Lean movie-making: Zombie flick wowing Cannes made for $70 - <AUTHOR> http://www.cnn.com/2009/SHOWBIZ/Movies/05/21/Colin/index.html

<comment><USER2> I've worked on a lot of no-budget movies (no-budget in Hollywood terms is anything under $100k). I have dont feature films that cost as little as $30k. The trick of making a short cheap movie is to know what you're doing well enough to shoot the whole thing in a short period, like 1-2 weeks.

The $70/45 pound is bullshit. Even if you don't pay people (you can get away with this because everyone wants to be in movies), the rule is that you at least feed them and pay for their transport costs (bus tickets or gasoline). Unless you are exceptionally good at scheduling, you'll have them there for a full day which means feeding them twice.

I guarantee this thing cost at least $10,000 in food and expenses. What it probably means is the filmmaker spent $70 and scrounged up the rest from his parents and friends' parents. Even if you do home cooking, feeding and stumping up bus fares for an average of 20 people a day ain't cheap. I hate these kind of stories because when you're trying to raise money for a low- budget movie people say 'well X was made for $150', while many of your suppliers (particularly suppliers of locations, which you can't afford to build) hear 'movie' and think you're going to drop thousands per day.

<comment><USER3> It also doesn't account for the makers labor. It's like saying "I made a web app in my spare time over 3 months while working at McSoftware Firm. So it cost $0 to make!"

No, it was subsidized.

<comment><USER2> Well, working for free or deferred pay (if the film gets sold) is common at the bottom end of the business. So I'm prepared to accept that the labor outlay was $0, since in such cases there's an agreement that nobody is owed any money unless paydirt is hit. And equipment may be owned or borrowed - after all, I have 2 cameras that can shoot video, and a fast computer, so if I began shooting something lo-fi tomorrow I'm already equipped. But still.

</comment></comment></comment><comment><USER4> It helps when you have friends just coming off the X-Men 3 production: "Most of the zombie make-up in the make-up artists' cases was inherited from other movies."

<comment><USER5> It's still impressive that he was able to borrow and recruit volunteers for the whole deal, but the $70 budget is a bit deceiving when he certainly used equipment worth far more money.

<comment><USER6> I prefer to think of it the same way as stuff out of the demoscene that goes on about producing an awesome demo in 4k... and then doesn't mention that it requires all sorts of stuff to be separately provided through DirectX or OpenGL.

<comment><USER7> But it does mention it, it just doesn't make for a snappy headline.

</comment></comment></comment></comment><comment><USER8> I'm always curious how they tabulate costs for this kind of movie. Why exactly were the crow bar and drinks included in the $70, and everything else not? The video camera, or the editing software, or the computer he edited on, or the time of the creator and actors, or even the actors make up and costumes, all cost money, it's just that they were donated or already owned.

If he just recalculated some of the expenses I'd imagine it could also be $0 or several thousand.

<comment><USER9> It's out-of-pocket money, just like those "I built a web startup for $100" posts. If the web startups counted how much the OSS would have cost if it was not free, the total cost would skyrocket.

<comment><USER8> There's a difference. OSS is free for everyone. The things that reduce his film making costs are not free for everyone.

<comment><USER9> OSS may be free in terms of purchase dollars, but not free in terms of time needed to learn how to code. Just like getting X-Men production props is free in terms of purchase dollars, but not free in terms of time needed to build those connections.

</comment></comment></comment></comment><comment><USER10> Agreed, the $70 estimate is very misleading. It doesn't include opportunity cost of capital (time), cost of education, his existing equipment, his friends connections etc. etc.

Also, I'd like to add: his opportunity cost is actually HUGE - 5 years earlier and he was not qualified enough (guessing - tied down with education, learning the ropes etc.), while 5 years later and he's too old to be doing this (pushing 40) and probably tied down with wife and kids.

<comment><USER11> The zombie film flick "Colin" is succeeding on the strength of the filmmaking and the PR made-for-nothing-story.

I have two friends who have made documentaries and films. Startups and film- making are very alike. Making films for people to watch is very much a labor of sweat and passion. Even finishing the film is a feat. Making it into a film festival is a success. There is a whole circuit of local/regional/national/international festivals. Everyone has heard of Cannes - but the Big Sky (Montana) festival? Making a film that is accepted into Cannes? That is a major accomplishment. Making a film that gets picked up by a major distributor. Probably the equivalent of an IPO.

As Chris Holland of the Film Festival Secrets blogs writes:

"I think this [Doonesbury] strip pretty much sums up the indie film experience for many filmmakers"

[http://filmfestivalsecrets.blogspot.com/2009/02/doonesbury-d...](http://filmfestivalsecrets.blogspot.com/2009/02/doonesbury- does-indie-film.html)

Chris, an indie film insider, on the realities of getting your film distributed:

"So while you're on the ground at the film festival, do the following:

» Set discrete, measurable, attainable goals. Of course you should think about what your overall goals are for your film and your career, but for the purposes of any one event you need to write down the bite-sized goals that you can accomplish while you're there. "Find a distributor" is not a bite-sized goal. "Talk to ten distributors and establish contact with an acquisition rep at each" is more reasonable."

[http://filmfestivalsecrets.blogspot.com/2009/01/last- minute-...](http://filmfestivalsecrets.blogspot.com/2009/01/last-minute-film- festival-prep-tips_7437.html)

</comment></comment><comment><USER12> Hollywood has a long _long_ history of fudging the numbers on the true costs of movies. They use it for everything from simple tax evasion to huge complex schemes in order to deprive rights holders of royalties.

Calling it $70 as a publicity stunt is pretty benign.

<comment><USER11> My friend Matt who works as a PA (production assistant - meaning you basically do stuff like go grab a very specific lunch for X movie starlet at times) says Hollywood operates under its own rules.

For example, apparently if you work for more than 14 days (or it might be 21) straight on a production you automatically become part of the union. So, what they do, is every 14 days they fire all the temp workers on the set. And usually rehire them the next day.

<comment><USER13> By the way, do you know why Hollywood seems to have so many strong unions?

<comment><USER11> I don't know and this explanation seems to be good (e.g. talent is not interchangeable because of social connections and big-hitter players supporting the union)

[http://www.marginalrevolution.com/marginalrevolution/2007/11...](http://www.marginalrevolution.com/marginalrevolution/2007/11/why- are-hollywo.html)

</comment></comment></comment></comment><comment><USER14> I learned from a Media Studies course that distribution and promotion costs 100% of the cost of a movie. So a $30 mil movie costs another $30 mil to promote. Unless of course you get promotion by saying how much it cost!

[Additional] I loved the Hunt for Gollum and that was astonishing film making for the budget.

</comment><comment><USER15> Certainly impressive, but I take issue with the statement that this film cost $70 -- is the creator's time worthless? If this film grosses $140, I doubt he'll be jumping in joy over a 100% profit.

<comment><USER16> Your startup is certainly impressive, but I take issue with the statement that you only need $20000/year to develop it -- is your time worthless? If your startup makes $120000 in its first year, I doubt you'll be jumping in joy over a 200%-500% profit.

<comment><USER17> Uh... no, no that argument definitely doesn't scale like that. $100,000 profit for a year's work sounds like a plan to me.

<comment><USER16> The point was that we also measure startups by their cash costs, not their cost+time.

</comment></comment></comment></comment><comment><USER18> How much of this is just buzz-creation? It is next to impossible to verify the $'s spent. However, 18 months of time + volunteers does have a high opportunity cost.

</comment><comment><USER19> hopefully it'll make more money than the blairwitch project

<comment><USER20> Is this sarcastic? According to Wikipedia, Blair Witch Project had gross revenues of nearly $250m as of 18 months ago.

 _The Blair Witch Project grossed $248,639,099 worldwide, against a $22,000 budget.[12] The film was featured in the Guinness Book of Records as having the highest profit-to-cost ratio of a motion picture ever, making back US$11,301.78 for every $1 spent._

<comment><USER19> not sarcastic, I'd just like to have something for $70 break the record

<comment><USER20> Ah...now that you've rephrased it, I see how your comment could read that way.</comment></comment></comment></comment>


Supreme Court Ruling Means Immigrants Could Continue to Be Detained Indefinitely - <AUTHOR> https://www.npr.org/2018/02/27/589096901/supreme-court-ruling-means-immigrants-can-continue-to-be-detained-indefinitely <comment><USER2> For this to be a problem, you first have to commit a crime. Simple fix: don't commit crimes.</comment>


Startup Quote: Sarah Lacy, senior editor, TechCrunch - <AUTHOR> http://startupquote.com/post/6495439419

<comment><AUTHOR> It may be easier than ever to start a product, but building a company is just as hard as its ever been.

\- Sarah Lacy (@sarahcuda)

<http://startupquote.com/post/6495439419></comment>


Webcams used to attack Reddit and Twitter recalled - <AUTHOR> http://www.bbc.com/news/technology-37750798 <comment><USER2> Forgive me if I overlooked it in the article, but if this recall is being conducted at Hangzhou Xiongmai's own initiative, it should be applauded. No doubt it'll be expensive to fix these up, and it's not clear that the organization has any real liability for the security faults. People are suggesting that we should "name and shame", and I somewhat agree, but I think we should also applaud efforts of those who are taking the expensive steps of fixing the problem with no direct incentive to do so.

Because the DDOS's costs are borne externally to the consumer, consumers can't really be counted on to mandate security fixes. On the other hand, establishing liability for a company adding to a preexisting botnet through security faults seems tenuous.

One solution seems to be regulation (self or third-party), and it's exciting to see a manufacturer take this issue seriously and start us down the path of self-policing.

[edit: for clarity]

<comment><USER3> I join you in applauding Hangzhou Xiongmai in doing the recall.

