Show HN: Talks from successful founders, curated every day - <AUTHOR> https://opsimath.co/?ref= <comment><USER2> Nice website, but why does the "Invite Friends" mailto link includes a bcc to your email?

</comment><comment><USER3> Nice.

Speaking of curated lists, I pass these essays from pg (in no order) to anyone who comes to me asking why am I or am I not into startups:

[http://paulgraham.com/before.html](http://paulgraham.com/before.html)

[http://paulgraham.com/ds.html](http://paulgraham.com/ds.html)

[http://paulgraham.com/growth.html](http://paulgraham.com/growth.html)

[http://paulgraham.com/schlep.html](http://paulgraham.com/schlep.html)

[http://paulgraham.com/founders.html](http://paulgraham.com/founders.html)

[http://paulgraham.com/really.html](http://paulgraham.com/really.html)

[http://paulgraham.com/ramenprofitable.html](http://paulgraham.com/ramenprofitable.html)

[http://paulgraham.com/relres.html](http://paulgraham.com/relres.html)

[http://paulgraham.com/boss.html](http://paulgraham.com/boss.html)

[http://paulgraham.com/die.html](http://paulgraham.com/die.html)

[http://paulgraham.com/notnot.html](http://paulgraham.com/notnot.html)

[http://paulgraham.com/startupmistakes.html](http://paulgraham.com/startupmistakes.html)

[http://paulgraham.com/whyyc.html](http://paulgraham.com/whyyc.html)

[http://paulgraham.com/hiring.html](http://paulgraham.com/hiring.html)

[http://paulgraham.com/bronze.html](http://paulgraham.com/bronze.html)

[http://paulgraham.com/gh.html](http://paulgraham.com/gh.html)

[http://paulgraham.com/wealth.html](http://paulgraham.com/wealth.html)

[http://paulgraham.com/taste.html](http://paulgraham.com/taste.html)

A word of caution [0]: Over the years, I've twice come very close to quitting my job in the wake of reading those essays, and finally quit it this past month. Tread carefully [1].

In addition to this, I'd highly recommend paying close attention to how WhatsApp took on email, numerous copy-cats, the social media, the telecom industry and still won.

[0] [https://news.ycombinator.com/item?id=2982306](https://news.ycombinator.com/item?id=2982306)

[1] [https://news.ycombinator.com/item?id=10758278](https://news.ycombinator.com/item?id=10758278)

<comment><USER4> Yeah. I quit my job after reading those essays. I did 'succeed', however, in that I made about 3 years salary in one year after exiting. And while I joined several accelerators, the main factor for the victory were the essays.

I joined a few startups after that, none of whom read Paul Graham's essays, and their failure was also for not reading it. It's an extremely frustrating thing because they can do their homework and read a free 1000 word article online but instead choose to pay expensive consultants who lead them down the wrong path.

</comment></comment><comment><USER5> This is awesome! Thanks! My only advice would be a sleeker logo :D

</comment><comment><USER6> This looks great, please add an RSS feed ;)

</comment><comment><USER7> Very nice, thanks :-)

</comment><comment><USER8> Not on Apple podcast?</comment>


Two Spreadsheets, Microsoft Access, and a Pulitzer Prize for Public Service - <AUTHOR> http://blog.danwin.com/pulitzer-winner-daniel-gilbert-s-two-spreadsheets/ <comment><USER2> Great article. Microsoft Access was my first introduction to databases. (For those who don't know, MS Access is like "excel for databases.") Gave me a good-enough sense of what was happening under the hood. Started me on a career in software. 15 years later, I'm in a recently updated version of enterprise SQL Server (say what you will, but it works for us). I chuckle every time i get to write IIF(x,y,z) in a SELECT statement. I was doing that in access in 2003.

<comment><USER3> Excel and Access are _amazingly good_ products. The Jet SQL syntax is a little strange, but Access will handle substantial datasets. You can workaround the table size limit using views. It won't be fast, but it will work.

<comment><USER4> I'm not so sure I agree about access, but I totally agree about excel. I mostly use Mac and but I will always keep a Windows box around if only to run excel.

Sometimes that's the tool you need for the job, and no other will work as quickly or as well. The windows excel team knocks it out of the park pretty much every time.

<comment><USER3> I love mainly two things about Excel. One is calculation on multiple cores. The other is grace in handling huge files. I've worked with 100MB files in Excel. If I turn off auto calculation, that's actually workable. Linux spreadsheet apps tend to fall over and die when files get too big, or there are too many formulas.

