The Supreme Court is struggling to rein in America's rogue patent court - <AUTHOR> http://www.vox.com/2014/6/4/5776642/the-supreme-court-is-struggling-to-rein-in-americas-rogue-patent-court <comment><USER2> Many folks in the tech community lament, on one hand, that the U.S. legal system lacks people, particularly judges, with technical backgrounds, yet at the same time are intensely unhappy with the decisions of the Federal Circuit, which has a substantial number of judges with degrees in science and engineering. The only way I can reconcile these sentiments in my head is that when people say "judges don't understand technology" what they mean is "judges don't see technology the way I see technology."

<comment><USER3> I like the conclusion of the article, which is that concentrating all patent cases into a single court has given that one court too much power. That particular court seems heavily pro-business right now. The legal system works better when appeals court judges across the country make decisions, and the supreme court manages the splits.

Not sure if it's true, but it sounds like it would avoid the concentration of decisions in one bad court. We see that in "West Texas" patent lawsuits as well. One rogue court can affect the nation.

<comment><AUTHOR> > _I like the conclusion of the article, which is that concentrating all > patent cases into a single court has given that one court too much power. > That particular court seems heavily pro-business right now. The legal system > works better when appeals court judges across the country make decisions, > and the supreme court manages the splits._

The author of the original article probably doesn't remember the days before the Federal Circuit was created. Except for the then-rare cases when the Supreme Court intervened, judicial interpretations _and applications_ of patent law could vary widely among the different courts. The validity of a patent often depended heavily on where the lawsuit was filed. Some courts were known as graveyards for otherwise-good patents. The federal district court in Minnesota was one such place, along with its appellate court the Eighth Circuit.

That often led to patent owners and accused infringers racing to get their lawsuits filed first: A patent owner would try to sue the accused infringer first in a patent-friendly court, while the accused infringer would try to sue the patent owner first in, say Minnesota, asking for a "declaratory judgment" of invalidity and non-infringement. Under the procedural rules, usually whoever won the race to the courthouse got to keep their lawsuit alive, while the second-place filer would have their lawsuit dismissed.

That in turn led to great uncertainty in the scope, validity, and value of a patent. Clients hate uncertainty. That's what led to the creation of the Federal Circuit: To try to bring more uniformity to the judicial interpretations and applications of patent law.

<comment><USER4> Well, that's one interpretation of the history of patent law. Another might note that patentees became enormously more powerful when the CAFC was created, winning a much higher proportion of cases. The metastatic growth of the patent system was a goal of the patent bar.

"To try to bring more uniformity to the judicial interpretations and applications of patent law"

That isn't an improvement when the decisions are consistently bad.

<comment><AUTHOR> > _The metastatic growth of the patent system was a goal of the patent bar._

Back then, I was a baby lawyer in one of the largest patent-law firms in the U.S. I don't remember metastatic growth being discussed as an explicit goal, but there's no question that patent attorneys, on both the plaintiff- and defense sides, welcomed the greater prestige and income that went with litigating bet-the-product-line infringement lawsuits.

</comment></comment></comment></comment></comment><comment><USER5> The Supreme Court's job is less about correcting bad laws than striking down unconstitutional laws. Many terrible laws can be totally constitutional. The best way to fix a bad law is to replace it with a better law.

<comment><USER6> _The Supreme Court 's job is less about correcting bad laws than striking down unconstitutional laws._

The judicial power in the United States extends to _far_ more than "is this constitutional or not". It includes how to interpret and apply laws other than the Constitution, and the Supreme Court is the final stop for that process.

Much of the debate about the Federal Circuit is that its interpretation and application of patent law departs radically from the Supreme Court's interpretation and application.

<comment><USER5> Oh I agree. But the best solution would be just to write better laws in the first place -- laws that can't be interpreted to produce the mess of a patent system that we have right now.

</comment></comment></comment><comment><USER7> The USA seems to have the most incredibly lousy "justice" system. Laws are made by lobbyists and enforcement of those laws, sometimes involving judgments of billions of dollars seem to rest on some good ol' boys in some dingy Texas courtroom.

Surely it can't be as bad as it seems to this outsider - can anyone point to a good guide on how this all works?

<comment><USER2> The U.S. has a tradition of litigation, which forces all these issues into the public. Do you think there's less influence-peddling in say France or Italy? In places where the decision-makers can't get sued over every little action, you don't even need to have a lobbyist make a law.

Take something like bribing officials in developing countries to get contracts. European companies are far more likely to engage in such behavior than American ones. What do you think that says about their behavior at home?

<comment><USER4> "Take something like bribing officials in developing countries to get contracts. European companies are far more likely to engage in such behavior than American ones."

It's legal for European companies to bribe foreign governments to get contracts. The Europeans don't consider their laws to apply outside their borders, so their companies can comply with local law.

The USA has the Foreign Corrupt Practices Act that punishes US citizens or companies with criminal penalties on return to the USA for ordinary business practices in foreign lands. An ambition to clean up foreign corruption keeps US companies out of some countries.

<comment><USER2> The fact that it's legal doesn't mean it's not morally objectionable. You can argue that not the choice not to make it illegal is a jurisdictional one, but that doesn't change the fact that European companies engage in the practice when they could choose not to. I think that says a lot about European attitudes towards corruption versus American ones.

</comment></comment></comment></comment><comment><USER4> OP Cites Judge Prost's dissent in Alice, "The majority has failed to follow the Supreme Court's instructions—not just in its holding, but more importantly in its approach."

But that was about the awful judgement of the three-judge panel. The ruling was reexamined by the whole CAFC and a 5-5 hung court could not decide weather to keep the ruling intact. Until the Supreme Court rules, that 5-5 non- decision is the final word. Any rational decision by the Supreme Court -- concluding that Alice's patent is invalid -- will not be considered a reversal.

Also, it is considered unlikely the decision will reach the question of software patent eligibility. It will probably turn on abstract idea or business method eligibility. The patent monopolizes any use of computers in handling escrow accounts.

</comment><comment><USER8> while this isn't 100% inaccurate, one major headache are vague rulings from SCOTUS. the "reasonable certainty" test is a good example as well as their "abstract means abstract" pseudo-standards. while SCOTUS paints with a broad brush (rightfully so), many of their decisions are borderline meaningless other than to say to the CAFC "no you're wrong," which results in multiple rounds of these type of decisions (often on the same issues, or variations of them). that being said, the closeness of the CAFC to the bar is quite troubling and the e-mails that Rader sent to attorneys who argued in front of him were pretty embarrassing for all involved.

</comment><comment><USER9> Hah, I knew who the author was going to be before I even clicked the article. (Hi, binarybits!) Allow me to rebut some points:

1\. If anything is to be blamed for the "explosion of patent litigation in recent years" (for certain values of "recent"), it's the following:

a) the recent AIA "joinder" rules regarding how many defendants you can sue together, forcing trolls to file multiple suits where they would have filed one giant suit; and

b) Genentech v Medimmune [1], which made it possible for potential licensees to file a pre-emptive "Declaratory Judgement" lawsuit if someone even approached them to discuss a license, which forced licensors to take sue- first-ask-questions-later attitude to avoid ending up in a defensive position.

2\. As this patentlyo post [2] points out, the CAFC is not a single-minded group of judges. Most of the decisions that were reverted by the Supreme Court had CAFC judges with dissenting opinions. (As many as 5, as in the Limelight case.) And if you need data as opposed to examples, well, there's a study [3] finding that this court had the "second highest percentage of dissents amongst the circuits studied".

Further, since Bilski, the SC has agreed with the CAFC 7 out of 13 times [2], which is not too bad. But there's more: the TFA uses this link [4] to show that the Supreme Court reversed the CAFC 10 times. Somehow TFA does not mention that there were a total of _40 cases_ since the CAFC was formed, which indicates that the Supreme Court affirmed the Federal Circuit decision 75% of the time!

3\. The Supreme Court is not infallible, especially when it comes to patents, because I'm guessing it is a relatively esoteric part of law. This patentlyo post [5] points out one potential error in the Limelight case. The Prometheus decision was another example where they actually conflated _patent eligibility_ with _patentability_ [6, 7, 8]. This is such a basic mistake that even a non-lawyers like us can understand it.

4\. Recent empirical evidence indicates that the Federal Circuit is no more "patent friendly" than district courts [9]. In fact, if you look at the chart 2, the rate of _invalidating_ patents has been increasing steadily since 2000. (To be fair, they theorize it's because of Supreme Court pressure.) But if you look at chart 4, the CAFC has consistently been affirming the district courts findings of invalidity the vast majority of the time. So no only does the Supreme Court agree with the CAFC more often than not, so do the district courts.

1\. [http://en.wikipedia.org/wiki/MedImmune,_Inc._v._Genentech,_I...](http://en.wikipedia.org/wiki/MedImmune,_Inc._v._Genentech,_Inc).

