to address the scourge of illegal spoofed robocalls in this country, including the development of the end-to-end call authentication protocol known as SHAKEN and STIR" [5]

etc

[0]: [https://www.t-mobile.com/news/caller-verified- note9](https://www.t-mobile.com/news/caller-verified-note9)

[1]: [https://ecfsapi.fcc.gov/file/1119062987519/2018%2011%2019%20...](https://ecfsapi.fcc.gov/file/1119062987519/2018%2011%2019%20Verizon%20Call%20Authentication%20Framework%20WC%20Docket%20No.%2017-97.pdf)

[2]: [https://ecfsapi.fcc.gov/file/1091391175368/Sprint%20Call%20A...](https://ecfsapi.fcc.gov/file/1091391175368/Sprint%20Call%20Authentication%20Comments.pdf)

[3]: [https://about.att.com/sites/cyberaware/ae/robocall](https://about.att.com/sites/cyberaware/ae/robocall)

[4]: [https://docs.fcc.gov/public/attachments/DOC-354933A2.pdf](https://docs.fcc.gov/public/attachments/DOC-354933A2.pdf)

[5]: [https://ecfsapi.fcc.gov/file/111974588343/Comcast%20Resp%20t...](https://ecfsapi.fcc.gov/file/111974588343/Comcast%20Resp%20to%20Chmn%20Pai%20re%20SHAKEN%20STIR%20\(11-19-18\).pdf)

</comment></comment></comment></comment></comment><comment> WD-42 Funny, Pai "celebrated" repealing Obama era anti robocall laws back in March. Maybe it took him a year of robo calls on his own phone to change his mind.

[https://www.cnet.com/news/courts-nixes-fcc-rules- targeting-r...](https://www.cnet.com/news/courts-nixes-fcc-rules-targeting- robocalls/)

This guy is anti consumer. Don't let him fool you.

<comment><USER22> The earlier regulations were too broad and in theory could subject callers to a fine if they called or texted anyone else without prior consent.

What he is asking for now is that caller IDs be verified. I don't know how realistic that is given the way they are implimented (trivially spoofable) but that's a narrower demand.

<comment><USER23> I'm all for requiring businesses to get explicit permission from me before they can make the little box in my pocket buzz and interrupt me.

<comment> munk-a I'm... not so much, I'd prefer that they be required to register with an organization that can bop them on the head if they abuse it.

I wouldn't want to see statistical surveys, polling and other grey area items here impacted.

<comment><USER24> _I 'd prefer that they be required to register with an organization that can bop them on the head if they abuse it._

I know the FCC doesn't have express _legislative_ power here, but can't they impose fines or am I mistaken-on either or both?

<comment><USER25> The FCC fines television and radio stations for regulation violations.

</comment></comment></comment></comment></comment></comment><comment><USER26> Robocalls are terrible and a valid reason to have regulations. We should sign up every Senator and Congressman's cellphone to N number of scammy sites. See how fast the issue is solved. SS7 issue be damned, AT&T and Verizon will solve it if you force their hands.

<comment><USER27> Good luck finding a congressperson's personal cell phone.

<comment><USER28> What would it cost to Wardial a whole area code with TextToSpeech + SpeechToText on twilio?

<comment><USER29> [https://www.twilio.com/voice/pricing/us](https://www.twilio.com/voice/pricing/us)

If you need 1 minute per number: ~10,000,000 minutes * 0.013 $/minute = $130,000

<comment><USER30> Not quite that many, the NANP only allows NXX numbers that would match this Regex:

[2-9](?!11)[0-9]{2}

So there's only 7,200,000 numbers allowable within a singe NANP area code.

</comment></comment></comment></comment></comment><comment><USER31> The vast majority of robo calls are done for someone either in the US (a company) to make money or uses the US banks to collect money in some way.

What they may want to consider is a team of people to actually take the calls and trace them back to the source. Or at least the people that are making money in some way. And don't say or react 'oh that wouldn't work'. Of course it would work if done correctly. No point in selling health insurance by way of a third party making calls or on your own if it will get you in hot water.

From what I can tell nobody is making robo calls to simply be annoying. It's quite different than a DOS attack done for fun or many other 'crimes' if you want to call it that.

Not that they shouldn't approach this in the way they are. But to simply make as if there is no way to get the perps is a bit ridiculous. Someone is in the end selling something or collecting some name or something like that.