Still, I think liability (for either users or manufacurers) is the right answer. If your device is participating in a DDOS, then it is a bad actor and you should pay for that.

As for regulation, I am in favor of the _right_ regulations (which I suspect will be rules about liability). The danger is that we end up with rules forcing particular engineering methods and security certifications.

That will benefit the incumbent companies who already used the official methods, without necessarily improving the software. In fact it would create "standing targets" that will benefit attackers.

<comment><USER4> > If your device is participating in a DDOS, then it is a bad actor and you > should pay for that.

I wonder how that would play into the debate on gun manufacturers being responsible for people shot and car manufacturers for people run over.

It's hard to find a good way to do make a law about this, that doesn't end up taking ownership away from the owners.

<comment><USER3> Gun users and car users are already liable in these cases.

In the case of IoT security, it's probably more realistic that we see manufacturers held liable. But in my book owner liability would be fine exactly because it keeps ownership with the owner.

If some DDOS victim can show your camera was pinging them, then he can sue you for 1 cent per ping or something. It's only $200 in total, no big deal. But it will make you ask for more security on your next IoT purchase.

<comment><USER5> $200 would be devastating to large swathes of the population in the US

<comment><USER6> True, but I wonder if they'd be buying IoT devices in the first place.

</comment></comment></comment></comment></comment></comment><comment><USER7> There should be recalls from more manufacturers. Someone I know purchased a surveillance camera with a major brand name (Samsung) from Costco [0] just a few weeks ago that gave me a root shell by simply telneting in as root with no password and no way to reliably set a root password or disable telnet. It was returned the following day. Last I checked, Costco is _still_ selling it. This problem isn't confined to cheap Chinese cameras you can buy online. Vulnerable devices are being sold at major American retailers and they are still on the shelves.

[0] [http://www.costco.com/Samsung-SmartCam-HD-Plus-1080p-Wi- Fi-I...](http://www.costco.com/Samsung-SmartCam-HD-Plus-1080p-Wi-Fi-IP- Monitoring-Camera-Bundle-SNH-V6414BN.product.100234327.html)

<comment><AUTHOR> Yeah, this is one reason I still don't have security cameras setup on my home network. If I decide to get them, I am going for a dedicated ethernet network just for cameras and no internet connection. I _may_ allow a VPN to a inside the house server to see footage. According to the Wirecutter, Nest cameras are some of the better commercial one but I've still not bought one or done any review myself.

<comment><USER8> When we were shopping for a baby cam to keep an eye on the baby, I opted to get a simple RF cam [1] instead of the more popular IP cameras that allow you to use your smartphone and monitor from anywhere.

The lower tech approach means you can park a van in my driveway and probably pick up the signal but that's a lot harder (and more obvious) than scanning an IP range from anywhere in world and finding vulnerable devices.

[1] [https://www.amazon.com/Foscam-FBM3501-Wireless-Digital- Monit...](https://www.amazon.com/Foscam-FBM3501-Wireless-Digital- Monitor/dp/B00DNBA82S)

<comment><USER9> I got a Wansview camera and assigned it a static IP and just don't allow any traffic not originating from the chromecasts or tablet -- it's nice because all the TVs do picture in picture with the baby camera.

Still pretty weird seeing the constant log entries trying to reach a couple servers - I've been doing traffic capture since I'd like to see what it's trying to do. One is obviously the plug-n-play stuff, but it's crazy that those packets apparently get broadcast outside the network (? - I haven't really looked into how that PnP IP/port is handled but it's getting caught at my firewall).

</comment></comment></comment></comment><comment><AUTHOR> Is this recall of IoT devices the first of a kind? While it is but a drop in the bucket of IoT insecurity, it has to be an expensive way for the Chinese firm Hangzhou Xiongmai to learn that having the same password on all devices is a security bad idea. Other manufacturers should take note.

<comment><USER10> At least shaming the manufacturers into considering security is a good thing if it makes them avoid being shamed in the future by caring about security. But I doubt most people who bought and use these devices will care as long as they still work.

<comment><USER11> Agreed. This is a good business decision to issue a recall. It probably won't cost too much since very few people will actually return it.

</comment></comment></comment><comment><USER12> It's common to see people frown upon seeing

      curl ... | sh

Sad that we happily allow a _black box_ to connect to our internet without any inkling of the fact that it might be used to attack someone, spy upon someone (ourselves?), ...

<comment><USER13> What is wrong with curl | sh with HTTPS?

Linux does essentially the same thing with GPG signatures instead.

<comment><USER14> It doesnt ever work.

Ive yet to see a "curl [https://thisshit.net/trust/us/really/we/have/https](https://thisshit.net/trust/us/really/we/have/https) | bash" script which didnt fail for whatever dumb reason, such as only working on specific variants of Ubuntu, with specific packages installed in specific version, and/or RedHat.

Usually these shit scripts fail when trying them out, for curiosity, in ArchLinux, Gentoo or Alpine Linux.

Sandstorm.io looking at you.

If you are already going to invest in making "an install script" with defined/researched which packages/versions with which your software needs, for various platforms - submit this data to that platform as an debian/{control,etc} to make a .deb or specfile for .rpm or PKGBUILD or whatever, and use the platforms _build tools_ to generate a platform specific package - be a package mantainer if you have to.

Another side effect of telling your users to curl | bash, is I wont ever use your software. You didnt make the effort to do the right thing with packaging, why would you have done any better for whatever it is youre trying to do with your shit software? (sandstorm again).

<comment><USER15> Don't all the same criticisms apply to `./configure && make install`?

<comment><USER14> Sure, so make it clear what curl | bash is, tell your users "we dont have any packages for your system, here is the source and we use X build tool, please do ./configure && make install, or cmake or whatever", that would have been nice.

When I have to install packages from source, I have a more secure/locked down linux container, with seccomp applied, dropped capabilities etc, then if I intend to use the the software over longer time, and expect updates, I skim the source and build-system quality, quickly write a PKGBUILD or APKBUILD, build it, install it into its own new container - with iptables filtering outgoing connections, and thats it, sometimes submit the APKBUILD to alpine testing or aur.

And all this is easier than curl | bash oh watch it fail for dumb reason in the install script - and I did try that, the time spent troubleshooting the install script is longer than time to sandbox the whole thing as described above.

So, if I can do it, why cant the project? Why spend their efforts on writing an install script instead of package-build instructions to various distributions?

<comment><USER15> For Sandstorm in particular, it doesn't necessarily run inside a container since it is itself a container management / sandbox tool, makes use of seccomp protections, etc. I'm not sure what the best way to sandbox Sandstorm is. Maybe get a separate VM instance.

(I am a Sandstorm fan, but I don't have it installed because it wants me to flip some sysctl about user namespaces or something, and I don't currently have a separate machine to do that on)

<comment><USER16> > it wants me to flip some sysctl about user namespaces or something

FWIW, this is no longer needed! Sandstorm has been updated to work without user namespaces and this installer script change will remove the check from the installer (will probably ship this week):

[https://github.com/sandstorm- io/sandstorm/pull/2656](https://github.com/sandstorm-io/sandstorm/pull/2656)

(You will need to let Sandstorm start as root if you don't want to flip the sysctl, though.)

<comment><USER14> > You will need to let Sandstorm start as root

Joke of today, thanks for the laugh.

<comment><USER15> What do you run as root that isn't accessible to other users on your system, and why are you deploying Sandstorm on this machine?

If it's a single-user machine, any process running at any privilege level can trivially get root by editing ~/.bashrc and aliasing the sudo command.

<comment><USER14> Aliasing the sudo command? Are you serious?

I dont even have sudo, let alone if I had it, I wouldnt use its dumb caching of credentials/session or "ask no password" "feature".

Just because my system is single-user doesnt mean I run every process with that one user, in fact I run firefox as its own user, chrome has its own, mpd as its own user, nginx is its own user and so on. This is basic security practice.

If you seriously think that it is so easy to get root just because you can run a process as a normal user - "by aliasing sudo command", then by all means run everything as root, whats the harm or big deal, right? Why do you even have a user which is non-root?

Why cant sandstorm run like lighttpd or nginx - as their own user, requiring no capabilites, in fact even syscalls can be revoked from them with seccomp and they will still work fine. All they need is socket api, file system api ( open close create), and some others, no they dont need to load kernel modules, ptrace or open_file_handle_at and so on.

<comment><USER16> nginx usually needs to _start_ as root, in order to bind low-numbered ports, but the worker processes run as non-root.

Sandstorm works exactly the same way.

nginx _can_ run as completely non-root, if you are OK with high-numbered ports.

Sandstorm can too, if you are OK with high-numbered ports and if unprivileged user namespaces are enabled.

(It sounds like you actually use UID separation for security on a desktop. That's cool, although keep in mind that if everything is talking to the same X server, then UID separation probably doesn't help much. If you're serious about this approach you should probably be using QubesOS.)

</comment></comment></comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER17> > _The web attack enrolled thousands of devices that make up the internet of > things - smart devices used to oversee homes and which can be controlled > remotely._

It's almost poetic that the IoT devices in question are remote-controllable webcams, since constant surveillance is the _other_ symbol of a dystopian Big Brother society.

</comment><comment><USER18> Has anyone seen an explanation of how the telnet port on these devices is getting exposed to the internet to be exploited? I would think that most home users are behind a NAT device. Even with UPnP, why would the manufacturer have that port set to be forwarded?

<comment><USER19> It's UPnP [0]. It was _always_ going to be UPnP. UPnP is the wrong set of trade offs and always was. And even making it 'off by default' won't solve the problem because the standard instructions for getting any multiplayer game or IoT gizmo to work are 'turn on UPnP'.

Not that this in any way absolves the OEM for the utter idiocy of including the telnet port in their forwards at all and the absolute negligence of having it active by default and 'secured' by a single or small combination of well known auth tuples.