2\. [http://patentlyo.com/patent/2014/06/federal-circuit- really.h...](http://patentlyo.com/patent/2014/06/federal-circuit-really.html)

3\. [http://papers.ssrn.com/sol3/papers.cfm?abstract_id=1598419](http://papers.ssrn.com/sol3/papers.cfm?abstract_id=1598419)

4\. [http://writtendescription.blogspot.com/p/patents- scotus.html](http://writtendescription.blogspot.com/p/patents-scotus.html)

5\. [http://patentlyo.com/patent/2014/06/judicial-hypothetical- li...](http://patentlyo.com/patent/2014/06/judicial-hypothetical- limelight.html)

6\. [http://inventivestep.net/2012/03/20/supreme-court- continues-...](http://inventivestep.net/2012/03/20/supreme-court-continues-to- confuse-patentable-subject-matter-with-patentability/)

7\. [http://www.boulwarevaloir.com/article-Mayo-Promethus- pub.pdf](http://www.boulwarevaloir.com/article-Mayo-Promethus-pub.pdf)

8\. [http://www.ipwatchdog.com/2014/03/31/missed-opportunities- fo...](http://www.ipwatchdog.com/2014/03/31/missed-opportunities-for-alice- software-at-the-supreme-court/id=48845/)

9\. [http://www.morganlewis.com/pubs/Smyth_USPatentInvalidity_Sep...](http://www.morganlewis.com/pubs/Smyth_USPatentInvalidity_Sept12.pdf)

</comment><comment><USER10> The current Supreme Court is pretty rogue itself.</comment>


Ask HN: Is Amazon (US) taking online market share from other online retailers? - <AUTHOR> <comment><USER2> Yes, Amazon is taking share from online retailers AS WELL AS brick and mortar stores and malls. Hundreds of malls have closed, many others have lost major retail anchors and main street is getting hollowed out as stores here and there are picked off.

<comment><AUTHOR> Thanks. Do you know of any examples/articles of this, specifically taking from online? I'm in Australia and Amazon is launching this week. I'm interested in how it will affect other online retailers.</comment></comment>


Ask HN: Are my expectations for a workplace unrealistic? - <AUTHOR>

I'm from a westernized country in Europe and I'm having a hard time finding the right developer job for me, making me feel that the problem isn't the sameyness of the workplaces, but my unrealistic expectations towards them. Being an avid reader of HN, I see stories about places like GitHub and Automattic that talk about how great it is with remote workers and how to put an emphasis on work done rather than set hours per day. So when I go to job interviews (at startups and large firms alike) where they talk about "core hours", the importance of "having fun during those 8 hours a day" and being "a part of the team in-house" it all feels like they're stuck in an industrial age mindset.
I've worked at a handful of different companies and they fluctuate on how strict they are with work hours (one place had me on a rigid 9-to-5 schedule while another had me fill in a timesheet to prove I've spent 8 hours a day working), but they all adhere to the standard butt-in-seat-8-hours-a-day and are taken aback when I mention my interest in more autonomy. At one point when I was gauging a prospective employer's views on remote work in an interview the air got surprisingly tense as he aggressively scoffed at the idea of someone taking the job only to move to a 3rd world country to rake in the money.
I've spoken to other developers about this and we all somewhat lament the lack of freedom, but everyone just accepts it as the price to pay to be a programmer. It's a little sad that when I ask my friends how their job is the answers range from "meh" to "alright" and I find the situation somewhat stifling to our creativity and efficiency as "knowledge workers". I don't understand how at an age of ocean-crossing communication and untold abundance we are still working like factory mules.
Are my expectations unrealistic or is there an ideal I can aim for? <comment><USER2> In my personal experience (UK and EU mostly):

* 100% remote working is rare

* Flexitime around core hours is relatively common

* Remote working from the start is very rare. Most employers want you on site to absorb the company culture and gel with the team before they would consider remote working. You need to show that you're effective and productive first.

* Companies measuring outcomes rather than effort - non-existent outside of the smaller startups.

If you want remote work and outcome based companies then currently you need to be looking to the smaller more startup-ish organisations. Which has associated impact on risk and salary. Or you need to get into a suitable position within the organisation to help make the change to more remote/outcome based work yourself.

A few things to consider from the employer's side:

* If you and the employer are in different countries it can add a considerable administration burden on the employer. In many cases they won't have the skills in-house so you are asking them to acquire a specialised set of HR skills and knowledge for one hire. This is a tough sell unless you have the answers to that problem to hand.

* Something you notice as an employer is that people often mistake their personal productivity with the team productivity. There is quite a lot of evidence that distributed teams are less productive than co-located ones (see [https://news.ycombinator.com/item?id=5145358](https://news.ycombinator.com/item?id=5145358) \- any _research_ based counter examples very welcome!). You need to have a good argument that remote working will pay off for them.

* Running distributed teams well takes effort and skill. You need to adopt new tools, new structures, take more effort on things that "naturally" happen when folk are co-located. Unless a company already has this in place it's a lot of effort to make for a single new hire.

<comment><AUTHOR> Thank you for your thorough answer. You've given me a lot to think about.

Looking for remote-only positions is hard as most companies don't want to hire outside their own country, meaning that 95% of companies that post on remote job boards are out of the question. Of course I understand that the clerical necessities would be too much for a small startup to want to deal with.

Your point about introducing my desire for remote work after I've proven how awesome I am is probably the best way to go about this, seeing how I'm shooting myself in the foot by talking about it in the first interview. My experience with it at former workplaces hasn't been completely positive (the suggestion always seems to cause an apprehensive reaction), but I realize that I need to make it worth it for them and prove that I'm worth it.

As embarrassing as it is to ask such an entitled question, I'm quite happy for the feedback.

</comment></comment><comment><USER3> If your main interest in in remote work you'd be much better off by applying to companies with a remote working culture rather than trying to convince a traditional company to change it's work structure.

Open source companies in particular tend to be very open about remote working.

</comment><comment><USER4> Yes, it is opening up but you are being a little unrealistic. They do have their reasons. The average "knowledge worker" today, is not self-correcting and self-motivated enough to stay on the line of productivity.

That being said, it looks like you've made a mindset that autonomy of time is a sure-shot metric of the quality of a company. It is true, to a great degree, but the implication isn't reversible. Some of the best work in the world is being done by people with more or less fixed timings.

Don't let the timings and work-from-home option mark your final judgment over a good firm. There is so much more to it.

<comment><AUTHOR> This is my first post to HN and I was dreading a backlash, so I appreciate your tone and candor.

I definitely think my pursuit of the ideal has made me blind to other benefits offered by the companies I've interviewed at. I guess I'm just a little tired of every company having the same attitudes towards remote work no matter how "hip" they want to seem that I've zeroed in on that as the only metric to judge them by.

Food for thought, so thank you.

<comment><USER5> One thing to keep in mind is that you won't genuinely be able to judge a workplace until you've been in it for a while. Some of the best jobs I've had were ones where I thought I was just taking them because I needed any job; conversely, the very worst I ever had was one where I was absolutely certain going in that it would be perfect.

<comment><USER4> +1

There are so many factors that come in that unless you're there on your own, you cannot decide. Even advice from people does not really work because people have so many filters and biases themselves.

i work at a fairly challenging workplace and love it here. i _do_ have colleagues who hate the job for precisely this reason.

</comment></comment></comment></comment><comment><USER6> > where they talk about "core hours", the importance of "having fun during > those 8 hours a day" and being "a part of the team in-house" it all feels > like they're stuck in an industrial age mindset.

There's a reason for it. People communicate best in person. No amount of technology can totally replicate face to face communication.

And many would argue that communication is essential for high performance teams. I certainly do.</comment>


I compiled a list of active startup investors during Covid-19 - <AUTHOR> https://www.angelstep.co/active-investors <comment><USER2> Dashboard of the COVID-19 Virus Outbreak in India - [http://covid-19.ideas2it.com/](http://covid-19.ideas2it.com/)</comment>


Fuck Dropdowns - <AUTHOR> http://www.fuckdropdowns.com/ <comment><USER2> Also: they registered a domain to wrap a YouTube video?

</comment><comment><USER3> You have to enter an email address to download the slides?

(╯°□°)╯︵ ┻━┻</comment>


Apple Publishes the Top Reasons They Reject Apps - <AUTHOR> http://techcrunch.com/2014/09/01/apple-publishes-the-top-10-reasons-they-reject-apps/

<comment><AUTHOR> One out of every five apps gets rejected for either "more information needed" or "did not comply with terms in the Developer Program License Agreement" which is almost as bad as not providing a reason at all.

Still, I applaud Apple for taking a (small) step forward in terms of transparency.</comment>


Legendary Akihabara Radio Store closing its doors after six decades - <AUTHOR> http://www.japantimes.co.jp/news/2013/11/25/national/legendary-akihabara-radio-store-closing-its-doors-after-six-decades

<comment><USER2> It seems the world's radio/electronics community was first in New York ( [https://en.wikipedia.org/wiki/Radio_Row](https://en.wikipedia.org/wiki/Radio_Row) ), then Akihabara, and now in Shenzhen, where the details of electronics outlets that appear seem completely mindblowing. For example: [http://www.evilmadscientist.com/2009/a-visit-to-the- electron...](http://www.evilmadscientist.com/2009/a-visit-to-the-electronics- markets-of-shenzhen/)

<comment><USER3> Shenzhen looks impressive. I haven't been there, but it looks similar to the Zhongguancun district in Beijing.