<comment><USER5> Libreoffice calc is the only bit of libre software I've ever found inferior to the non-libre version. Excel is just that good, and most people use it as "Microsoft Grid Paper 2016"

</comment></comment></comment></comment></comment><comment><USER5> Excel is one of the best, and most misused tools in the world. I know one, maybe two people besides myself that do anything beyond using it as grid paper or to render graphs, and that's a shame. The MS office classes around here, from what I know, don't even mention functions beyond adding numbers.

Hell, Excel was basically the first thing I ever programmed in. Just playing with it to see what I could make it do. Nowadays I see people spending an hour making a python script to parse a file, when I can just drop it in excel use a couple functions and maybe a macro, and have it parsed in 10 minutes.

It's a real shame. I wouldn't be surprised if a lot of things in companies could get a lot better if everyone learned excel overnight. Some people's job basically amounts to doing something a spreadsheet and a little macroing can do.

<comment><USER6> It generally takes me much longer to parse data in Python (I use Pandas sometimes) than in Excel/Access but I like to think that's because I've put much more practice in the latter and have to spend more time reading the docs for the former.

<comment><USER5> Plus with standard scripting languages you have to do a lot of backbone work too- load the file, parse the file, etc before you can ever get into doing any sort of computations. Plus excel is vastly easier to debug, thanks to it all being live.

</comment></comment></comment><comment><USER7> Nice! SQL is good like that, in my experience I've found that non-devs are able to understand and use it somewhat surprisingly quickly. Probably has something to do with the clause structure & parsing being fairly similar to that of a natural language sentence.

</comment><comment><USER8> Good article, but the spreadsheet/database skills did not seem to be the real story. Yes, very useful, and powerful, but LOTS of people have developed those skills. Instead, I found myself asking, "Where did the data come from?" He asked for it. Who did he ask? The power of the story seemed to me to be that he asked a powerful question, figured out how to get the data to answer that question, and then figured out what skills he'd need to sift the data.

</comment><comment><USER9> This article shows why you shouldn't trust journalists.</comment>


Banksy identity 'accidentally revealed by Goldie' during interview - <AUTHOR> http://www.independent.co.uk/arts-entertainment/music/news/banksy-identity-revealed-goldie-interview-robert-del-naja-massive-attack-art-a7804091.html <comment><USER2> There was a study a few years ago that came to the conclusion that Banksy is Massive Attack. New bits of Banksy art appeared wherever Massive Attack happened to be on tour at the time, and nowhere else at that point in time.

Of course, he could just be a big fan and follow them everywhere :)

</comment><comment><USER3> Who cares?

<comment><AUTHOR> Lots of people, probably.</comment></comment>


JerryRigEverything reveals a ridiculous flaw in a $100 crowdfunded smart lock - <AUTHOR> https://www.youtube.com/watch?v=RxM55DNS9CE&feature=youtu.be <comment><USER2> Yeah, that's not how you secure something...</comment>


Ole Rømer, the speed of light, apparent period of Io, and Doppler effect (1998) [pdf] - <AUTHOR> http://www.df.unipi.it/~giudici/romer.pdf <comment><USER2> Seems to be down. Abstract:

Ole Rømer, the speed of light, the apparent period of Io, the Doppler effect, and the dynamics of Earth and Jupiter

James H. Shea Geology Department, University of Wisconsin—Parkside, Kenosha, Wisconsin 53141 (Received 3 November 1997; accepted 14 January 1998)

Ole Rømer's (1676) method of using variations in the apparent period of Jupiter's moon, Io, to demonstrate that the speed of light is finite made use of what we would today call a ''Doppler'' method. He did this 166 years before Christian Doppler described what we now call the Doppler effect and the mechanism in 1842. Although the method Rømer conceived is unquestionably valid, his original and only paper on the subject left out much of the detail necessary to determine whether his measurements were adequate to the task of demonstrating the effect he claimed to have observed. Unfortunately, the timekeeping available to Rømer and his colleagues Picard and Cassini, each of whom made some of the observations involved, was, at best, not quite up to the task of measuring the necessary times with sufficient accuracy. Mathematical analysis of the dynamics of the Earth/Jupiter synodic system allows a more thorough analysis of Rømer's work than has previously been made. Rømer's case was built on four ''observations,'' one of which clearly failed, one of which was successful, and two of which were quite questionable.