But yeah, that's really what they did. Here's the section of Mirai's scanner.c that sets up the destination port. [1]

        // Set up TCP header
        tcph->dest = htons(23);
        tcph->source = source_port;
        tcph->doff = 5;
        tcph->window = rand_next() & 0xffff;
        tcph->syn = TRUE;

They really did just forward port 23. Tempting to call malfeasance but at best massive incompetence.

[0] [https://www.us-cert.gov/ncas/alerts/TA16-288A](https://www.us- cert.gov/ncas/alerts/TA16-288A)

[1] [https://github.com/jgamblin/Mirai-Source- Code/blob/master/mi...](https://github.com/jgamblin/Mirai-Source- Code/blob/master/mirai/bot/scanner.c)

<comment><USER20> I've never seen any embedded UPnP implementation (I think the spec is "Internet Gateway Device") require any kind of authentication before forwarding ports. I wonder if that's even possible?

</comment></comment></comment><comment><USER21> Is this the first time that this has happened? A severely insecure device leading to a recall.

<comment><USER22> The other company that was widely affected by this, Dahua (see my coverage here: [https://ipvm.com/reports/dahua- ddos?code=hn](https://ipvm.com/reports/dahua-ddos?code=hn)) also issued a statement that they would offer a trade-in discount for affected devices. It wasn't a full recall, and you have to jump through some hoops (work with authorized dealer, etc.) in order to get it.

</comment></comment><comment><USER23> Underwriter's Laboratories should start including basic security hardening in their tests.

<comment><USER24> Vulnerabilities can be surprisingly hard to find: [http://mjg59.dreamwidth.org/45098.html](http://mjg59.dreamwidth.org/45098.html)

(Matthew is an absolute expert at breaking into cheap IoT devices)

<comment><USER25> But with this particular vulnerability, e.g. weak passwords and no way to reset it, I would think that UL could in fact test for this and fail the device.

I like the idea of UL testing for at least _basic_ security vulnerabilities.

<comment><USER26> I think you mean testing for basic security best practices. Testing for vulnerabilities is the hard part, but having good practices is easier to test (e.g. is it a vulnerability or a feature it can't reset?).

</comment></comment></comment></comment><comment><USER27> One down, one million to go.

Thee is no way these horses can be put back into the barn, there are too many of them. As long as consumers make their decision based on price there is every incentive for the manufacturers to continue cutting corners - the ones that put extra work into security will be at disadvantage compared to those playing fast and lose.

Can we talk about BGP flowspec instead? Filtering offensive traffic early and often can end DDoS once and for all.

<comment><USER28> >Can we talk about BGP flowspec instead? Filtering offensive traffic early and often can end DDoS once and for all.

What about spoofing? Until broadband providers get serious about BCP 38, this is just cat and mouse.

<comment><USER29> Is BCP 38 difficult to implement? It seems like something most edge routers should already support.

</comment></comment></comment><comment><USER22> And at the same time, the company recalling those products is issuing threats against anyone who is defaming their "goodwill": [https://news.ycombinator.com/item?id=12778954](https://news.ycombinator.com/item?id=12778954)

</comment><comment><USER30> This article doesn't mention the brand names of cameras manufactures by Hangzhou Xiongmai. Anyone know any?

<comment><USER31> It appears that on Amazon they're sold under the name "XM".

[https://www.amazon.com/Surveillance-Infrared-Recording- Wirel...](https://www.amazon.com/Surveillance-Infrared-Recording-Wireless- included/dp/B01DNHFC2C)

If you sort by the seller there you can see they make dashcams and webcams.

</comment></comment><comment><USER32> Was it possible to take control of these cameras even if they were behind a consumer firewall? Is the issue that consumers were connecting them directly to the Internet, not behind a firewall?

</comment><comment><USER33> Would it not make sense for broadband router manufacturers to step up here, especially ISPs who provide routers to customers.

First of all, IoT devices really need to be connected on isolated vlans with very strictly controlled WAN capabilities. Obviously this already exists, but not in the fashion a layman, who wants to put their fridge on the wifi will understand. The average home routers need cleaner interfaces and clearer abstractions rather than the cruft that exists now.

Does your fridge really need to access the internet, and if it does, perhaps you could setup your router to only allow access at certain times, to a single host and with circuit breaker protections in case traffic has a signature that matches that of a DDoS attack. This circuit breaker pattern could be extended to all traffic running through the router, and provide the user with reports of potential infected devices and traffic hungry users.

</comment><comment><USER34> As someone who was a VLSI design engineer for 4 years, as well has extensive software experience, much of the disruption happened because of poor engineering. There should always be redundancies in critical systems. The groups such as Twitter, Reddit and Spotify did not use redundant DNS providers relying only on Dyn. Moreover, DNS should be designed so that the systems are more resilient to attacks. The initial design of the internet was meant to withstand nuclear attacks after all.

There is absolutely no way that we can protect all devices on the internet from being bots, etc. Just as it is almost pointless blaming hackers when in most cases the hacks were because breeches from failure to update software, to put in proper security software, and to hire top level consultants to implement secure systems.

Put another way, we can't possibly jail everyone who would want to steal money. That is why we use safes.

<comment><USER29> Fair point, but how do you decide how much redundancy is excessive? I can always construct a scenario which will require more redundancy and more cost.

<comment><USER34> It would depend on how critical the element is to the system. I would expect at least one backup system. That is there should be a least one major backup DNS provider for example. Some systems on airliners have two backups.

</comment></comment></comment><comment><USER35> A significant number of these cameras were bought on Aliexpress and EBay. How are they going to do the recall when they don't even know the end customer?

<comment><USER36> Aliexpress and Ebay don't ship the products, the sellers do know who the buyers are, at least their name and address.

<comment><USER35> Ok when I said "they" I meant the manufacturer(s). Look at Samsung and their inability to do a proper recall for the Note 7. A lot of the stores from Aliexpress disappear after one year of existence. I think the proper thing to do immediately is to reverse Mirai and force a password reset on the affected devices.

</comment></comment></comment><comment><USER37> It's disappointing the article doesn't give any actionable detail of the recall. From what I can see, Hangzhou Xiongmai is a components manufacturer, not a retail brand, so there's no practical way to identify an affected device with the information here.

</comment><comment><USER38> So by subsidizing each webcam by a dollar or two, China is able to deploy millions of pieces of hardware to the U.S. that can be used to map and destroy our infrastructure for a total cost of a few hundred thousand dollars. If done purposefully, this has to be one of the most efficient military spends in history.

<comment><USER39> You forgot the part where people are voluntarily buying those, because they cost less. Of course those made in California would be totally safe, but damn shame about that globalism.

<comment><USER40> > Of course those made in California would be totally safe

Maybe I'm too cynical, but from what I know about the NSA and other three letter US Government agencies, I beg to differ.

Additionally, good luck finding any type of electronic device that is entirely made in the USA. I honestly can't think of anything with a printed circuit board that is assembled in the USA from 100% American-made parts.

Then of course there's always the whole engineers taking shortcuts to meet unrealistic deadlines thing. Somehow network security tends to be very low on the list of priorities when you have to make a profit.

<comment><USER41> This has nothing to do with governments, it's freaking _hard_ to build secure software. There'd be bugs in American software just like there are bugs in the foreign software.

</comment></comment></comment></comment><comment><USER42> I think I see a opportunity for something new here.

Why isn't there a uber secure OS written in a high level language that would prevent easy privilege escalations, vulnerabilities caused by buffer overruns etc?

It would be nice to have a standard security approving body (like FCC) that gives out graded standards.

It is like every generation forgets the mistakes of the past and repeats them. When $5 Raspberry Pi is powerful enough to run desktop OS, I see no reason to not adopt a high-level language that prevents basic security violations at the roots.

<comment><USER29> I think this method requires too much effort and attention to detail to be realistic, although I do agree this would be an ideal solution. It makes more practical and economic sense to put an electronic network "condom" around a dirty, likely misconfigured and insecure IoT device.

</comment></comment><comment><USER43> I think the real problem here lies in the lack of auto-update. Devices will always have vulnerabilities, constantly being discovered, which once weaponized will be just as trivial to own a large swath of devices as telneting for root was here.

The UCC provides an implied warranty for suitability for intended purpose. The FTC defines unfair and deceptive business practices to require a baseline level of security commensurate with the sensitivity of the data that could be exposed or the potential damages that can be inflicted. As in most cases, new laws tend to make things worse, we just need to do better with the old laws.

It's not that it's illegal to sell someone a Io(S)T device that can be owned for running a DDoS, but I am willing to bet it is illegal or at least creates significant liability for the manufacturer to sell such a device that also has no way to be fixed after that flaw is discovered.

What would be nice is a simple industry standard labeling that indicates a device has auto-update functionality, along with a large numeral indicating the number of years from date of purchase that updates will be provided. The same decal could be used on computers, phones, routers, and IoT.

Just like we trained consumers to look for the WiFi Alliance logo to know the router or card they are buying will "just work" I think we are missing a label which would drive consumer confidence and encourage good behavior by the manufacturers.

Probably an industry consortium already exists for something like this, but I just haven't heard of it... Because there's no such thing as a new idea, right?

</comment><comment><USER44> Wow, with more and more crap entering the market and more and more people connecting things, it seems like in the future it would be nearly impossible to prevent these types of attacks.

Who could you hold responsible? The user for not setting a password or the manufacturer for accidentally creating a backdoor? Neither is really reasonable nor feasible. Filtering the attack is also extremely hard due to the scale of distribution.

Will this lead to a more locked down internet?