[http://en.wikipedia.org/wiki/Zhongguancun](http://en.wikipedia.org/wiki/Zhongguancun)

<comment><USER4> I find zhongguancun to be very monotonous compared to akihabara; most of the stores just sell the same junk. There are only a couple malls that specialize in lower level components. Still none of the crazy stuff I could easily fond in Tokyo.

</comment></comment></comment><comment><USER5> I used to walk through that place every time I went to Akihabara. It reminded me of something out of Neuromancer with the tiny stalls and bins of weird high-tech (and low-tech) components, with the Japanese merchants and the chatter of all the foreign visitors.

But I have to admit, despite walking through those cramped corridors dozens of times, I never did actually buy anything there. I still go to Akihabara when I need something _right now_ , but 9 times out of 10 I just buy it at the colossal 8-story Yodobashi Camera on the other side of the station (erected several years ago).

So it's not too surprising they can't make that cool little electronic component shantytown mall work anymore.

<comment><USER6> Ditto. I lived in Tokyo for 2 very formative teenage years in the late 90's. Akihabara always felt like a bit of a wonderland, but not one where I actually spent many of my limited funds. I'm sad to hear that mall is closing, as the atmosphere was truly one of a kind.

</comment></comment><comment><USER7> This is a bit of an exaggeration. The prices were pretty high and the people weren't all that knowledgeable. And there's another similar market right across the street that's twice as large.

<comment><USER8> yea, still it'll be sad to see it go. Most of the interesting parts are elsewhere in Akihabara however and I don't think we'll really be missing out on much. I hope a bunch of the markets will find homes elsewhere in Akihabara though.

</comment></comment><comment><USER9> The stores are mainly one-item things (one guy selling only lightbulbs, another selling only security cameras). But there are stores in the area that sell lighbulbs AND security cameras close by. Most of the stores in it have equivalent stores in the area anyways.

The one thing that I'd miss is the "antique" electronics on the second floor. There was a decent amount of interesting stuff seen up there.

</comment><comment><USER10> I'm sorry to see any store there go. I used to spend at least a full day walking around Akihabara every time I went to Tokyo for work and always came home with plenty of stuff I didn't even know I wanted. I still have various "Engineer" brand tools, while not the absolute best they were relatively cheap and well made. I was mainly into building home audio here then and found aluminium cases that were good enough to put next to commercial equipment, a long way from the angular steel stuff I could find online. There were machined knobs, actual ALPS potentiometers, and in the audiophile stores crazy stuff like $1000 binding posts and tantalum resistors with gold-plated leads, nice to look at but I wasn't crazy. What made it great was not the amazing range of stuff or expert advice (language barrier...) but the Japan-ness of it all - maybe tiny, maybe outdated, but everything presented with pride. Of course you can get it all and more online but it isn't the same. Online you don't see lovingly restored TEAC reel-to-reel systems next to Kenwood FM tuners and SGI Indy boxes, all perfectly clean and ready to go. If I was in Tokyo today I'd head right for Akihabara, and maybe buy an extra suitcase to get it all home.

</comment><comment><USER11> I remember going to Yodobashi Akiba and being confused. Then I went into the small shops, I couldn't read the names of the parts. Then I ate ramen and bought a toy train.

<comment><USER12> That's how I would have done it, too.

</comment></comment><comment><USER13> I found a similar thing happening in Yongsan - Seoul's electronics market. I visited recently after a 5-year absence and was saddened to see so many shuttered stores.

</comment><comment><USER14> This is only one of three similar stores closing. The other two, Radio Center ([http://www.radiocenter.jp/](http://www.radiocenter.jp/)) and Tokyo Radio Depart[ment Store] ([http://www.tokyoradiodepart.co.jp/](http://www.tokyoradiodepart.co.jp/)), are still alive and kicking... although rather feebly, and it's a probably a matter of time until they go as well.

</comment><comment><USER12> "The warren of small stores selling paraphernalia such as resistors, capacitors, LEDs and soldering irons became a symbol of Akihabara over the years."

... paraphernalia, allright. How does that journalist imagine he could write this article without any of them? :-D

</comment><comment><USER15> Sad to hear, this was one of my favorite places in Akihabara. They have really good selection in tools and parts, I got some mini-XLR connectors and inductors. The first few guys I asked didn't have them, but they pointed me to the stall that did. They didn't speak English, so I wrote "18 uH" on my phone and they knew what I meant.

It's not like those parts would be hard to find online. But they had all that stuff in stock, in their tiny stalls.

</comment><comment><USER16> I always thought it was what the places in Bladerunner where the people who made the snake scales were was based on. You would go along and be told that the man over there had that particular kind of resistor.

<comment><USER17> More like Taipei, I think ... which also has vast electronic doodad markets. Well worth a poke around, even if you don't have a use-case for a snake or an SCR the size of a beer can :-)

</comment></comment><comment><USER18> I've heard you can go across the street to some bigger stores.

If anybody's in Seoul, the Yongsan electronics market is similar and if you want to supersize it head to Shenzhen.

</comment><comment><USER19> similar location in Taipei: [https://en.wikipedia.org/wiki/Guang_Hua_Digital_Plaza](https://en.wikipedia.org/wiki/Guang_Hua_Digital_Plaza)

<comment><USER20> and even there (here:), most of the good stuff is outside of the plaza in the neighbouring streets, and underground stores. It's really fun, though.</comment></comment>


Vitamin D and Inflammation: Potential Implications for Severity of Covid-19 - <AUTHOR> http://imj.ie/vitamin-d-and-inflammation-potential-implications-for-severity-of-covid-19/ <comment><USER2> Just listened to a podcast on this [1]

a) 95% of severe covid cases in Indonesia had vitamin D deficiency (n=780)

b) Darker skin in high latitudes is strongly correlated with vitamin D deficiency

c) In Sweden, Somali immigrants make up 40% of the covid hospitalizations despite being .8% of the population.

d) Vitamin D is also a hormone that regulates up to 5% of all gene expression while your immune system cells have vitamin D receptors

e) 70% of Americans have insufficient (a step above deficient) Vitamin D levels

[1] [https://www.youtube.com/watch?v=45rlZGRz6Qo&feature=youtu.be](https://www.youtube.com/watch?v=45rlZGRz6Qo&feature=youtu.be),

[Also] [https://www.youtube.com/watch?v=4_ZJ8YDOX6g](https://www.youtube.com/watch?v=4_ZJ8YDOX6g)

<comment><USER3> While that may be true, I'd really like a better source than a channel which otherwise deals with "supplements that lengthen telomeres" or the age-old sauna-detox myth.

<comment><USER4> I was surprised to learn a few years ago that saunas might actually have significant health benefits.

See the references below from _The Journal of the American Medical Association_ (JAMA), _The New England Journal of Medicine_ (NEJM), and Dr. Patrick who has interviewed the original researcher.

[1] [https://media.jamanetwork.com/news-item/sauna-use- associated...](https://media.jamanetwork.com/news-item/sauna-use-associated- with-reduced-risk-of-cardiac-all-cause-mortality/)

[2] [https://www.jwatch.org/fw109897/2015/02/24/sauna-use- linked-...](https://www.jwatch.org/fw109897/2015/02/24/sauna-use-linked- better-health-finland)

[3] [https://www.foundmyfitness.com/episodes/sauna-heart- presenta...](https://www.foundmyfitness.com/episodes/sauna-heart-presentation)

<comment><USER3> I explicitly said "sauna-detox myth", i.e., the myth that you can "detoxify" your body through sweating.

<comment><USER5> I'm surprised to hear that you believe this to be a myth. The only sources claiming this to be a myth seem to be popular news sites referencing each other in a circular fashion. Here's a detailed study on the matter: [https://www.ncbi.nlm.nih.gov/pmc/articles/PMC3312275/](https://www.ncbi.nlm.nih.gov/pmc/articles/PMC3312275/)

</comment></comment></comment></comment></comment><comment><USER6> Can someone explain something to me? What's this Vitamin D craze about that a lot of people in the Hackernews crowd seem to follow?

Multiple times in the past days weak studies indicating some beneficial effect of Vitamin D have been posted here. None of them looked like anything even remotely conclusive. This one just cries "confounder!".

But in the comments below a large number of people seem convinced that this is definitive evidence and that they always knew their Vitamin D pills are some kind of magic.

<comment><USER7> I doubt anyone here thinks it's some kind of magic, but if you've been following the pandemic from the beginning, you've probably seen these two doctors who both recommend vitamin D:

\- Dr. Seheult's: [https://www.youtube.com/watch?v=NM2A2xNLWR4&t=821s](https://www.youtube.com/watch?v=NM2A2xNLWR4&t=821s) \- Dr John Campbell: [https://www.youtube.com/watch?v=GCSXNGc7pfs&t=29s](https://www.youtube.com/watch?v=GCSXNGc7pfs&t=29s)

It's cheap and has minimal downside. Pre-covid it was already known to "reduce symptoms of colds or influenza"[0].