I am reminded of what I thought back when graffiti was a bigger deal than it is now. Why not simply set honey pots that you know are going to get tagged? Or monitor various locations likely to get graffiti.

Now this doesn't mean that offshore people with scams won't get involved. That could happen. But as a start might make sense to at least gut the people in the US that are benefiting from this (in addition not instead of other 'remedies' by the carriers).

</comment><comment><USER32> Still no word on when they'll crack down on USPS junk mail too, I miss important letter because my mailbox is piled up with spam. And people to have to buy bigger PO Boxes just to support their racket.

<comment><USER33> USPS would go bankrupt if it wasn't for junk mail. It is pretty much the only mail I get since I opted out of physical billing statements.

<comment><USER34> Possibly, but they also do quite a lot of business in package delivery, which is something customers actually still want.

</comment></comment></comment><comment><USER35> I've stopped answering my phone completely unless the number is in my contacts. If I plan to communicate with anyone (recruiters, etc.) I make it explicit that I won't answer their call unless they give me the number they'll be calling from ahead of time, and then I tell them I'll place them in my contacts with that number.

My hope is that this is training these individuals to be more aware of the issue, assuming they've forgotten about it due to being desensitized or using some paid caller ID spam service that not everyone has access to for lack of funds.

I've also long turned off my voice mail; it's just a waste of time.

<comment><USER36> I stopped using phone completely, period, even for known numbers. It's in permanent silence, no vibration, no checking mode. It took some time for friends to learn they have to use Skype or whatsapp to contact me, but after that I don't have to worry about spam and midnight calls anymore.

<comment><USER37> So, you're basically not reachable in an emergency unless someone knows the special code to get hold of you? To say nothing of local service people etc. who you might have to deal with.

I don't like junk calls either but cutting myself off from normal communication channels doesn't seem as if it would be very practical.

<comment><USER36> People can use texts for emergency messages. If they want to voice call, this usually mean situation is not so urgent in a first place.

<comment><USER38> I think I'd take issue with a text "Umm, yeah, your mom died so call me".

And, yes, I do in fact use punctuation on text messages...

<comment><USER36> No offence, but something is seriously wrong with your head

</comment></comment></comment></comment></comment></comment><comment><USER39> While I was reading the last paragraph of this story, my phone rang, showing a number in a nearby town. And of course, as I confidently expected, it was "Hi there! This is Stan, from your local air duct cleaning service!"

Nice to get that evening call from Stan, or James, or Dave, wanting to clean my ducts. Every fucking evening.

Yes, FCC. Do it do it do it!

</comment><comment><USER40> Are robcalls something that ALL Americans deal with daily, or is it just really bad for some people?

<comment><USER41> I get several of them every day and I know other people who do, too. I just disable phone calls most of the time because T-Mobile doesn't care at all to address the issue, no matter how many times I've reported it. Their answer is for me to install a 3rd party app that doesn't actually block the calls but hangs up on them.

<comment><USER42> T-Mobile has put much effort into not only identifying scam calls but also the ability to block them. No app required, no extra charge.

[https://support.t-mobile.com/docs/DOC-38784](https://support.t-mobile.com/docs/DOC-38784)

<comment><USER43> I've gotten plenty of legitimate calls marked as spam caller, which means T-Mobile can't be trusted here.

<comment><USER42> I haven't gotten any spam calls after enabling it on my phone number that I've had with TMO for 20+ years, nor have any legit calls been marked as spam. I suppose everyone's milegage may vary.

<comment><USER43> How do you know if they blocked a legit call?

<comment><USER42> Fair point. I make it extremely easy to find me through methods besides a phone call, so I assume if a legit call did not come through because of T-Mobile blocking, I'd find out through an alternate channel (the caller iMessages or emails instead).

<comment><USER43> What I've specifically found is I miss calls from businesses that I've requested, but did not know would be coming on that day or from that number. And they aren't going to send me emails about the missed call, usually.

<comment><USER42> I give out a Google Voice number to callers of this type that doesn't ring anywhere. I get an emailed voicemail transcription, and can choose to return the call at my leisure. Consider it!

<comment><USER43> The fact is, in the business world people often don't leave messages. You can miss important conversations if you don't pick up every call.

<comment><USER42> If you're not leaving a message, the call isn't worth returning. I don't lose any sleep operating this way. I can appreciate that some people have no choice if inbound calls are business leads or the like. Find a more resilient inbound funnel flow I'd argue.