<comment><USER45> Hopefully it will lead to some regulation of these devices. That's a dirty word to many, but the fact is that Internet-connected devices are part of a global community, and need to behave safely, and being open to hijacking by criminals is not safe.

The proposal I like best is that the industry should get out in front of this, and build a self-regulator organization now which issues recommendations and certifications of Internet-connected products. Then governments could simply require compliance with the industry norms, established and vetted by the industry, and we can keep political institutions out of micromanaging the electronics industry.

The model to follow here is Underwriters Laboratory, which sets standards and grants certifications for electrical and industrial supplies and equipment. Then, for example, city governments can just specify that everyone installing, say, outdoor lighting at their home must purchase lights and outlets rated for wet outdoor usage by the UL.

<comment><USER46> Egress filtering, or filtering packets not of the source network, would go a long way here. It wouldn't fix everything, but it would be a definite start.

</comment></comment></comment><comment><USER47> Though I'm happy we got top billing in the headline, Reddit wasn't actually impacted directly (though of course many of the sites we linked to were).

</comment><comment><USER48> You guys are crazy. A probably small creative team simply made an error while building a camera in good faith that was abused by criminals. Who is the victim here?

What's all this crap about simple fun web cameras as "Bad Actors"... In fact the use of the term "Actor" as applied to a pretty dumb piece of electronics is pretty creepy in itself. What are we trying to do here?

The term "State Actor" is fairly new in terms of popular usage. Thanks to CNN and media, we are being trained to know this word in a particular context.

Now, we are being trained to place dumb pieces of electronics in the same bucket as Russia and China. LOL

I'm sure there wasn't a meeting where the camera manufacturer execs set around a table and said let's make these things blow up the world.

And you know, even if there was, the shame lies on the fact that we don't have better edge level security that can detect and shut down abnormal traffic patterns close to source.

There is some fairly low hanging fruit here. Routers and gateways with pretty damn simple algorithms could detect and prevent these types of attacks if they were available.

The network should protect itself against "Bad Actors", because... trillions of devices are a coming, and we can't expect them all to be certified to protect the network. The concept itself is completely absurd.

Fat better to improve the infrastructure than to impose per device level policies. It's the IETF that needs to step up. Not the guys in a garage who couldn't code.

Sure maybe they could have done a better job, but from the level of programming we are currently at it is an absolute certainty that this will happen again whether we like it or not.

<comment><USER49> > A probably small creative team simply made an error while building a camera > in good faith that was abused by criminals. Who is the victim here?

Everyone who's been affected by the DDOS. Manufacturers are responsible for the security of their devices. If you ship something that's vulnerable, it's you to fix it. If there are damages, those come out of your pocket.

> It's the IETF that needs to step up. Not the guys in a garage who couldn't > code.

No. If you're a guy in a garage who can't code, you shouldn't be writing code, let alone shipping devices.

Are you for real, or some kind of astroturf account?

</comment></comment><comment> martin-adams I've been concerned about the security of IoT devices for a while as the low cost devices generally do have security as an after-thought.

However, these being used for a DDoS attack puts a spotlight on the issue. While I don't know the solution, I feel it will become harder for manufacturers to shrug this off.

</comment><comment><USER50> So... if a company does all due diligence to perform a recall, but very few people actually send back their five dollar web camera. Is the company pretty much off-the-hook then if that customer's kept webcam gets hacked and is used to brick a nun's IoT pacemaker?

<comment><USER51> I would imagine they are off the hook for liability if they issue a recall, and I would also imagine there are going to be probably less than 5% of devices actually returned. How many end users of these products have any idea that they were part of this attack and how many end users will care enough about some cheap chinese electronic device to send it back and wait for a refund/replacement?

</comment></comment><comment><USER52> So, do there exist _any_ IP cameras that are simple, secure and don't open a crazy number of ports for bizarre, unnecessary protocols whilst including a steaming pile of PHP (or similar) to provide a buggy, over-engineered, exploit-ridden web interface?

I could do with some for a farm project at the moment, but as far as I can tell, they're uniformly awful. Are there any that are reflashable with something more respectable, even?

Ideally what I want is a video stream over TCP with power-over-ethernet support - and no other services.

</comment><comment><USER53> I'm surprised we haven't seen anything exploiting rompager yet. This is a very widely used web server in home routers

[https://www.shodan.io/search?query=rompager](https://www.shodan.io/search?query=rompager) [http://www.pcworld.com/article/2861232/vulnerability-in- embe...](http://www.pcworld.com/article/2861232/vulnerability-in-embedded-web- server-exposes-millions-of-routers-to-hacking.html)

</comment><comment><USER54> Apple made a good call with its "strict" requirements for HomeKit devices.

[http://www.forbes.com/sites/aarontilley/2015/07/21/whats- the...](http://www.forbes.com/sites/aarontilley/2015/07/21/whats-the-hold-up- for-apples-homekit/#39031ee4322b)

<comment><USER55> its easy to be secure when virtually nobody has your devices...

<comment><USER54> I'm not sure what point you're making. Which devices are those?

<comment><USER55> my point was simply that homekit has been incredibly slow to gain any adoption and is pretty limited in terms of who can make things (mfi program), what hardware needs to be in your product (special auth chips..) etc. As a general strategy, if your iot strategy requires iot device makers include special chips and use specific factories, its a rather closed way to approach the market.

<comment><USER54> MFi isn't too limited. You must just apply and meet certain standards. The benefit is you have access to a huge market (iOS users).

What's wrong with this approach? Imagine the PR disaster if this DDoS attack was caused by HomeKit devices.

As a potential future user of HomeKit it's reassuring to know security is a real concern here. I'm glad I won't have to probe the device to check it isn't running a telnet server with no root password, for example.

When we're talking about an internet-connected camera or a front door lock, yeah I'm going to want high standards for security. If that slows down HK adoption so be it. If I wanted a convenient-but-insecure lock compatible with my existing devices _today_ I'd just leave my door unlocked.

<comment><USER55> i think this perspective conflates good security and bad security with a single approach.

"You must just apply and meet certain standards" \- your factory also needs to apply and meet standards, not just you. we work with a fantastic factory that builds high quality products (numerous baby and toy products) and is large (>45K employees). they aren't mfi certification (its not just meeting standards, its an application process that costs time and money).

The benefit is you have access to a huge market (iOS users). - we already have access to this market. The main thing is slapping a little homekit badge on the packaging and slightly tigher integration with siri.

agreed with you that nobody wants to be at fault for taking down the internet due to bad security on their devices, but its a bit misleading to suggest that apple's approach is a good way to do it.

whats fundamentally wrong with it is the cost it imposes onto companies making something compatible with their ecosystem. I don't want to add a few dollars to my BOM so that I can further help their ecosystem. I also don't like the closedness but I understand that is apple's general approach. I want to have open APIs and cloud integrations. Radio/hardware level integrations are fine but given the giant mess that is IoT radio standards, I would rather just integrate via https.

For perspective on how this makes it down market:

Lets say I want to make a Thread compatible device and a homekit compatible device. I have now likely added 4-8USD to my BOM. Typical multipliers from BOM to retail are 3-5X or more so we could have just added 32 usd to our price. Or we could have just done a cloud integration and used the wifi or bluetooth chipset we were going to use anyways...

<comment><USER54> I agree it's not a complete security solution, but it's certainly a good baseline if nothing else.

>The main thing is slapping a little homekit badge on the packaging and slightly tigher integration with siri.

It's integration into the entire HomeKit platform including the new Home app across multiple devices.

Thanks for the in depth numbers. Personally I'd pay an extra $20 for something HomeKit compatible, especially if I'm paying $150+ anyway. I've been looking at some devices lately and haven't even considered anything which doesn't integrate with HomeKit.

</comment></comment></comment></comment></comment></comment></comment><comment><USER41> Laws won't fix this, recalls won't fix this, what we need to do is find a technical solution to the DDoS problem.

You can't un-ring this bell, and it might actually be harmful to try. A free and open Internet is more important than DDoS attacks.

</comment><comment><USER56> It's not webcams technically, they're the ip surveillance cameras which run a customized linux with some scripts and a RTSP server, and definitely not designed for public IPs.

</comment><comment><USER57> If they are connected to the internet, why not push out an update to fix the default password issue?

A hardware recall seems silly when it's clearly a software issue. Unless they didn't include any firmware updating system... which is likely the elephant in the room not being addressed with most insecure IoT devices. Android faced this problem as well and has recently made progress addressing it. Although a lot of phone companies get in the way and manufacturers have very short support lifespans.

<comment><USER55> This. We build IoT devices and frankly, we are late shipping while we are doing heavy duty testing on FOTA. Happy to ship late to avoid being part of a botnet and to make sure we can improve our products over time. Depending on the complexity of the product, FOTA can be rather complex and I don't expect budget device makers that aren't particularly branded to bother.

</comment></comment><comment><USER58> What a stupid, inaccurate, article title. Shame on the beeb.

Edit: Better? "Webcams used to attack a DNS provider recalled."

</comment><comment><USER59> Is the denial of service attack on DNS servers still going on? Major sites are still much slower than last week.

</comment><comment><USER60> Good for them! A recall is the responsible option at this point, and I hope other manufacturers do the same.

</comment><comment><USER61> How many devices are recalled? What percentage of the DDoS were they responsible for? Not enough information.

</comment><comment><USER62> what about the routers and other cheap devices. This is a drop in the bucket. Until regulations (and strong enforcement) of devices requiring device security to sell them in countries like the US, UK, EU etc. happen this will continue to be a problem.

</comment><comment><USER63> Does anyone know if Foscam's were affected at all? I unplugged mine to be safe.

</comment><comment><USER64> This is extremely disconcerting

</comment><comment><USER65> I wonder if when you hit show parent (yesterday) it wouldn't load...