[0] Benefits of Vitamin D Supplementation - Journal of American Physicians and Surgeons [https://www.grc.com/health/pdf/Benefits_of_Vitamin_D_Supplem...](https://www.grc.com/health/pdf/Benefits_of_Vitamin_D_Supplementation.pdf)

<comment><USER8> I feel like we're just repeating the exact same arguments seen for Vitamin C. Which went through the same arguments (cure for colds, cure for cancer, recommended by doctors etc) and ended up generally being inconclusive as to whether or not it actually helped.

At this point I'm convinced vitamin supplements are a scam in 99% of situations. The only time they're useful is when you have an actual deficiency as prescribed by your primary doctor.

<comment><AUTHOR> Vitamin supplements are mostly a scam, but you can increase your Vitamin D level for free.

<comment><USER9> For those that don't know, Vitamin d is created when sunlight hits skin.

"The major natural source of the vitamin is synthesis of cholecalciferol in the lower layers of skin epidermis through a chemical reaction that is dependent on sun exposure (specifically UVB radiation)"

[https://en.m.wikipedia.org/wiki/Vitamin_D](https://en.m.wikipedia.org/wiki/Vitamin_D)

Which unfortunately doesn't work well in the winter depending on how far you are from the equator.

It's fat soluble so levels can be tested.

<comment><USER10> >For those that don't know, Vitamin d is created when sunlight hits skin.

Actually it's when UVB rays hit the skin, and only during certain times of the day, and north of 37 degrees only during part of the year.

In order to get enough UVB rays to make Vitamin D you need sunlight from around noon, during spring summer and fall

[https://www.ncbi.nlm.nih.gov/pmc/articles/PMC3257661/](https://www.ncbi.nlm.nih.gov/pmc/articles/PMC3257661/)

</comment></comment></comment></comment></comment></comment><comment> radford-neal The rational calculation here is very clear.

Taking 1000 IU of Vitamin D a day has pretty much zero risk.

Going outside in the sun around noon, without too much clothing (or sunblock, of course!), for about 15 minutes a day also has pretty much zero risk. (In fact, it likely has benefits other than vitamin D, such as nitric oxide production, which lowers blood pressure.)

There is substantial evidence that these measures would reduce severity of infections such as influenza and covid-19, at very small to zero monetary cost. It's not a certainty, of course, but it is highly unlikely that Vitamin D deficiency is actually protective against covid-19.

Therefore, all public health organizations should be strongly recommending that everyone take 1000 IU of Vitamin D and get some sunlight, and heavily publicizing this recommendation.

The fact that they are not doing this is sadly an indication that the people in charge of these organizations do not actually have a mental orientation of _solving_ _the_ _problem_. (As you probably know, there are many other indications of this as well.)

</comment><comment><USER11> I don't know how you can take this data seriously. It's comparing population Vitamin D levels vs. population COVID mortality for n = 12 countries.

Are studies like this done to justify an actual Vitamin D study? They need to take a sample of confirmed COVID patients and test their Vitamin D levels individually.

<comment><USER12> You don't always need a big n to make causal conclusions. Do you know the story about the king who gets served a soup? Because he's frightened that the soup might be poisoned, he gives it to his food tester first because the king reasons like this: "If my food tester (n=1) doesn't die, then I probably won't die, too, when I eat the soup". Many great philosophers have argued, that people should use their common sense instead of requesting big tests. Therefore no big n's are needed. Start thinking.

<comment><USER13> ??? The Kong's conclusion wasn't causal with any statistical certainty (which is what the above is arguing). It was anecdotal.

Maybe the poison doesn't work for carriers of certain genes. Maybe it's temperature reactive. Maybe it'll take weeks to kill.

Just because the King observes something do not make his causal conclusions from that observation valid. Adequate sample-sized statistics aim to bridge that gap.

<comment><USER14> Well that settles it. Better keep on doing nothing!

<comment><USER15> (n=0)

</comment></comment></comment></comment></comment><comment><USER16> So, a couple of thoughts:

First, correlation does not prove causation. This kind of study is fairly common for medical stuff and it's not some double-blind study, so it's rather hard to draw firm conclusions.

Second, I have no doubt Vitamin D plays an important role in immune function. It is one of the vitamins people with cystic fibrosis are typically deficient in and this is a population very prone to respiratory infections, among other things.

</comment><comment><USER17> Prophylaxis is simple. There is a toxicity risk, and there are effects relating to bone density, (oral Vitamin D does not always do what people want who suffer osteoporosis, the bodies tendency to homeostasis can be an issue I believe)

But, in the current context some thousands of IUD should be something easy to do.

Like the thyroid risk and iodine for kids: you dont want to have to but you know you can.

Second upside: D is now indicated in depression. And its always be suspected in MS (higher prevelance in women, and in northern hemisphere dark winter economies)

<comment><USER18> > Like the thyroid risk and iodine for kids: you dont want to have to but you > know you can.

I'm not familiar with these. Can you explain?

<comment><USER19> [https://en.wikipedia.org/wiki/Iodine_deficiency](https://en.wikipedia.org/wiki/Iodine_deficiency)

</comment></comment></comment><comment><USER20> Hug of death? Archived at: [https://web.archive.org/web/20200515044745/http://imj.ie/vit...](https://web.archive.org/web/20200515044745/http://imj.ie/vitamin- d-and-inflammation-potential-implications-for-severity-of-covid-19/)

</comment><comment><USER21> Just a few days ago there was an article which claimed that Vitamin D supplements were useless (also referring to scientific research). Seriously, at some point, one starts not believing anything related to vitamins, since they seem to contradict one another all the time.

<comment><USER22> Supplemental vitamin D is not as effective as that naturally produced by exposing skin to the sun.

This is perhaps what you read, and doesn't invalidate thre findings here.

</comment></comment><comment><USER23> The most effective way to get Vitamin D in your system is a Vitamin D lamp. Taking D3 is a limited substitute. Switching to a lamp had an immense and immediate effect on my insomnia.

<comment><USER24> What about just getting some sun?

Not effective?

<comment><USER25> Use this calculator to figure out how much sun time you need given your latitude/longitude, cloud cover, elevation, etc. [https://fastrt.nilu.no/VitD.html](https://fastrt.nilu.no/VitD.html)

<comment><USER26> And keep in mind that using your skin to generate Vitamin D from the sun is a complex process that takes time. Exposure during the day typically results in Vitamin D being made available in the evening, and thorough washing can reduce yield.

</comment></comment></comment></comment><comment><USER27> I am getting an SSL error for this page. This website serves a self-signed certificate for/by "odin.com" in Russia.

</comment><comment><USER15> Noob question: If a person is obese, do they have greater propensity to Vitamin D deficiency? Reason I ask is I read that its fat soluble, and so I was wondering if having a greater BMI caused less Vit D in the body.

<comment><AUTHOR> Obesity is correlated with vitamin D deficiency.

[https://onlinelibrary.wiley.com/doi/abs/10.1111/obr.12239](https://onlinelibrary.wiley.com/doi/abs/10.1111/obr.12239)

</comment></comment><comment><USER28> I wish people would stop posting studies like this.

It's a junk correlation study, done at a particular time when Southern Europe was hit the worst. If they did it now, with Britain surpassing all those countries they'd get a different result.

Maybe they should do a correlation study of "Vitamin D vs Estimated number of Covid cases in country at date of lockdown" and see what they get.

(Also I'd note they conveniently fail to point out that _Northen_ Italy was hit much more badly than Southern Italy).

<comment><USER29> They mention Northern Italy right off the bat

<comment><USER28> > They mention Northern Italy right off the bat

They do.. without pointing out that's where the outbreak first originated, or comparing with Southern Italy by offsetting infection dates.

With epidemics the originating location (and the dynamics around it) is the key factor, and their failure to note that is what I'm calling out.

</comment></comment></comment><comment><USER24> I wonder if kids have higher vitamin D than adults?

<comment> core-questions They probably go outside more often, at the very least.

</comment></comment><comment><USER30> Get out and sunbath, enough about supplements:)

<comment><USER21> Wow, thanks, I am cured. You know that currently a lot of people all over the World who cannot go out, right?

</comment></comment><comment><USER31> Pretty thin. Even ignoring the accuracy of the source data, there are plenty of outliers on that graph. Before I'd assume vitamin D has any effect at all on COVID-19 death rate, I'd compare Sweden and Scotland.</comment>


The 10 Best Science Fiction Books - <AUTHOR> http://publishersweekly.com/pw/by-topic/industry-news/tip-sheet/article/68381-the-10-best-science-fiction-books.html <comment><USER2> Looks like I'm reading the "wrong kind" of science fiction, was really surprised that I haven't read a single book from this list... Some I knew I should, others I haven't heard of before.

</comment><comment><USER3> Surprised to not see a single book from Phillip K. Dick in the list!

<comment><AUTHOR> _"...Surprised to not see a single book from Phillip K. Dick..."_

Interesting list and it wasn't what I'd have expected. Would have expected at least one PKD.</comment></comment>


Larry Ellison blows off Oracle OpenWorld crowd to watch America's Cup - <AUTHOR> http://blog.sfgate.com/techchron/2013/09/24/larry-ellison-blows-off-oracle-openworld-crowd-to-watch-americas-cup/ <comment><USER2> If you poured $300,000,000+ into the sport ([http://www.forbes.com/sites/danielfisher/2011/11/15/larry- el...](http://www.forbes.com/sites/danielfisher/2011/11/15/larry-ellison-bets- big-on-americas-cup-racing/)), and your team was on the verge of an epic comeback from being down 1 to 8, I think you'd probably do the same thing.