<comment><USER43> FYI, I was paying attention recently and calls from my bank that I requested have been marked that way, for e.g. 2FA verification. If I had turned on the option to block such calls I'd have been left clueless why I wasn't getting the requested call.

</comment></comment></comment></comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER44> The FCC previously proposed giving carriers "freedom to block".[1] That didn't fly. Insisting on tighter standards for caller ID is reasonable enough.

[1] [https://www.washingtonpost.com/technology/2018/11/20/fcc- has...](https://www.washingtonpost.com/technology/2018/11/20/fcc-has-new-plan- combat-unwanted-robocalls-spammy-texts/?utm_term=.bfa8093ddfc0)

</comment><comment><USER45> I understood the problem to be, at least in no small part, regulatory to begin with. To what extent are carriers permitted to deliberately not complete a call originating outside their own network (what about from a foreign network)?

</comment><comment><USER46> I've noticed that my prepay burner phones, some of which I've kept in service for years, _never_ receive robocalls.

It's definitely not a blind system of calling all numbers, you can have a robocall-free existence. I've simply never supplied the numbers for those phones to any personal information selling (or leaking) services/businesses, and that seems to effectively keep them off the call lists.

</comment><comment><USER47> Putting aside any discussion of Pai's motivations and political considerations, is there a reason that carriers wouldn't want to eliminate these robocalls? Are the spoofers paying the carriers? It seems like any carrier that figured out how to effectively eliminate (or even reduce) them would have a massive competitive advantage until the others caught up, right?

<comment><USER48> That would require cost sunk into innovative engineering, while the business model of telecoms is stasis at best and anticonsumer practices at worse.

</comment></comment><comment><USER49> I almost exclusively use my Google Voice number and its remarkable how good it is at filtering spam-calls. I want to tell everyone to get Google Voice.. but given their history of killing successful projects. Well, its only a matter of time.

Dear Google: here take my money! Keep Google Voice!

<comment><USER50> Nearly 100% of the spam calls I get on my cell phone in the past few years are to the actual cell phone number (which I've never given anyone), not the GV number. :(

Sadly, I'm not aware of a good way to filter these out.

<comment><USER51> It's a bit of work, but what I've done in the past is to set the default ringtone to a silent ring tone (or the mosquito one if you're old enough and want to annoying your kids), then for each of your contacts set a custom ringtone. Doesn't scale well if you've got a lot of contacts to deal with.

</comment></comment></comment><comment><USER52> Hopefully this regulation will really make illegal telemarketers stop calling us with those spam calls.I also read an article that might be useful for someone who has similar robocalls problems at [https://www.whycall.me/news/consumer-wins- massive-229500-rob...](https://www.whycall.me/news/consumer-wins- massive-229500-robocall-lawsuit-against-time-warner-cable/).

</comment><comment><USER53> I'm sure Pai "threatening regulatory intervention" has them quaking in their boots. They just toss him a few benjamins and the he shuts tf up.

</comment><comment><USER54> Thank god. It's getting ridiculous. I get 3 or 4 of these every day now. That's something like 90% of the calls I get.

</comment><comment><USER55> What needs to happen is jail time for systematic violation of the "do not call" list. Anything less is bandaids.

<comment><USER56> I agree completely, though I wonder why do-not-call even needs to be a thing here. These spammers are calling _repeatedly_ for the sole purpose of committing _fraud_ ¹. Fraud, normally, is illegal. Why do phones need special legislation here?

¹The factory warranty on my vehicle is going to expire? I don't have a vehicle with an expiring warranty. "This is your final notice" how I wish those words would be true. Or my "medical-grade knee brace" that I supposedly wear. Or the interest rate I could get on the CC I don't have.

<comment><USER55> Why do we need do-not-call? Because even if it isn't fraud, _I still don 't want them to call me_.

[Edit: And I think it is in fact working, in that the non-fraud people don't call me much anymore. So the ones who do call are the ones willing to break the do-not-call law, which means they're probably _also_ willing to break other laws, like the ones against fraud.]

</comment></comment></comment><comment><USER57> I like how Pai is championing this issue only because it's the most uncontroversial action he can possibly take. So that he can say "Look! I'm doing something! I'm totally not giving the telecom companies a free pass!"

</comment><comment><USER58> I have a phone number from a city I used to live in 10 years ago. I don't keep up with anyone from that city so if I get a call from that area code its most likely a spam call.

</comment><comment><USER59> It is out of control. A robot selling health insurance keeps calling at all hours, although I live in Canada where I enjoy universal health care.