</comment><comment><USER66> there needs to be a regulation body, similar to NHTSA that regulates security of digital products.

<comment><USER67> Becareful what you ask for. How is any software nowadays different?

If I setup a raspberry pi with camera and there are exploitable bugs in the software is the creator of the software liable? Does every piece of software open source and closed source need to be approved by a regulation body before your allowed to run it? Distribute it? Put it on GitHub?

There's nothing unique about IoT devices. They're just computers. If you regulate one you arguably have to regulate the other

<comment><USER66> I'm not saying iOT devices specifically. We can define the regulation threshold at mass consumer digital and connected products.

Yes, digital/software is inherently less tangible and trickier to regulate than a physical product sold at smaller volumes, but we need to start somewhere. Poorly made digital+connected products distributed in large volumes can have tremendous impact to the world population.

</comment></comment></comment><comment><USER68> A recall where you could just upgrade the firmware?

<comment><USER69> Can you still do so reliably on a compromised device?

<comment><USER70> Yes. The Mirai software runs in memory. You can clear the infection just by rebooting the device. But if it's connected to the internet, it will be reinfected again within minutes, unless you change the admin password.

<comment><USER71> You mean, one of the known botnets runs only in memory.

We've no idea if there are others out there who attack these devices and subvert the firmware too.

<comment><USER70> Sure, and even if there isn't one today, it's probably just a matter of time before nastier stuff gets out there.

</comment></comment></comment></comment></comment><comment><USER72> We need a new acronym: IoCT = the Internet of Crap Things.

<comment><USER73> I much prefer InternetOfShit ([https://twitter.com/internetofshit](https://twitter.com/internetofshit))

</comment></comment><comment><USER74> I'm designing a weapon on mass disruption IoT confetti. Bow to my demands or I will send you an exploding yey tasteful confetti card with 50,000 confetti all trying to access your wifi network.

</comment><comment><USER75> _Webcams used to attack Reddit and Twitter recalled_

I think it's kind of troubling that "the vast variety of information services that comprise the internet" apparently means "Reddit, Twitter, and Facebook" to laymen now.

<comment><USER76> the title was just a really terrible summation of the attack. TONS of websites were affected. Some huge like reddit and twitter, and some tiny ones.

</comment></comment><comment><USER77> > "Security issues are a problem facing all mankind," it said. "Since industry > giants have experienced them, Xiongmai is not afraid to experience them > once, too."

The courage to try something new. Oh wait it isn't new, this is being a copycat.

<comment><USER78> It's probably just bad English but it really sounds like, "everyone gets hacked, we don't care".

<comment><USER79> The company issued the recall, it could be hugely expensive for them and is the right thing to do. Looks like they do care to me!

</comment></comment></comment><comment><USER80> > If your webcam is hijacked you have effectively let an intruder enter your > home

Except it's not. They can't touch me, hurt me physically, take things away. All they can do is see me.

So what they see some guy in front of a computer. I'm more worried about the hacks that can take over my keyboard, and can access financial data. But even then it's the banks problem and insurance that will take care of it.

<comment><USER15> If they can see some guy in front of a computer, can't they see some guy in front of a computer typing a password into a financial website?

</comment></comment><comment><USER81> So there must be a law:

1\. Any device with internet access must be able to automatically update all its software.

2\. Because a manufacturer can either go out of business (some devices are used for >10 years) or not care about its users, all its software must be open source. A code, which needs to be secret, can be stored on a hardware level.

3\. But if a software is open source, it doesn't mean there would be people who'll fix the bugs, therefore there should be the list of OSes approved (by a regulator and EFF?) to be used on IoT-devices. The development of these OSes should be public (on GitHub, etc.). By having ~10 different OSes instead of a million, solving bugs would be possible and much easier.

4\. By having such list of approved OSes, we also solve the problem of having a vulnerabilities in the updating process, e.g. missing signatures, using RSA-1024 or even RSA-512 for signatures.

5\. By having such list of approved OSes, it'll be easy to maintain the live kernel patching service (in the future it'll be hard to imagine an OS without it).

6\. By having such list of approved OSes, community would quickly fix the problem of using default passwords.

Without such law, expect 10 Tbit/s attacks in a year, and >500 Tbit/s attack in 2022 (if popularity of IoT would increase as fast as mobile phones did).</comment>


How Much You Could Save by Pooping at Work - <AUTHOR> https://www.330ramp.com/blog/2019/12/17/flushing-money-down-the-toilet <comment><USER2> > A safe assumption would be that you'd have to call a plumber once per year.

Wait, what? Is that a "safe assumption" in America? Because I'd calculate with "once in a decade".

<comment><USER3> I've never needed a plumber in 20 years, and before that I can't recall my parents ever needing a plumber, either.

Should I buy a lottery ticket?

<comment><USER4> You should buy a new hot water heater.

<comment><USER3> That's the landlord's responsibility, not mine.

</comment></comment></comment></comment><comment><USER5> I keep trying to tell my friends to not sweat going to the bathroom at work, people just don't get it smh

<comment><USER6> I precept students at work.

One of my Day1 line items is "if you have to go to the bathroom, just go. You don't need to tell me."

Which is right up there with:

"Don't hurt yourself trying to get here on time."

And maybe a sarcastic: "Don't worry, your work/projects will still be here when you return" if I size them up as being appropriate for that.

</comment></comment><comment><USER7> Further toilet cost cutting can be found at [https://m.wikihow.com/Make-a- Substitute-for-Toilet-Paper](https://m.wikihow.com/Make-a-Substitute-for- Toilet-Paper)

</comment><comment><USER8> For me it would be a cost, because I have a composting toilet. Every time I poop elsewhere I'm losing valuable nutrients that could go into my garden.</comment>


Phantoms of fear and loathing - <AUTHOR> http://peterstrempel.com/index.php/culture/phantoms-of-fear-and-loathing/ <comment><AUTHOR> One of a series of posts by the author on perceived pathologies of Wikipedia administration. Earlier, "Wikipedia on par with Fox News".

[http://peterstrempel.com/index.php/culture/wikipedia-on- par-...](http://peterstrempel.com/index.php/culture/wikipedia-on-par-with-fox- news/)

I'd be interested in seeing commentary regardless of agreement.</comment>


Microsoft shows how bad Chrome is for your laptop's battery - <AUTHOR> http://www.theverge.com/2016/6/20/11975514/microsoft-chrome-edge-browser-battery-life-tests <comment><USER2> Two thoughts: Now that Chrome has virtually all of Ecmascript 6 compliancall save for tail-call optimization) and a good smattering of Ecmascript 7 in (just realized last week) it would seem that the next step for the V8/Chromium teams would be to optimize the hell out of the stack "it's far easier to make a correct program fast than it is to make a fast program correct"

The second is that while Edge is only on a single platform that Microsoft owns, Chrome is on multiple platforms. Thus one would hope that they can optimize their own stack for this one particular test. Perhaps this is a copout, but still worthy of mentioning

<comment><USER3> The other factor is that Edge implements far less of ECMA specs than Chrome. It would be interesting to see how much more CPU power would be used by Edge when it implements the same set of functionality as Chrome's V8 engine.

</comment></comment><comment><USER4> I use a Surface Pro 4, an incredibly buggy device that has the most to gain from switching to Edge. The battery life with Chrome is about 3 hours. Unfortunately, Edge still only supports extensions (i.e. adblocking) in preview releases as far as I'm aware.

A browser without adblocking in 2016 is worthless. Looking forward to the July update and hopefully a ublock origin port sometime before the end of the year.

<comment><USER5> Just to add to this, I'd be curious to see a head-to-head of the various browsers with an appropriate adblock extension active as well.

</comment></comment><comment><USER6> Google products seem to often be terrible for your battery. Even on firefox, having google docs or gmail or whatever open sets of that damned google talk plugin that devours my battery. So much of android too, from what I remember. Seems like they make awesome products, but without any regard for efficiency.

</comment><comment><USER7> Okay, now run one running Edge under Windows 10 versus the same laptop running Chrome OS.

<comment><USER8> Since Chrome itself kills battery life, what makes you think an OS where all user applications are Chrome-based is gonna help?

<comment><USER3> Is there a windows notebook that runs for 12+ hours on battery? I have yet to find one. Seems like Windows notebook makers are scrimping on the battery.

My rather old Samsung ChromeBook runs all day on a single charge. So I don't think that the problem is Chrome. More likely that Microsoft knows kernel internals that help it run more efficiently than third parties who don't have such inside knowledge.

<comment><USER8> > _My rather old Samsung ChromeBook runs all day on a single charge. So I don > 't think that the problem is Chrome. More likely that Microsoft knows kernel > internals that help it run more efficiently than third parties who don't > have such inside knowledge_

Conspiracy theory that doesn't explain how every non-MS other browser beats Chrome on the same game, including Firefox. And it's not like Chrome/Chromium on Linux is battery-friendly either.

The actual difference (why Chromebook can get 12 hours battery life) is that Windows (or OS X for that matter) runs much more stuff compared to ChromeOS under the hood. Now consider the times a Chromebook with an actually efficient browser would get.

</comment></comment></comment></comment><comment><AUTHOR> Opera: Why we challenge Microsoft's battery test

[https://news.ycombinator.com/item?id=11961649](https://news.ycombinator.com/item?id=11961649)

</comment><comment><USER9> I would be interested to see the power consumption impact of browsing the Verge

</comment><comment><USER10> Seems like a lot of people are criticizing the validity of this test.

And yet, this is an easy test to replicate:

1\. Charge any windows 10 laptop to 100%.

2\. Set alarm to go off at 80% Battery.

3\. Stream video (netflix, amazon, youtube, etc..)

4\. repeat with next browser.