If you're into sailing it's a seriously exciting event. I can't really blame him.

<comment><USER3> But presumably the schedules have been known for a long time, so he could have not scheduled a keynote to coincide with the race times.

<comment><USER2> See my other comment: [https://news.ycombinator.com/item?id=6441483](https://news.ycombinator.com/item?id=6441483)

<comment><USER3> Interesting. I guess it really depends on how much advance notice he gave that he was canceling the keynote.

</comment></comment></comment></comment><comment><USER4> I see all of the "I would too" comments, but really it's a slap in the face for his customers. He owns Oracle, and he's obviously a fan of the America's Cup competition, perhaps he could have scheduled OpenWorld a bit later?

<comment><USER2> _No one_ expected the America's Cup to continue this long. It was scheduled to end this past Saturday _at the latest_ , but between the 2 points Oracle was penalized (meaning they have to win 11 instead of 9) and weather delays it's extended a lot longer than anyone thought it would.

Today the TV announcers were talking about how their realtors are trying to kick them out of their temporary apartments.

<comment><USER5> I believe the TV announcers said that this is now the longest running America's Cup since 1899.

</comment></comment></comment><comment><USER6> Well now you have it. Even the company's CEO couldn't care about something called "Cloud Marketplace" and the "Oracle Cloud Database Service."

</comment><comment><USER7> I hope Ellison gets so infatuated with other things that he runs his company into the ground. :)

<comment><USER8> Haters gonna hate...

<comment><USER7> Disliking Ellison is a legitimate sport, one with a larger American following than sailing (excluding temporary recent fans).

</comment></comment></comment><comment><USER9> Biggest come back ever if they win. They were down 8-1! He's put so much money into it. I would too!

</comment><comment><USER10> Does anything important/interesting ever happen at "Oracle OpenWorld"? If so, does it require Ellison's presence?

<comment><USER11> I doubt it. People who go to JavaOne/OpenWorld are going for the BoF or technical sessions, not to hear some CEO speak about their strategy. Usually when I go, I skip those keynotes because they're mostly devoid of any useful information.

</comment></comment><comment><USER12> I don't even like Larry Ellison, but I would do the same thing. Epic America's Cup, and he has invested so much into it...

</comment><comment><USER13> I'm no fan of Ellison or Oracle but IMHO he's done so much for that company, I have a hard time chiding him for taking a little time off. Very poor timing I'll admit, but I wouldn't be holding my breath at an Oracle event just to hear Ellison speak on a product.

</comment><comment><USER14> I would, too.

</comment><comment><USER15> And nothing of value was lost.</comment>


Automated garbage collection is rubbish - <AUTHOR> http://john.freml.in/garbage-collection-harmful

<comment><USER2> John knows better than this, so shelf this rant under "blogging while frustrated". It has all the hallmarks of a night of optimization gone fruitless.

</comment><comment><USER3> Decent, fast, incremental, aggressive, safe GC is _hard_.

Parallel processing, especially across multiple CPUs and multiple boxes, is _hard_.

Mixing the two can lead to, well, let's just call them "undesirable interactions of features".

The specific example he gives of inserting node B between nodes A and C is easily solved by not holding the pointer to C in a register, but instead by setting B.NEXT from A.NEXT before setting A.NEXT to point to B.

But that's not the point. The point is that despite some fantastic advances in computing languages and runtime systems, sometimes we _still_ have to think about these things.

And it can be hard. And sometimes it hurts.

</comment><comment><USER4> His concern is valid, and while I think that we should never go back to C++ by breaking memory safety, he makes a good point. His languages are not expressive enough to allow the programmer to do what he wants.

More languages maybe should have value types, like C#. Maybe they also should have linear types and/or uniqueness types.

Lots of mechanisms exist to enable aggressive (and scalable) memory management. There is no reason why we should just accept the current state of the art.

<comment><USER2> _His languages are not expressive enough to allow the programmer to do what he wants._

His languages are Ruby and Common Lisp; dunno about ruby, but lisps allow you to have plenty of control over GC, up to and including turning it off, but usually the programmer knows better and uses something portable, like object pools, fixed containers in static memory areas, and destructive operations instead of fresh consing . The less portable options include: weak pointers, static-arrays, weak vectors, weak hashtables, finalizations, the last of which is a callback mechanism that lets you register a function to be invoked by Lisp before the object it's associated with is marked for GC.

This is the GC docs for ACL 8.1: <http://franz.com/support/documentation/8.1/doc/gc.htm>

In SBCL, you can even allocate your object with C's malloc and free! That's right SB-ALIEN:MAKE-ALIEN and SB-ALIEN:FREE-ALIEN, you can also allocate objects in "foreign" space and tagged them yourself, so Lisp treats them as its own objects.</comment></comment>


FBI to gain expanded hacking powers as Senate effort to block fails - <AUTHOR> http://www.reuters.com/article/us-usa-cyber-congress-idUSKBN13P2ER <comment><USER4> Well, this combined with the snoopers charter just motivated me to sign up for an EFF membership. It's not much, but it's something.

It really feels like we're marching towards a brave new world. They can pry my copy of Applied Cryptography from my cold dead hands.

<comment><USER5> That book might one day be considered as dangerous as an unregistered firearm... Sadly.

<comment><USER6> I accidentally downvoted on mobile. I'll fix later.

I own many unregistered firearms. Fortunately, that is likely to remain legal for some time.

<comment><USER7> I think it's quite likely that the US will end up with total surveillance of everything except guns. Guns don't threaten the power structure.

<comment><USER8> Gun homicides are down dramatically[0], yet we hear a constant drum beat from the media about terrorists and mass shooters. Guns absolutely threaten the power structure they will be coming for them soon enough.

[0][https://static.ijr.com/wp- content/uploads/2016/01/guns4.jpg](https://static.ijr.com/wp- content/uploads/2016/01/guns4.jpg)

<comment><USER7> No they don't, at least not in the hands of white people and rightwing fringe groups. We can see this by contrasting the treatment of the Malheur occupiers versus the non-armed Standing Rock occupiers.

The Malheur occupiers carried out an armed takeover of a Federal building in the middle of nowhere. No economic threat, no political threat, so they were basically surrounded and left alone. The Standing Rock occupiers are not armed and are standing in the way of money, so they get the water cannon and worse treatment.

If there was a time for terrorism to be used as a pretext, it was much closer to 9/11\. Similarly for mass shootings. Most of the public accept them as routine and children are drilled about the possibility at school. That isn't enough to make even minor gun restrictions happen. Obviously nothing is going to happen under a Republican government, especially a Trump presidency. "Soon enough" isn't this decade.

(The only thing which _could_ provoke serious disarmament efforts would be an armed Black Lives Matter movement..)

<comment><USER9> As you mention though, Malheur vs Standing Rock is an apples to oranges comparison. The Bundy's took over a very remote ranger station that no one honestly cared about. The Standing Rock occupiers were actually in the way of something.

</comment></comment></comment></comment></comment></comment></comment><comment><USER10> Instead of arbritary abuse of power by a despot we are doing the same only with processes and the law but the effect is the same.

Surveillance, secret courts, gag orders, harassment of activists and whisteblowers, no fly lists, militarization of the police, infiltration of dissenters and protest, and dubious relationships with terrorist sponsoring states show things are in a sinister and precarious state.

Our media and human right orgs so quick to turn the spotlight on others remain strangely reticent when it comes to self reflection. There is no frenzy and hysteria and no one is raising the bogey of totalitarianism and campaigning for sanctions.

Our media won't do its job and our instinctive rush to the moral high ground has lulled us in a sense of complacency.

But our moral highground and soft power built over generations is now toast. Every single bit of posturing about human rights by western media, NGOs and government will be met with derision and mockery. It is propaganda.

The use of surveillance both in the private and public sector is a 'gift' from our 'freedom loving' technologists. Ignore these naysayers and colloboraters, often found here. They have posed about freedom and liberty for decades only to suck up to authoritarianism given the slightest opportunity. The only thing they can do now is deny it, diminish it or wave it away making HN the single worst place to have a discussion on privacy and surveillance.

</comment><comment><USER11> Here is the actual text: [https://www.law.cornell.edu/rules/frcrmp/rule_41](https://www.law.cornell.edu/rules/frcrmp/rule_41)

There's nothing wrong with being against this, but this seems like a huge stretch of the words "new" and "hacking" to the point of absurdity.

They are already allowed to remotely access this information based on the case that fired this off - the issue wasn't with their methodology but who issued the warrant. The entirety of what this rule changes is it defines special circumstances where it is appropriate for the judges in a district of a victim instead of the perpetrator to issue a warrant __to do things that are already allowed __.

> Under the proposed amendment, however, investigators could not obtain a > search warrant merely because a user's location is concealed through > technological means.