</comment><comment><USER60> I get about 5 junk calls a day, at least 2 usually in Chinese. Does anyone know what the ones in Chinese are about?

These days I just don't answer unless it's someone in my contacts, if it's anything important they'll leave a message.

Wonder if it's possible to have a plan with NO voice on it!

</comment><comment><USER61> Just give consumers the ability to see the actual number or VOIP address that's calling them instead of "Caller ID", even if the number is blocked. Then consumers can accurately create an adblock-like list of spam numbers, block calls from outside their country, etc.

<comment><USER62> The problem I notice is that I'm getting calls from my local area code (low population area). Chances are those numbers are registered, used, and released. Poor dev or person in the near future will find themselves on a blacklist.

<comment><USER61> Those numbers are just the caller id rather than the true origin of the caller. Anybody can claim anything as their caller id. The phone companies know the true origin (usually outside the US) but they do not pass that information forward.

</comment></comment></comment><comment><USER63> NoMoRobo is free for landline VOIP in the US (maybe Canada too). Works like a charm in 98% of the time.

For cell phones, you'll usually have to pay for such an app that can intercept calls and check RBLs of naughty numbers.

<comment><USER64> Checking for naughty numbers is completely useless, when the incoming caller ID is spoofed every time.

</comment></comment><comment><USER65> Robocalls aren't the worst part of caller id spoofing. Robocalls are basically annoyances. However, there are real scams such as the IRS scam [https://www.irs.gov/newsroom/irs-urges-public-to-stay- alert-...](https://www.irs.gov/newsroom/irs-urges-public-to-stay-alert-for- scam-phone-calls) where people are getting called with numbers that appear to be from the government, and are losing millions of dollars.

We really need a solution to prevent number spoofing.

<comment><USER66> I'm one who has used number spoofing for good. I create a system to call patients and remind them of medical appointments many years ago, and we would spoof the Caller ID number so that it showed the call coming from the appointment desk of the relevant Doctor's office, even though all the calls were actually originated from a central location. The company had ownership of all phone numbers we displayed, and it was beneficial to users who could call back and reach an appointment desk with the power to help them.

<comment><USER37> Yeah, that's one of the issues. There are actually quite a few legit reasons to spoof Caller ID. So "ban spoofing, period" is pretty much a non-starter.

<comment> yjftsjthsd-h Just do it like SPF does for email; the legitimate owner of a number may delegate its use to anyone they choose.

</comment></comment></comment></comment><comment><USER67> Good. Robot calls have rendered my phone a "voicemail only" machine. I never answer my phone, please text or leave voicemail.

</comment><comment><USER68> If the FCC were interested in the least this would have been done years ago.

</comment><comment><USER69> Yyyyyyyyesssssssss!

It's about time.</comment>


Adventures in financial and software engineering - <AUTHOR> https://falconair.github.io/2015/01/30/composingcontracts.html <comment><USER2> I started working in financial tech in 97, and I've seen a number of "one model to rule them all" efforts come and go since. Back in the late 90s I saw consultants touting Java coded UML models as the way for banks to build the definitive object model of their trading operations. In the early 2000s I worked on JP Morgan's Kapital, an early 90s Smalltalk risk management system using the Gemstone DB. That was supposed to be the last word in derivatives abstraction. And more recently I spent some time working on JP's Athena project, a Python NoSQL system with an implicitly functional graph programming system that enables Python code to behave like spreadsheets. I suspect the ability of traders to invent products, and more recently regulators to invent rules, will always outstrip the ability of coders to invent clean abstractions that will factor the financial domain neatly.

<comment><USER3> There is one (at least) of these systems live based on the original paper by Simon Peyton Jones in a dialect of Haskell.

JPM/BAML/GS have fallen down due in large part to their choice of language in my view. A graph database written in a hurry in C++ then glued together with tens of millions of lines of hacked up python is not the way to build a bank wide platform in my book!

<comment><USER4> What is the paper's title? I'd like to understand the theory behind this approach.

<comment><USER5> Probably this one: [http://research.microsoft.com/en- us/um/people/simonpj/Papers...](http://research.microsoft.com/en- us/um/people/simonpj/Papers/financial-contracts/contracts-icfp.htm) ("Composing contracts: an adventure in financial engineering"). If you have the book called "The fun of programming" (abound functional programming), you have an updated version of that paper; the chapter is called "How to write a financial contract".

[EDITED to add: This is also the first link in the OP.]