</comment><comment><USER11> Maybe they should do a comparison of extension support or developer tools? :P

</comment><comment><USER12> It's funny how Microsoft conducted the "tests" on Chrome [1] & Firefox [2] and discreetly leave out Safari. Safari is by far a winner when it comes to efficiency. So hats off to MS for their "informative" & "thorough" test(s).

[1] has been known for draining battery, so no surprises there.

[2] which for a couple of releases has become even more unusable. On my MBP (2014, i5, 8GB), takes over 4+ seconds for the bar to activate. Hopefully with the introduction of E10S [3], next releases will be much more perfomant.

[3] [https://wiki.mozilla.org/E10s](https://wiki.mozilla.org/E10s)

EDIT: I did not know Safari is no more on Windows. So in that case Edge is the winner for Windows.

<comment><USER13> So... You think MS should have run all of their tests on macOS?

<comment><USER3> How about porting Edge to Android and testing on a smartphone?

<comment><USER13> ...because they care most about performance on Windows?</comment></comment></comment></comment>


Ask HN: Containers and network access? - <AUTHOR> Tuning for any high load, the first thing you need to do is turn off conntrack. But then you lose DNAT. Yet every container network guide depends on iptables and DNAT?!
What's the docker approved way to flatten the network and get routing directly to the container services? Or are people actually running with conntrack and DNAT in production? It seems like it can have a significant impact, which is why I'm seeking alternatives...
On another note... It seems like the ECMP fix is going to be coming to the kernel soon, there's a lot of hardware which will be ECMP capable, so that should hit the masses. I wish it were here sooner! <comment><USER2> A docker container can run in host networking mode.

You could also disable the DNAT and route IPs to your containers. Docker uses network namespaces to create a bridge to the actual ethernet card - the DNAT part of things is only one possible configuration.

IPv6 makes it easier to have routable addresses.

The right choice is going to depend on the available infrastructure, performance requirements, workload profile, ...

But really, in most environments, connection tracking simply isn't the bottleneck. Where it is, configure your systems not to use it.</comment>


Frank Wang's Quest to Put DJI Robots into the Sky - <AUTHOR> http://www.forbes.com/sites/ryanmac/2015/05/06/dji-drones-frank-wang-china-billionaire/ <comment><USER2> For now there's FAA Section 333 which is case by case. With enough cases, it should start forming meaningful classes. [https://www.faa.gov/uas/legislative_programs/section_333/](https://www.faa.gov/uas/legislative_programs/section_333/)</comment>


Researcher claims private phone numbers on Facebook are not, Facebook won't fix - <AUTHOR> http://tech.leadstories.com/2962552-look-up-phone-number-on-facebook.html <comment></comment>


New Triplebyte Founder Roles: Ammon – CEO, Harj – Chairman - <AUTHOR> https://triplebyte.com/blog/new-triplebyte-founder-roles-ammon-ceo-harj-chairman <comment><AUTHOR> I've been founding and investing in startups for over a decade now, so I know that founder transitions are inevitable as a company grows. This is one of the instances where having "startup experience" helped me a lot with thinking through the different options and picking the right one. I'd be happy to talk with anyone who is thinking through their role as a founder.</comment>


ASK: Experience with Indian Recruiters? - <AUTHOR> I have 20 years experience in Silicon Valley, IT, Tech.
I have been on the job hunt, and over the last 6 months, I have had so many poor interactions with Indian recruiters that I refuse to work with them at all going forward.
Their understanding of what I do is poor, their communication, integrity, follow-up, entire demeanor is poor.
My interactions with them has been so bad, that I would never hire a potential employee in the future from any Indian recruiters going forward, as I am convinced they never have the best interest of anyone but themselves.
I feel itsa cultural thing - but I just can't believe that companies would be working with recruiters who have such crappy performance.
And this has been for jobs literally across the nation. I have been sought for positions from CA, TX, MA, NY... but all from Indian recruiters who aren't even qualified to ask basic questions about what I do. <comment><USER2> I have only one experience to share. Interviewers (2) asked me to choose my favorite time to be phone-interviewed in a window of 4 hours, 9-13, more like 9-12.30 because by 13 call had to be completed.

I took 1 hour off from work to attend, then the "conf room" wasn't working (conferencing pin code was wrong). This made them re-schedule the call. Then they asked me to re-schedule again. Then again.

Finally we arranged for a given time and day, with a working conf room. When I called-in they were interviewing another developer on the same conference room. And it wasn't the previous interview... they actually scheduled two interviews at same time because they messed up with time zones.

They canceled or rescheduled interviews giving note no more than 30 minutes before the agreed time. So in all this I lost 4 hours of work. At the end I gave up and withdraw my application, not worth it.

</comment><comment><USER3> Similar story here in London; I have experience with 2 Indian recruiters and seems like I will not bother anymore.

They seem to only recruit for bullshit outsourcing companies - in my case they tried to advertise Infosys and Tata Consultancy Group. This meant none of them could tell me what the _actual_ client was and what my day to day would be like.

Also the last one tried to get me to sign not one but _two_ GDPR consent forms, the second by literally opening a PDF, filling-in a page manually (it wasn't a form so I guess I should've printed it out, filled it by hand and scanned it?).

Overall no thanks.

</comment><comment><USER4> Any reason you looking for 6 months and not being able to land a job/going ahead with a place you got placed ?</comment>


Ask HN: What Product to Build with Drones? - <AUTHOR> Hi,
My friend and I have 20 years of experience in conception and design of drones, missiles and several aeronautic equipments.
Today we are offered up to $1M to build an innovative product that would involve drones or equivalent.
What would be a great idea? We really liked the news about "drones planting 1 billion trees" or "drones doing surveillance of sharks in the bays".
What else? <comment><USER2> >What would be a great idea? We really liked the news about "drones planting 1 billion trees" or "drones doing surveillance of sharks in the bays".

Combine the two. "Drones planting 1 billion sharks in the bays"

<comment><AUTHOR> Love it. Will start in California, we don't need this in Australia at the moment!

</comment></comment><comment><USER3> Fireworks laser. One drone with tons of lasers on it that can paint amazing colors in the sky. Maybe a cluster of these drones for added effects.

</comment><comment><USER4> Drones picking up trash would be cool, but maybe infeasible.

</comment><comment><USER5> Photographic/video lighting.</comment>


How to hire designers - <AUTHOR> http://insideintercom.io/how-to-hire-designers/

<comment><USER2> I've learned over the years as a creative director that there are just some clients who _get it_ and some that don't.

The clients who _do_ get it will invite the design team to their production meetings; they'll include us on key decisions (for example, "should we have feature x?"), and they'll expect us to contribute to the overall product, NOT just in design, but also in functionality.

The clients that don't get it? You get a stack of content and a list of demands, along with phrases (that we now use freely around the office) like "jazz it up" and "make it more FUN!" _Those_ are the clients that think great designers are found on Dribbble and that my team always needs to be "pushed" to produce "fun, exciting, INNOVATIVE" design. In reality, we just take our effective, well-executed design and practically roll the dice to see which Dribbble style _du jour_ we can slap on it.

So, in a kind of weird way, Dribbble makes my job a lot easier in terms of showing me how to make my work shittier so that it's accepted by dumbass clients. For that, I am thankful.

<comment><USER3> Great designers _are_ found on Dribbble. It seems you're making a leap from "Dribbble has bad designers" to "All designers on Dribbble are bad".

Just because some designers on Dribbble choose to focus on visuals doesn't mean that they haven't mastered the other components of design as well.

Dribbble and similar sites like Behance are great to evaluate visual design. For other components, you have other media (writing, videos, case studies, etc.) Why can't we just leave it at that instead of acting like this is somehow Dribbble's own fault?

<comment><USER4> Sorry they designed a medium for a specific purpose but it wasn't the poster above you's ideal specific purpose so therefore it is worse than useless.

</comment></comment></comment><comment><USER5> Great post and a great follow up. I think dribbble's co-founders intended the site to be a show and tell of _actual_ work (pure speculation) but has become more of a showcase of flashy unrealistic photoshop designs.

I think the divide in the design industry is going to be short lived as companies start to realize that they don't really need a a graphic designer, a product designer, a UI designer and a UX strategist. They need one (or several) competent designer that can understand all of these roles.

I wrote a short blog post discussing the issue: [http://generalist.io/designers-design](http://generalist.io/designers-design)

<comment><USER6> I dunno. That is pretty general. The needs of each company varies widely, and, like the author said, the master of all 4 of those categories is a rare find. Defining your company's needs will help you figure out what kind of designers to look for.

My preference for a product team structure is this: Interaction designer (product manager), art director, front-end developer, back-end developer(s)

I read your post. UX designers that "scoff at the visual design because that's not part of their job" drive me crazy, too. In my opinion, outside of a one person design department, an interaction designer need not be able to create Dribbble worthy visual design, but they should absolutely have a strong understanding of layout, hierarchy, grids, color theory, etc.

<comment><USER7> "UX designers that "scoff at the visual design because that's not part of their job"

These people are far outnumbered by the graphics designers who simply upgraded their resume to add UX and yet cannot name any of the main roles of that position.

</comment></comment></comment><comment><USER8> The post is a bit misleading about PS monkeys. There are actually jobs out their that specialize in image production (e.g. Doing lots of red lining); or even producing grid layouts. Production really isn't design, but often junior visual designers are tasked with doing it (or even senior ones...because someone has to do it). Large organizations will hire people specifically for these roles who aren't really designers.

Interaction and visual design roles are separated not because the division is natural, but because visual and interaction design require specific skills that are rare to find both in individuals, especially on the visual side (interaction designers have diverse backgrounds, while visual designers require specific training).