> The proposed amendment does not alter that rule, but instead provides an > alternative means of satisfying Rule 41's venue provisions.

The rule clearly does not change anything about what is required to get a warrant, and concealment does not lower the bar for getting a warrant. The only thing that changes under this rule is it lays out scenarios where you would not be able to suppress evidence due to improper venue just because the warrant wasn't issued in the district you performed the crime from but instead where the crime actually occurred.

I'm not dismissing the concerns of all of those writing about this - <USER2> based on the comments and scenarios being laid out in them I think technically knowledgeable people are assuming the words "new" and "hacking" are being used correctly here without even looking into what has actually changed.

This also means people are completely unaware of what the government is already allowed to do apparently.

If everyone here got their way and this was magically blocked right now, absolutely nothing would change about what the FBI is allowed to do - <USER3> what evidence could be challenged if they ask judge A when they should have asked judge B (and can show they couldn't figure out that they were supposed to ask judge B (that's where the technological concealment comes in)).

</comment><comment><USER12> Snooper's Charter US version. I wonder if their new found hacking powers will survive a court challenge, or will it only be used in parallel prosecutions so no court ever sees it. Guessing the latter.

<comment><USER13> > Snooper's Charter US version.

That's complete and utter nonsense. The Snooper's Charter grants the UK government many new powers, and places obligations and restrictions on ISPs. It makes substantial substantive changes to the requirements for law enforcement to justify snooping and spying in the UK.

The Rule 41 change only applies to warrants seeking to access electronic documents, and makes no changes to what evidence must be presented to justify a warrant. It just changes, in two specific situations, _where_ that evidence can be presented.

These situations are:

1\. If it cannot be determined where the computer containing the documents is located, and the location has been hidden by technological means, then the warrant can be issued by a judge in any district in which the crime being investigated may have taken place. Under the old rule, the warrant had to be issued by a judge in the district where the computer was located, and so if that location could not be determined then investigators were out of luck.

2\. If the crime being investigated is a violation of the Computer Fraud and Abuse Act, and the damaged computer are in five or more districts, then the warrant can be issued in any district where the crime may have occurred. Under the old rule, it had to be issued in the district where the computer was located.

This is not even remotely like the Snooper's Charter.

<comment><USER14> Which means they can now shop around for judges until they get the answer they want. Right up there with the UK in terms of severity since this means they can keep up doing what they have been doing.

</comment></comment></comment><comment><USER15> Countdown to an FBI case where someone in their target list using HTTPS justifies wiretapping thousands...

<comment><USER13> You'll have a long wait, since this change is completely orthogonal to that.

The key change is to Rule 41(b), "Authority to Issue a Warrant". It contained a list of 5 circumstances under which a magistrate just can issue a warrant. A 6th is being added:

===={ begin quote

(6)

a magistrate judge with authority in any district where activities related to a crime may have occurred has authority to issue a warrant to use remote access to search electronic storage media and to seize or copy electronically stored information located within or outside that district if:

(A) the district where the media or information is located has been concealed through technological means; or

(B) in an investigation of a violation of 18 U.S.C. § 1030(a)(5), the media are protected computers that have been damaged without authorization and are located in five or more districts.

=====} end quote

There is also a change to 41(f)(1)(C), which concerns serving a warrant. The prior version read:

===={ begin quote

The officer executing the warrant must give a copy of the warrant and a receipt for the property taken to the person from whom, or from whose premises, the property was taken or leave a copy of the warrant and receipt at the place where the officer took the property.

=====} end quote

The update adds another sentence to that:

===={ begin quote

For a warrant to use remote access to search electronic storage media and seize or copy electronically stored information, the officer must make reasonable efforts to serve a copy of the warrant on the person whose property was searched or whose information was seized or copied. Service may be accomplished by any means, including electronic means, reasonably calculated to reach that person.

=====} end quote

<comment><USER16> > _issue a warrant to use remote access to search electronic storage media and > to seize or copy electronically stored information located within or outside > that district if ... the district where the media or information is located > has been concealed through technological means_

Remote access to a computer and they don't know where it is? This basically means a Tor hidden service or something like that?

</comment></comment></comment><comment><USER17> In a perverse way, these kind of restrictive laws starting in the US are good for the rest of the world. Let me explain.

Without doubt the concentration of computer science brilliance and investment is centred in the US, specifically in Silicon Valley. These kinds of restrictions on privacy and freedom upon those individuals will drive a kick back, investment and research into secure messaging and communication systems.

The encryption horse has already bolted, the proverbial stable door is wide open, and this could trigger the enabled and invested to bridle that horse for the good of mankind.

That's my hope anyway.

<comment><USER18> Even end-to-end encryption is of no use as soon as one has a single backdoor into your system.

Again, technology alone is never the whole answer. The legal framework must be sane as well.

</comment></comment><comment><USER19> >> especially troubling in the hands of an administration of President-elect Trump, a Republican who has "openly said he wants the power to hack his political opponents the same way Russia does."

Who exactly are they quoting here, and is there a source? This is damning to trump if it's true, and damning to the authenticity of reuters if it's not.

<comment><USER20> possibly this[1]? Trump encourages Russia to "find the 30,000 emails that are missing."

[1] [https://www.youtube.com/watch?v=gNa2B5zHfbQ](https://www.youtube.com/watch?v=gNa2B5zHfbQ)

</comment></comment><comment><USER21> It wasn't a Senate effort to block, it was a Democratic effort in the Senate.

Otherwise the headline nonsensical - hey the whole Senate tried to block but it didn't work?

</comment><comment><USER22> Why does it take legislation by the Senate to block or delay rule changes, giving the FBI authority to remotely access computers in any jurisdiction, seems it should have required legislation to enact the changes in the first place. Unfortunately this will go unnoticed by the public until it is too late

<comment><USER23> The legislative branch has delegated extensive 'policy' and 'rule-making' (arguable legislative) powers to the executive agencies, though vague statements in legislation, and broad interpretations by the courts. The same 'deference' which has allowed HHS to re-sculpt Obamacare on-the-fly is what gives the FBI, CIA, and NSA the authority to pursue these massive surveillance programs.

As a result of the tacit support the courts and legislature have given the executive agencies in the past, the legislature is now required to affirmatively act to stop most executive actions.

There have been some proposals to require legislation to enact any large change in executive branch rules/policy/interpretations, but there is little support for such measures, as most people do not want to rule back the administrative state, they just want the state to do different things.

</comment></comment><comment><USER24> "We totally weren't trying to hack that vote tallying machine... it used a VPN so we weren't sure of it's location and thought it might have been a foreign system."

</comment><comment><USER25> This is the same rule change that says if you use a VPN or TOR you can legally be hacked by the FBI, yes? I wonder if people who use work VPNs will be exempted since afaik the wording is about services that obscure your location, and most business VPNs aren't concerned with that (especially if they have split routing configured properly).

<comment><USER26> To be honest the answer seems simple. Get _EVERYONE_ on VPNs, regardless. Even if you don't really use it for much, make it connect automatically via some browser plugin and send some trash random data.

As a "data scientist" the most painful thing I have to deal with is data cleaning and data quality. Add to that the difficulty of actually getting into a (hopefully broad) array of VPN providers and tracking every person yelling into the pipe will make their (FBI/NSA) lives very very difficult, and this makes me happy on a rather visceral level.

<comment><USER27> That's actually why my group of friends all tag each others faces on Facebook as the other. Rather than not posting our faces, Facebook auto tags me as random people now (most often my wife).

<comment><USER28> Why not completely abandon FB? Build your own personal free network.

<comment><USER29> The network would have one person, challenging the definition of network.

</comment></comment></comment></comment></comment><comment><USER30> In the Goldman Sachs case I do recall charges being brought in certain states where CFAA laws were more favorable for the prosecution, and those charges being thrown out on appeal because they were brought in the wrong jurisdiction. I don't see how this changes that.

This is a procedural change the Surpeme Court already voted in favor of. The title is clickbait from what I can tell. I'm much more concerned with recent erosion of the right to remain silent.

Hacking powers are not being expanded. A loophole that has stymied investigations had been closed.

Now what we _do_ need is reasonable limits on the scope of allowable warrants to prevent dragnets. The more interesting question is whether the FBI should be allowed to use drive-by malware to infect all visitors of a site, and if so under which very well defined circumstances?

What TFA missed is the reason we are worried about this rule change is that it could make dragnets easier to get seemingly valid warrants for. E.g. Even if Hidden Services are not being used, investigator claims it's not 'reasonable' to get warrants for each IP accessing a site and so just infects all visitors with malware to scan the hard drive and local network for some evidence.

But that needs to be illegal for more than just the reason of not knowing what jurisdiction to get the warrant in.

</comment><comment><USER31> One of the most important stories of the year, on HN for 6 hours, with 11 comments and 105 points. Is everyone already afraid? I always said "I told you so" would ring hollow and have no satisfaction in it, but this is what happens when everyone forgets about our foundational principles and waves injustice away with arguments such as 234dd57d2c8db's.

The constitution is the supreme law of the land, created to protect, _not establish_ , natural rights. As such, such general _warrants_ do not properly satisfy the constitutional requirements our country established.