</comment></comment></comment></comment><comment><USER6> Declarative descriptions for financial contracts and markets having been actively used for a long time now.

Executable descriptions not so much. The issue really is that it's solving problems we don't have with a solution that gets in the way of solving the problems we do. That's not to say people haven't tried, far from it. But successes tend to be either very rare or very niche.

</comment><comment><USER7> FpML (Financial Products Markup Language) was conceived shortly before the paper referenced in the blog post.[1]

One of the paper's authors went on to create MLFi, a modelling language for finance[2]

This stuff is a bit esoteric but I think it will attract more attention because of its relevance to smart contracts.

1: [http://www.fpml.org/](http://www.fpml.org/)

2: [https://www.lexifi.com/product/technology/contract- descripti...](https://www.lexifi.com/product/technology/contract-description- language)

</comment><comment><USER8> I put together a Haskell proof of concept Monte Carlo pricing tool loosely based on SPJ's work:

[https://github.com/boundedvariation/quantfin](https://github.com/boundedvariation/quantfin)

Still needs some love, but it was a pretty cool experience.

<comment><USER9> I did similar, but I did it Excel. It was cool, not an experiment, and it was done quickly, as Excel is the ultimate Agile tool in finance.

</comment></comment><comment><USER10> I'm digressing a bit, but what language is used here? A skim-over looks like Prolog, but recommendation links at the bottom say Scala. Are the functions (when, and) predefined and not part of the language itself?

<comment><USER11> It's Scala. They show the definitions of the "When" and "And" in the post:

      case class And(contract1: Contract, contract2: Contract) extends Contract
      case class When(date: LocalDate, contract: Contract) extends Contract

It's basically a DSL on top of Scala.

</comment></comment><comment><USER12> I'm a fan of the combinator way, but of course now you have to 'interpret' or 'evaluate' the structure to know what the contract means, so it might be hard to run a 'query' over a bazillion of them sitting in a database - you'd have to interpret each one (each one is a little black box).

This is assuming that running a query or search over all the contracts is something that is useful to do, which I have no idea if that is the case (though seems like a common task in applications programming).

</comment><comment><USER13> I worked on aa commercial product called F3 which, among other things, implemented this type of contract specification as a subset of its functionality. Unfortunately, I'm not sure if they ever learned how to sell it well. One of the most memorable stints in my career so far.

</comment><comment><USER14> there was a blog post or an article by somebody at jane street about their own contract DSL a few years ago. can't find the link now though.

<comment><USER13> The paper that kicked this all off is in the references section. I believe the original company was called lexifi

</comment></comment><comment><USER15> Looks to be a really interesting article. Would really appreciate a font change and justified text though.

<comment><USER16> Good idea. I'll justify the text. What's wrong with the font?</comment></comment>


New mouse design raises questions - <AUTHOR> https://realhardwarereviews.com/quadraclicks-gaming-rbt/ <comment><AUTHOR> this is Qeric, I made the RBT to fix my own RSI, ask me anything!</comment>


Breathing Dirty Air Affects Children's Health - <AUTHOR> https://www.citylab.com/environment/2019/04/air-pollution-data-health-effects-child-asthma-choked-book/587545/ <comment><AUTHOR> The more you learn, the more designing cities and everyday life around cars seems crazy.</comment>


2k square kilometres of desert that neither Egypt nor Sudan wants - <AUTHOR> https://en.wikipedia.org/wiki/Bir_Tawil <comment><USER2> Interesting!

I just read about it on Quora

Bir Tawil has no resources, as opposed to the nearby Halayeb triangle; and due to the current situation (two contradicting treaties decide who gets which of the two areas), whichever country calls for Bir Tawil implicitly recognizes the other country as the owner of the Halayeb triangle. So neither countries will claim it.</comment>


The Dangers of Single Platform Strategies - <AUTHOR> https://medium.com/kyronbaxter/the-dangers-of-single-platform-strategies-78fc6321fd89 <comment><AUTHOR> I recently started writing on Medium again.

I wrote an article on why single platform strategies suck. It was distributed in the product management section of Medium.

Hopefully you'll enjoy it. If you do please leave some claps. If not please flame me, I like abuse.</comment>


Internet access is 'a fundamental right' - <AUTHOR> http://news.bbc.co.uk/2/hi/technology/8548190.stm and still u have the three strikes accusation based disconnections in the pipeline. <comment><AUTHOR> and yet there are talks of copyright infringing accusation based disconnections.</comment>