</comment><comment><USER9> _design was not about how something looks, but how it works._

One of the worst things for me as a developer is having deal with "designers" who don't know this. They think they produce a flashy looking mockup and then they're done. I've dealt with design or marketing companies who literally produce a few PSDs and say, "This should do something cool when you click on it." Which then makes me the designer. Which, I mean, I'm flattered, but that's probably not the situation the client intended to be in.

<comment><USER10> Not only is it not about how something looks, but design under this premise sets you back.

You are forced to make a conscious effort not to focus on looks to finally focus on how it works. You are better off without looks.

I've heard of a usability study that found people are afraid to interact with pretty websites. They prefer ones that look simpler. I wish I could find a reference and read it myself.

</comment></comment><comment><USER11> This post says some obvious (but good and valid) stuff but doesn't propose a solution. Images almost by definition showcase visual design not other types of design. Images are a incredibly convenient medium to produce and transmit. Nice visual design can be digested and appreciated nearly instantly. Hence image-oriented design showcases are at the center of the zeitguest of app design.

Come up with a low-friction, high-speed way to share other facets of design, like interaction and information hierarchies, and then the macro-discussion will reach further into those areas. Currently the best medium for this is launching a prototype in an app store or web and publishing it around. You can see how this compares to "uploading a png" to understand the downstream effects.

</comment><comment><USER12> Oh my god. I cannot upvote this article enough. So many times in my office, my job as a Designer (with a capital D) is dismissively referred to as "making things pretty".

"Hey man, can you add a little design flair to this?"

Fuck that shit. Our job is more than "make things pretty". Designers should have input on every step in the product cycle, not slap a coat of paint on a project that wasn't designed properly from the beginning.

I've been asked numerous times to fix this or that interface, and implement said design changes (since I'm also a developer). This requires me to set up a dev environment for said project, get fully caught up on the project, constraints, etc, then navigate my way through the code and actually make said changes (without breaking anything on the backend, because as a developer it'll be my job to fix that too).

Going back and making a "band-aid" style fix can take almost an entire day, when it could have been a 5-minute discussion during the planning phase.

Oh, and to top it all off: our graphic artist sits in on those meetings.

Apparently this is the norm.

</comment><comment><USER13> So where was the advice about hiring designers? As far as I can tell the post should be titled "Why not to hire designers based on dribbble". While it may be true, it really doesn't help those of us not in the field who are looking to bring in talent.

</comment><comment><USER14> This article diversified what I thought a good designer was. I always thought that a designer should be able to find the right font, design, colour and icons for a project.

Looking further into it there are a lot more to consider and more important points such as UX and interaction. I agree that UX and interaction is important but didn't realise it is that highly rated.

</comment><comment><USER15> "This is about design education, and above all else, the idea that design is fundamentally about how something works, not how it looks." This cannot be said enough. Much like when you have to relearn how to see the world while learning to draw, you have to relearn how to think about problems while learning to design.

Do not confuse graphic arts or even graphic design with product design.

</comment><comment><USER16> To put it simple and generalize a little bit, every function in a team ideally has good understanding of what is supposed to be delivered as a whole and is equipped with that specialized skills set for that function. I have to say it's not easy to have a team even close to this. But this is a correct direction. And each function has different weights in different product building processes.</comment>


How Distributed Systems Respond to Degraded Hardware - <AUTHOR> http://danluu.com/limplock/ <comment><USER2> How do we set up tests to simulate this? He mentions Emulab testbed but essentially says it is unavailable.

Disclosure: I work for [http://gunDB.io/](http://gunDB.io/) and we want to start doing tests like this. Willing to pay people who know how to set these things up. Please contact.

<comment><USER3> Intercepting system calls seems like the easiest way (I expect most of these failures are in I/O). Use LD_PRELOAD to easily hook the libc wrappers, for (almost) anything C-based.

Deeper simulation is possible, but this should get you the low-hanging fruit.

<comment><USER4> Use ptrace to wrap the system calls for things that aren't C-based (though this is a little more involved than LD_PRELOAD).</comment></comment></comment>


So you "just need a hacker", huh? - <AUTHOR> http://subwindow.com/articles/11 <comment><USER2> This would be better if the half that consists of mere insults was replaced with some ideas. There's a lot more you could say about this phenomenon, like why it happens, and what the solution might be.

Once again the top story is an embarrassment to News.YC. And unfortunately it is mostly the recently arrived users who voted it up. Maybe it's inevitable that I'll have to turn on some form of vote weighting.

<comment><USER3> The link itself maybe an embarrassment, but the discussions surrounding it on YC are somewhat less emotional and pretty interesting; and they do touch upon the reasons why it happens (particularly the thread started by mixmax)

<comment><USER2> I noticed that too. It's like stone soup. Still, chicken soup would be better.

<comment><USER4> You could take out the stones after the soup gets going--edit the post to be a self-reference link, rather than an outbound one. That would make it clear that the post is not valued, but the discussion is.

</comment></comment></comment></comment><comment><USER5> It's hard to find a brilliant hacker. But it's equally hard to find a brilliant marketing guy, a brilliant sales guy or a brilliant CEO.

While I don't disagree with the point of the post I think that many hackers should step back and look at how many great marketing people, CEO's etc. they know. The actual programming part is only a small part of starting a company, but many hackers seem to think it is all they need because hacking something together happens to be the first step to creating a great company.

The key insight is that no great company was made by only one guy. It takes both great hackers, great marketing people, great CEO's and great sales people. Hell, maybe you even need a great janitor...

So start showing some respect for each other instead of haggling over who needs who.

<comment><USER6> Sure I need a brilliant CEO, brilliant marketing guy, etc, etc. But first I need a great product. I'm going to make that, not the other guys.

<comment><USER7> You wouldn't start coding something before you'd fleshed out a design, right? So why would you start designing something before you identified the market for it?

Marketing is the social component of design, and you need brilliant marketing before you can create that brilliant product.

<comment><USER8> Not start coding before you fleshed out the design? Not design until you've identified a market? Sounds like a recipe for never getting anything done. That might be the proper way to tackle things when you have a big upfront costs, but generally for software you can just start coding on things you find useful and interesting. If others are interested, great, you've got a company. If not you just have a useful product and then you can move onto something else.

<comment><USER7> How can you create a useful product if you haven't identified the use?

<comment><USER3> luck in combination with the Max Strategy (continually trying different things all the time):

a lot of products did not identify their use before hand, or their real use was discovered accidentally after they were made.

post it notes - started as a failed adhesive. a coworker found that it worked well using it with paper and a gospel hymn book

snood - (a very popular puzzle bobble variant) the programmer made it because he was bored in grad school

linux - started as a hobby by a bored phd candidate

silly putty - a failed rubber substitute designed for WWII use

the list goes on...

<comment><USER9> Perhaps better stated that a lot of products did not identify their eventual use beforehand. For your list the seed product had some utility:

* adhesive gives rise to postit * rubber alternative gives rise to silly putty * pedagogic device gives rise to game, kernel

<comment><USER3> "the seed product had some utility"

for some of the seed products their makers intended for them to have utility, but they didn't - that's why they were initial failures...

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER10> I liked this rant, immature as it might be.

Just about every month, some business student will come to me and say they've got some "amazing idea" and just need someone to do the work of implementing it.

Before I even _hear_ their idea, I do a simple mental calculation.

First, I have to see their skills at least exceed mine in the same areas. For instance, I'm a competent but mediocre designer and marketer in addition to being a programmer. They better at _least_ match that and have actually worked on (and finished!) some project that they started themselves.

The person needs to be as competent in their supposed field as I am in mine. The value that people who are good at selling and networking bring is incalculable, I'd kill for a co-founder that could bring that. But they have to be as crazy and devoted to it as I am towards my coding, or else it just can't work.

Maybe that's why I suck at finding people to work with. :(

<comment><USER11> Send them to an outsourcing site. Tell them you'll offer a competitive rate. Most of these guys won't think of spending a dollar.

<comment><USER12> I wouldn't work for rates "competitive" with those at eLance or Rent-A-Coder. I've done projects through those sites, and despite explicitly stating, "Don't bother with lowball offers--we're looking for good work, not low prices. We are developers, and we will be judging your experience and code harshly." I still got bids of 150 bucks for a project that I would have billed a weeks worth of hours for. They, of course, would do a horrible job, and not even worth that much...but you shouldn't try to compete on price with those folks.

<comment><USER11> In theory, but we're talking about guys who think that you love programming so much that you'll just work for some of their worthless equity.

<comment><USER12> True. Asking any amount is probably enough to weed out the folks who think hackers are inter-changeable and completely devoid of business ideas or acumen. Of course, you can also just say, "No thanks, I'm working on my own idea for the time being. Best of luck to you, though." That's what I do.

<comment><USER11> My strategy has always entertained me because the guys I've known were so thrilled about their rediculous "world changing" idea that they were crushed to find that hardly any outsourcers were even interested:)

Yours will work well enough, but I also like to test to see if anyone is actually determined enough to go through all this trouble and carry out their plan anyway. Serious entrepreneurs are very few in this part of the country...

</comment></comment></comment></comment></comment></comment><comment><USER13> What a lot of people miss that the hacker is actually the starting capital of the company.

If you have an idea, and can't programm you can:

1\. Pay lots of money to hire programmers, or outsource your work, which needs money, i.e. capital.

2\. Find good programmers to work for your company, that are willing to do it with little pay, or only equity.

If you have money, you can buy the programmers, but if you have no capital to start off, no matter how brilliant your idea is, it will go nowhere, and remain nothing more than a day dream.

See people value what they know, and for businness types they would like to think that "ideas" are worth more, and that programmers are just little disposable things that they can just hire anywhere.

As we have seen, the most successful companies are being started by hackers, and not businness types.

</comment><comment><USER14> This sounds just like a zed shaw rant, in fact I think he says the exact same thing in some article. For the most part this is usually true (although abrupt), it is often hard to break it to people that their 'awesome idea' really isn't worth anything.