Actions like this, are the result of the allowed slippage, from both sides of the isle, as prescribed to them by the shadow masters.

We have allowed our true foreign enemies to infiltrate and subvert our system, falsely focus our efforts on foreign boogeymen, all the while our domestic enemies run rampant (often backed, or blackmailed, by foreign ones).

The true, the capable, the already somewhat successful enemies of the constitution don't wear hijabs, they wear business suits and ties.

This is a turning point for America, where we either cower in fear of the coming totalitarian surveillance dystopia, or we speak up and push back. Silence now will be nothing less than acquiescence.

As Hitchens said, the American revolution is the only revolution that still stands a chance.

<comment><USER32> Queue John Quincy Adams: [https://www.mtholyoke.edu/acad/intrel/jqadams.htm](https://www.mtholyoke.edu/acad/intrel/jqadams.htm)

<comment><USER33> I'd like to summon James Otis, Jr:

"I will to my dying day oppose, with all the powers and faculties God has given me, all such instruments of slavery on the one hand and villainy on the other as this Writ of Assistance is."

[http://www.constitution.org/bor/otis_against_writs.htm](http://www.constitution.org/bor/otis_against_writs.htm)

</comment></comment></comment><comment><USER34> Time to disband the FBI. And the ATF. Whatever good they do isn't justified by the threat they represent.</comment>


Hapi.js – v17 - <AUTHOR> https://hapijs.com/updates#17 <comment><USER2> Without am "About" page on the website, I can't tell what this framework is for. I've looked over each of the six pages listed, can't tell what to do with this product or why my company may be interested in it.

<comment><USER3> "A rich framework for building applications and services"

"hapi enables developers to focus on writing reusable application logic instead of spending time building infrastructure."

It's right there on the home page....

<comment><USER4> So this is like Django? Or is it like Heroku? Or more like AWS Lambda? Or .NET? Could even be a hip development methodology.

I know it is hard to write a good about blurb, but why oh why do so many projects end up with something this vague?

</comment></comment></comment><comment><USER5> I was recently wading through Loopback's voluminous docs and gobs and gobs of auto-generated code, trying to figure out how to make a highly customized and flexible REST API that allows things like this:

GET /api/crazy/long/path/that/goes/on/forever

It's a cinch in Hapi. Hapi is extremely flexible, minimal yet powerful, and a joy to use. Big fan!

</comment><comment><USER6> Hapijs is great software that has left me consistently happy, strikes a nice balance between too much, and too little.

</comment><comment><USER7> This link goes to the main Hapi.js website which doesn't really explain much about what's new in v17. From the release notes [0]:

"hapi v17.0.0 is a major new version of the framework.... The main change and the motivation for this release is replacing callbacks with a fully async/await interface."

I've never used Hapi.js before, but since hearing about how "async/await" support has been implemented I'm definitely going to look into it more.

[0] - [https://github.com/hapijs/hapi/issues/3658](https://github.com/hapijs/hapi/issues/3658)

</comment><comment><USER8> Hapi is the best api/server framework for Node. It's structured without being too opinionated.</comment>


Kubernetes 1.1 Performance upgrades, improved tooling and a growing community - <AUTHOR> http://blog.kubernetes.io/2015/11/Kubernetes-1-1-Performance-upgrades-improved-tooling-and-a-growing-community.html?m=1 <comment><USER2> The posting with commentary: [https://news.ycombinator.com/item?id=10535994](https://news.ycombinator.com/item?id=10535994)</comment>


De-Google-Ify Internet - <AUTHOR> https://degooglisons-internet.org/en/ <comment><USER2> This is a French free software foundation that have collected together various open source alternatives under a unified branding.

Being neither a startup nor american, they are of course condemned to eternal scorn by many HN readers.

<comment><USER3> I do have to admit being guilty of something similar. Being German, I would never use German software (even German translations) or hardware. I have seen to many things :D

<comment><USER4> Well, it depends. Since I switched to Linux I was quite surprised to see how many of the packages have German or European maintainers.

<comment><USER5> Yes, Europe has a lot of software engineering.

The issue is Europe has very few flag ship companies in Tech.

Not sure as to why, part of it may be the fragmented nature of Europe (lot of small/medium sized countries with different languages). Part of it may be because it failed to reach a critical mass at a critical time (dotcom boom), and now, an European startup are bought by US flagships. Lastly, part of it may be because Europeans are more risk-averse than Americans, I'm French and I'm working for an US company, and the American positivism ingrained in my US colleagues is fascinating, and, to say the truth, sometimes annoying as it feels fake, it's a facade basically.

</comment></comment></comment></comment><comment><USER6> Each proposed "free alternative" looks like it comes from the site owner, FramaSoft (example: Google Forms -> FramaForms, Google Maps -> Framacarte).

While I appreciate the efforts to de-centralize the internet, this is more an ad for the company than anything.

<comment><USER7> The free alternative (without quote, they really are free) are mostly other free software with a FramaSoft branding, in order to make it look like a coherent offering rivaling Google suite.

If you go in the documentation of each software, you will see what project it comes from.

For example, Framabag is Wallabag, Framanotes is Turtl, Framapad is Etherpad, etc...

<comment><USER8> I can't wait for them to release the latest update for FramaWeb (which is just firefox but you call it FramaWeb) to the FramaOS (which is just linux but you call it FramaOS) for my FraMachine (which is just a computer but it's specifically built by this one dude and you call it the FraMachine).

<comment><USER9> It sounds stupid, but it's actually very useful to unify everything on a single brand instead of having a hard to navigate archipelago of software. You might say it's hypocritical to turn themselves into a vendor, but if that vendor aligns with my values and can be trusted, then I'd be happy to buy a FraMachine with everything you listed because I know there's only quality FOSS software/hardware without spending ages researching and building everything myself.

<comment><USER8> It sounds stupid, but I'm actually defending the unification of everything on a single brand instead of having a hard to navigate archipelago of software.

</comment></comment></comment></comment></comment><comment><USER10> Framasoft is also behind the decentralized video platform Peertube (the creator wasn't part of framasoft originally, but he was employed by them)

</comment><comment><USER11> What is the best single term description for software like this?

Self Hosting (It was already a term for an unrelated thing)

Control Panel (its more than a control panel)

Full Stack Automation (that is what I thought of calling it)

personal cloud (What does personal mean)

personal infrastructure (that does sound intimidating)

community computer (a small server that only serves a particular community or small business)

I'm open to ideas as I develop a product that could be described by some of these names.

<comment><USER9> I'd say decentralized fits the bill quite nicely.

EDIT: Decentralized as in "Decentralized Service" or something along that line.

<comment><USER11> That seems to be framasoft's message. Decentralized sometimes means peer to peer which doesn't describe the software I currently have in my web app manager.

</comment></comment></comment><comment><USER12> I'm curious how Framasoft will keep the lights on and the servers running without ads/data-collection.

<comment><USER2> The same way wikipedia or the linux foundation keeps running I suppose.

<comment><USER13> The Linux Foundation is more like a Chamber of Commerce: [https://www.linuxfoundation.org/about/board- members/](https://www.linuxfoundation.org/about/board-members/)

<comment><USER2> Sorry! I was wrong. Linux is much older than the Linux foundation, though that has no effect on my larger point of course.

</comment></comment></comment></comment><comment><USER14> Plug: I created EteSync a secure, end-to-end encrypted, and privacy respecting sync for your contacts, calendars and tasks. [https://www.etesync.com](https://www.etesync.com)

Relevant for people interested in removing Google from their lives.

</comment><comment><USER15> [https://hn.algolia.com/?query=degooglisons- internet&sort=byP...](https://hn.algolia.com/?query=degooglisons- internet&sort=byPopularity&prefix&page=0&dateRange=all&type=story)

Been posted so many times before

</comment><comment><USER16> Only way to keep an "open" internet is to make our decision makers make open standards law. It's not perfect but it force the companies to open up their closed gardens.

<comment><USER13> What would that law make them do?

<comment><USER5> Laws already helped to break large monopolies in the past.

At one point, the internet giants will probably be broken into several entities as they start to have detrimental effect on society, we are seeing the early stages with Zuckerberg's testimony in front of Congress for example.

It will probably happen by breaking down the various services provided by these giants (AWS/Amazon, gmail/search/youtube, etc).

</comment></comment></comment><comment><USER17> The favicon is way too similar to BitWarden's, wish they'd pick something better.

</comment><comment><USER18> [https://degooglisons-internet.org/img/Peha-Banquet-CC- By-192...](https://degooglisons-internet.org/img/Peha-Banquet-CC-By-1920.jpg)

This is not what I want the Internet to be.

<comment><USER19> At least Google and Apple are big contributors to open source software (e.g. Chromium, CUPS). Instead of roasting big companies (because... privacy?) we should work together. This picture does more harm, because it view companies purely as enemies.

<comment><USER20> Open source is NOT free software. You are not free because you are using Chromium instead of Chrome. Free software is a philosophy, Open source just mean every one can read the source.

You can contribute to Open Source and be evil...

<comment><USER21> _Well technically_ , when you can _just_ read the source, it's not called "Open Source", but rather "Shared Source".