<comment><AUTHOR> Pretty much any solid rant sounds like a Zed Shaw rant.

</comment></comment><comment> ten-seven Lots of people are Jacks of All Trades, but masters of none. Take, for example, the Ocean's Eleven/Twelve/Thirteen movie franchise. Everybody had skills and roles to play. It wasn't possible for one person to be in all places all the time, nor was it possible for a single person to perform each job.

This blogger...lots of attitude, but doesn't sound like a team player. Attitude will take you only so far.

<comment><USER15> Yeah. It also wasn't possible to knock out all of the power in Las Vegas with an EMP bomb, to lift a mansion covertly with a 12-man team in one night, or to "hack" into a casino's "security system" by clipping little tiny things to a few network cables.

That's because those were _movies_.

</comment></comment><comment><USER16> Is Hacker News the new slashdot or what? How come this entry made it to the top of the page? And a note for Erik Peterson: some future day when you discover that you need some help for something you don't quite understand fully, you might regret having written that blog entry.

</comment><comment><USER17> Someone (aswanson?) posted a question I thought was really good, and was replying to with the following. But when I hit "Add Comment", it seemed the post was deleted in the meantime. I'm going to put my reply up anyway 'cause I spent 5 minutes writing it :)

The question was: how did the situation get this way, with creative and knowledgeable people being told what to do by often clueless managers and MBAs, who have no particular expertise? It seems irrational and it's not obvious why the world would work this way.

Jerry Weinberg, who was one of the first few computer programmers in the world and later became famous as a writer, was asked this once. He said that the first few generations of programmers (up to 1970 or so) were arrogant towards customers, businesspeople, and managers. Programmers were so scarce, and computing itself so unfamiliar and scary, that programmers expected and were given a kind of godlike deference, which they abused. After a while, customers got angry about the fact that they didn't have a say, were treated like idiots, and given stuff that didn't work very well. Eventually, Weinberg said, this led to a backlash whereby managerial control was imposed on programmers. The effects of this backlash persist today.

I don't claim that this is the only answer to the question, but it sounds like a piece of the puzzle, at least in the software business. The thing about the backlash is that it also failed, leading to the irrational situation the original questioner described.

Perhaps the current generation of entrepreneur hackers can be seen in this context, as programmers who have creative control, but also really care about building what customers want.

</comment><comment><USER18> As a non-coder who is cursed with a brain that comes up with a constant flow of creative ideas that my fingers can't execute, you've just shattered my world. Screw you. Oh, and do you mind if I borrow some of your old reference manuals, I just decided to learn how to program. ;-)

</comment><comment><USER19> The problem is this: If Wozniak had the mentality of a 14-year-old with a thing for Marilyn Manson records and huffing glue, he would have said the same thing to Steve Jobs.

Who is upmodding such rubbish? Seriously--

<comment><AUTHOR> There are two main differences:

1) Apple was a hardware startup. Hardware startups need funding and someone to aggressively sell the product in person to big vendors. Software startups don't usually need that kind of person (unless they're going after the Enterprise cookie).

2) It was in the 70's, and startups were, in general, harder to start than they are now.

<comment><AUTHOR> I went a bit more in-depth here:

<http://subwindow.com/articles/12>

It turns out that Apple is a totally perfect example.

</comment></comment></comment><comment><USER13> Ah, and a lot of people mention Jobs as a non-hacker, which is simply not true. He was a hacker, but with great businness sense.

"Jobs attended Cupertino Middle School and Homestead High School in Cupertino, California,[9] and frequented after-school lectures at the Hewlett-Packard Company in Palo Alto, California. He was soon hired there and worked with Steve Wozniak as a summer employee.[12] In 1970, Jobs graduated from high school and enrolled in Reed College in Portland, Oregon. Although he dropped out after only one semester,[13] he continued auditing classes at Reed, such as one in calligraphy. "If I had never dropped in on that single course in college, the Mac would have never had multiple typefaces or proportionally spaced fonts," he said.[14]

In the autumn of 1974, Jobs returned to California and began attending meetings of the Homebrew Computer Club with Steve Wozniak.[15] He took a job as a technician at Atari, a manufacturer of popular video games, with the primary intent of saving money for a spiritual retreat to India. During the 1960s, it had been discovered by phone phreakers (and popularized by John Draper) that a half taped-over toy-whistle included in every box of Cap'n Crunch breakfast cereal was able to reproduce the 2600 hertz supervision tone used by the AT&T long distance telephone system. After reading about it and later meeting with John Draper, Jobs and Wozniak went into business briefly in 1974 to build "blue boxes" that allowed illicit free long distance calls."

</comment><comment><USER20> I can't help but wonder whether this was inspired by the Facebook dev forums.

</comment><comment><USER21> Commenters here talk as if no successful business was ever started by a sharp businessperson who hired software developers.

Clearly, many such businesses exist.

<comment> daniel-cussen I know of businesses who look like they were started by businesspeople who hired hackers because the hackers were later ousted (like digg). The businessperson displaced the hacker after the fact. Can you think of any businesses were there where this clearly didn't happen? Can you think you any successful software company started by a businessperson who paid consulting fees to thoughtworks or IBM, set up a booth at a CS department to recruit techies, or paid a headhunter?

<comment><USER21> Amazon.

<comment><USER21> Also, Intuit.

<comment><USER21> And, Wikipedia. And YouTube. Can Dick Costello code? I can't remember (he's a really nice guy, though). No? Feedburner.

<comment><USER22> Jeff Bezos was a hacker. He didn't _call_ himself one because he also had significant business & financial skills, but he worked as a quant for D.E. Shaw. D.E. Shaw is the Google of hedge funds; anyone there is more than a match for the Ph.Ds at Google. Bezos's degree was in EECS, and his childhood projects would easily have gotten him into YCombinator.

Intuit was cofounded by Tom Proulx, who wrote the first version of Quicken himself. Scott Cook gets most of the credit because of his determination, but without either of them, the company wouldn't exist. It certainly was not an outsourced startup.

Wikipedia I'll grant you. Though the concept of wikis was invented by Ward Cunningham, who certainly was a hacker.

YouTube was started by 3 ex-PayPal employees. Steve Chen and Jawed Karim were certainly hackers, Chad Hurley was more design. They built the initial version themselves.

<comment><USER21> Hurley was CEO, and received more shares than the other two founders. YouTube was founded with Hurley's money.

We can argue about the other two; I feel like I'll lose Intuit but win Amazon, but who knows. Not worth it. I think my point stands.

</comment></comment></comment></comment></comment></comment></comment><comment><USER23> this presents a rather binary view of things - either you're a hacker or you're an arrogant MBA.

there are plenty of people who aren't hackers but they certainly understand tech and aren't beef-headed MBA's. mitch kapor and joe kraus never wrote a line of code.

</comment><comment><USER24> I think the author has a point, but I think hackers are guilty of similar behavior regarding legal and finance expertise, both of which are critically important in keeping and profiting (respectively) from your hacking. I think it's really just pretty self-evident that people will overvalue their own field of knowledge, and consider other fields to be less important/valuable than they actually are.

</comment><comment><USER25> This sounds as hysterical as if someone told me, "If you don't know Mandarin, don't do any business with/in China!"

Delegation of responsibility is a concept of pivotal importance for any entrepreneur to grasp if they want to go very big. Isn't Richard Branson dyslexic?

</comment><comment><USER26> Sounds as young as he looks.

My advice: Never pass up a good opportunity.

</comment><comment><USER27> I sure hope he doesn't need as many lines of code to build something as he needs cuss words to make a point.

</comment><comment><USER28> Stuff like that makes me wonder if I should start a "Never ever work with that person, no matter what"-list.

</comment><comment><USER29> stubborn

<comment><USER29> the immediate downmods of my original comment of "stubborn" seems to be further testament to the overall quality in capacity for this site lately.

the authors comments are emotionally loaded opinions that are quite frankly, a result of immaturity and frustration.

so my original comment stands:

stubborn.

<comment><USER30> It was not a great comment, but I'd also like to say that we've had, if not quite a tradition... many of us have encouraged people not to downvote beyond -1 or 0 for comments that are not "really bad" (racist, outright insults, spam, that kind of thing).

</comment></comment></comment><comment><USER31> Brilliant!

</comment><comment><USER28> Ruby book: 30$ - Rails book: 30$ - Never have to work with arrogant hackers again: priceless!</comment>


Meet Boxed - Costco style delivery without the membership - <AUTHOR> http://pandodaily.com/2013/11/14/costco-style-commerce-app-boxed-expands-nationally/

<comment><USER2> Feels similar to amazon subscription goods, but just accessible from the phone. Kinda nice idea. Wonder if it will pick up traction.

<comment><AUTHOR> Yea, I thought it was kind of cool - seems like a simple target for Amazon acquisition but I'm so dependent on Amazon in every day life that I don't even know that I'd notice/if it would be worth it for them, but I think its a nice idea</comment></comment>


Writing Like a Doctor - <AUTHOR> http://chronicle.com/jobs/news/2009/06/2009060901c.htm <comment><USER2> Schools have long since abandoned any pretense of attempting to teach good writing technique.

In reality, the idea of writing as art was a direct by-product of a traditional liberal arts education, which taught subjects such as rhetoric and classic language study. When those subjects fell away, so too did the once- strong emphasis on composition and writing technique.

Academic writing, as noted by the author of this piece, is among the worst offenders. So too is legal writing (my field), to the point where I felt compelled to do a little ditty of my own on what constitutes good legal writing (<http://www.grellas.com/articles.html>).

There is much more to life than being a good technician but, in writing, strong technical skill does matter and its neglect in today's academic environment is something to be deplored.</comment>