<comment><USER14> I think the term source-available is more commonly used. [https://en.wikipedia.org/wiki/Source- available_software](https://en.wikipedia.org/wiki/Source-available_software)

</comment></comment></comment></comment></comment><comment><USER22> Also known as "complicating your life significantly for little benefit".

<comment><USER23> There are plenty of people who disagree that switching from Google to free and open source alternatives provides little benefit. You can start with folks who lose their Google accounts for spurious reasons, with no means of recourse.

[https://news.ycombinator.com/item?id=19124324](https://news.ycombinator.com/item?id=19124324)

[https://news.ycombinator.com/item?id=15197357](https://news.ycombinator.com/item?id=15197357)

[https://news.ycombinator.com/item?id=4013799](https://news.ycombinator.com/item?id=4013799)

</comment></comment><comment><USER24> I had a french feeling when I read the word "association". I confirmed it originates from France when I checked their "about" tab. I like their idea but I hate it when the front page is in english as if this is a world wide effort but the rest of the web site is in French. Je vous souhaite la meilleure continuation mais je vais passer.

<comment><USER25> We are a little NPO with only 9 employees and 25 members. So we don't have enough volunteers to translate each webpage. But if you want to help us to translate everything, please do !</comment></comment>


Secure password storage – a myth? - <AUTHOR> http://blog.mostof.it/secure-password-storage-a-myth/?utm_source=feedburner&utm_medium=feed&utm_campaign=Feed%3A+Blogmostofit+%28blog.mostof.it%29 <comment><USER2> I'm going to try to save tptacek the trouble of typing it out again:

1\. Salt must be per user unique. Do not reuse salt.

2\. Do not use md5 or sha* as they are, because they are too fast to compute and thus too easy to brutforce. Instead use a slow hash function, as slow as you can possibly tolerate in your app. E.g. Bcrypt, scrypt, or pbkdf2. These algorithms allow you to tune their slowness.

3\. As computers become faster, you will need to make your hash functions slower. Have a plan in place that will allow you to recompute bashes to increase their slowness.

</comment><comment><USER3> Guy doesn't know what he is talking about.

See [http://chargen.matasano.com/chargen/2007/9/7/enough-with- the...](http://chargen.matasano.com/chargen/2007/9/7/enough-with-the-rainbow- tables-what-you-need-to-know-about-s.html) and <http://codahale.com/how-to- safely-store-a-password/>

<comment><USER4> I get so tired of this. Almost ALL of you are thinking with blinkers on. The password field of your website is not the only vulnerability! Most, of the time, an even bigger vulnerability is PEOPLE. People at your company, for example, who have access to the database.

Listen up: rainbow tables CAN BE and ARE of a concern if you run a website, because unless you use a salt, anybody who has access to your database can (speaking figuratively) rainbow-table it straight into their bank account.

Stop thinking about JUST web pages and password fields. That is a mistake some banks and other corporations made, and their databases are now -- remember? -- available for download online.

</comment></comment><comment><USER5> Repeat after me: "use bcrypt".

<http://codahale.com/how-to-safely-store-a-password/>

Or just use bcrypt, please.

</comment><comment><USER4> Repeat.

Folks, for most implementations here there are basically 2 issues to consider (if we rule out man-in-the-middle attacks):

(1) If your attack is from inside (i.e., someone has your database), you still need a salt. Don't let the rhetoric fool you. Even bcrypt uses a salt, although I have seen diagrams of its operation that never mention that little fact. The only real difference is that the salt and the encrypted password are stored, concatenated, in one database field.

(2) If you are ONLY concerned with attack from outside (i.e., an automated dictionary attack against your password field), then you get just as much functionality -- in some ways more -- by introducing a small server-side delay, and using your old hashing scheme... SHA or whatever. You actually have an advantage here because unlike bcrypt, you never have to increase some "work factor"... you just keep using the same delay value. And note that a password hashed with bcrypt at one work factor is not compatible with bcrypt running at a different work factor. They would have to be converted. (There's a "version" field in the encrypted password that is supposed to alleviate this problem somehow, but I am not sure how because that number does not seem to be related to the "work factor" at all. Work factors are user-adjustable. Version numbers are not.)

Further, I would like to add that I am not convinced that this "work factor" is cryptographically sound. What it does is cause the key setup stage to be implemented 2^N times, where N is your work factor. However, blowfish was designed such that an ideal number of rounds was built in to the key setup, in order to achieve full coverage of the key bits with the S-boxes. It is not only possible but maybe even likely that by increasing the rounds beyond that number adds nothing cryptographically. In fact there is a good likelihood that it reduces the cryptographic strength of blowfish.

For a very simplistic example: "encrypting" a message with Rot-13 might keep your kid sister from reading it easily. But encrypt it beyond the ideal number of times -- do it twice for example -- and the message is readable again! You can say "big deal, this isn't Rot-13", but the same idea applies... or at least could apply. Until I see a mathematically rigorous proof that extra key setup rounds do not regress the cryptographic strength, I will remain unconvinced. I read the Neils Provos and David Mazieres paper (I have it right here), and they do not even remotely show that cryptographic strength is any better with more rounds (or, for that matter, that it is not worse). They merely state that they "hope" that is the case. (Quote: "We hope that the unpredictable and changing content of the P-array and S-Boxes will reduce the applicability of yet unknown optimizations.")

Not very encouraging for something dealing with cryptography!

Sure... it will take more time with a higher work factor. But until the method is proven (and it's not), you run the risk of weakening the strength of your encryption.

Cryptography is a complex subject. You can't just willy-nilly toss something together like this and say you "hope" it works (as Neils Provos and David Mazieres did), and call it good. And anybody who places their trust in it without better analyses deserves what they get if it comes crashing down later.

</comment><comment><USER6> I'm a bit tired of those "just _never ever_ store passwords in plain text" statements applied way too much universally. Sure, for websites, most of time, bcrypt+HTTPS is one of the best choices. But the article in subject never mentioned that it's about the websites.

One fact. Unless your ISP uses some sort of digital certificates, or authenticates you based on physical connectivity (like port number on switch, DSLAM or whatever), your ISP stores your password in _plain text_. And that - controversially - is a Good Thing.

It's because your ISP had decided that connection-level security is way weaker than password storage security. The cables may run all over the city and they're harder to protect. The encryption takes place every time when you authenticate your connection, so nobody with a network sniffer would obtain your password easily (active attacks are still possible, but they're harder).

The _real_ rules are much more complex, based on the environment your system's working in — the connection medium, geographical diversity, supported authentication schemes and so on. The only absolutely universally true rule is "secure the whole system as much as you can, starting from the weakest link in the chain (but don't invent your own schemes)".

(Sure, there are public-key crypto, zero-knowledge password proof schemes and so on - and they should be used if possible - but, for example, one the best security options a typical home router could offer for PPPoE is a CHAP with MD5 hashing as defined in ancient RFC1994.)

</comment><comment><USER7> I see many recommendations here, and in prior discussions, to use bcrypt. Having finally actually looked up how bcrypt works, I have two concerns.

1\. It uses Blowfish, but it modifies how the key schedule and S-boxes are set up. Doesn't that essentially make it no longer Blowfish, but rather Blowfish inspired? Blowfish has a long history and has been well studied. By fiddling with it, don't they throw that out?

2\. Suppose you are storing passwords encrypted using bcrypt with a cost factor of n. You decide to increase that to m. How do you compute the new hashes for existing passwords? From the description of the algorithm in their paper, it looks to me like you can only do this by having the original, plaintext password. Thus you can only strengthen a stored password when the user logs in, so you can compute the new stored password.

Both of the above issues could be addressed by doing something like the following. What advantages does bcrypt have over something like this?

        hash_password(start, cost, salt, pass)
            h = pass
            for i = start to cost
                h = sha256(i . ":" . salt . ":" . h)
            return h

To store password p1, with salt s1, and cost c1, compute h1=hash_password(1,c1,s1,p1). Store (c1,s1,h1).

To later update this to a higher cost, c2, compute h2=hash_password(c1+1,c2,s1,h1), and store (c2,s1,h2).

<comment><USER4> I can do it even better. As long as it's being done on your own server, and you are only concerned with outside threats, then toss bcrypt over the side, and you can do that in 2 easy steps:

[1] pause for 0.2 seconds (make sure the delay does not block other threads), and

[2] compute your goddamned hash the same way you have always done.

</comment></comment><comment><USER8> Argh. Not this shit again. bcrypt, scrypt, or _maybe_ (some clients explicitly require it because it's a Well-Known Name) PB-KDF2.

</comment><comment><USER9> Even better than this is to not generate a hash, but an HMAC with the hmac "secret" being some kind of site-key and salting the input. It can't be hit by continuation attacks, to which prepending an unchanging salt is completely vulnerable.

</comment><comment><USER10> I was under the impression that even these are vulnerable, because both MD5 and SHA1 are computationally efficient, meaning you really should be iterating the hashing process many times over, or using something like blowfish. Also, I think MD5 has collision problems?

Which really just brings us to our final solution, which is use a system that is designed by others and has been thoroughly tested and trusted.</comment>