© 1998 American Association of Physics Teachers

Wikipedia:

[https://en.wikipedia.org/wiki/R%C3%B8mer's_determination_of_...](https://en.wikipedia.org/wiki/R%C3%B8mer's_determination_of_the_speed_of_light)

One newer paper (2014):

[http://www.oasi.org.uk/Obsvns/20140518_Romer_revisited.pdf](http://www.oasi.org.uk/Obsvns/20140518_Romer_revisited.pdf)</comment>


Arguing on the internet suck - my new startup ArgueX fix the problems - <AUTHOR> http://arguex.com/

<comment><USER2> Initial thoughts:

\- show me some functionality or it didn't happen

\- no examples of how it works?

\- generally hostile atmosphere (you're priming with words like "sucks" and "argue", which are negative) - doesn't look fun

<comment><AUTHOR> Thanks.

You can try joining the beta, we'll let you know when it is available.

It's a little unfortunate that the term argument is perceived so negatively. It is the formal term though.

<http://en.wikipedia.org/wiki/Argument>

These types of arguments are by nature combative and adversarial, and won't work for Dale Carnegie following people who want to network and make friends. It's designed for people who are interested in logic and truth and understanding as opposed to a fun social interaction.

It is about more effective and less frustrating arguments. If you come from the perspective of, arguments are bad in general and you shouldn't argue, perhaps it's because of how terribly it has worked in the past? Sign up, and perhaps it'll change your mind.

</comment></comment><comment><USER3> I don't get it. Is this a forum with special rules prohibiting advanced rhetoric, or a natural-language processing tool, or a rationalist movement?

<comment><AUTHOR> It's not a forum and it's not a movement(yet?). It's a web platform designed for 1 on 1 debates with spectators as well as argument presentation. But it combines rules and simple natural language processing.

For example, one of the rules is, when presenting an argument, you cannot ask a question. We try to check for questions in your argument and warn you against them.</comment></comment>


Schools Grab .xxx Domains to Protect Names from Porn - <AUTHOR> http://www.cbsnews.com/8301-501465_162-57321368-501465/schools-grab-.xxx-sites-to-protect-names-from-porn/

<comment><AUTHOR> Or as a Slashdot commenter put it[1]: _"There's really only one TLD."_

      [1] http://news.slashdot.org/comments.pl?sid=2523358&cid=38044444</comment>


License to not drive: Google's autonomous car testing center - <AUTHOR> https://medium.com/backchannel/license-to-not-drive-6dbea84b9c45#.os2lwoe8b <comment><USER2> > _For some time, Google has been convinced that the semiautonomous systems > that others champion (which include various features like collision > prevention, self-parking, and lane control on highways) are actually more > dangerous than the so-called Level Four degree of control, where the car > needs no human intervention. The company is convinced that with cars that > almost but don't drive themselves, humans will be lulled into devoting > attention elsewhere and unable to take quick control in an emergency._

I think this is a really good perspective. Considering how often drivers are already doing things like using smartphones behind the wheel of non-self- driving cars, I think that sort of activity is only magnified by partial autonomy - which is very dangerous! Humans get distracted or bored easily, especially when completing routine tasks. I'm glad that Google is choosing to build a car that never needs human intervention rather than rushing to market with a partial solution.

Here's a video where you can see what distracted teen drivers look like. Terrifying. [http://youtu.be/SDWmwxQ_NnY](http://youtu.be/SDWmwxQ_NnY)

<comment><USER3> I've seen discussion of this issue in the domain of pilots with commercial airlines. The suggestion was made that because so much of flying is now done by autopilot, pilots' ability to react quickly and appropriately in a real emergency when control is handed back to them has significantly declined. And that we may soon go to completely pilotless airliners which are taken over by ground control in case of emergency. (This would also have the side-benefit of significantly reducing the risk of hijacking).

<comment><USER4> How does this reduce the risk of hijacking? An attacker would just hijack ground control instead.

<comment><USER5> Ground control is much easier to secure. Instead of having to find a needle (hijacker) in a haystack (the millions of random Americans flying each day) with a 90 second search, you can do proper background checks on the small number of people who are allowed to be there.

<comment><USER6> Until one of those people turns out to be malicious. There is no way to tell what anyone is thinking, or whether they've been spending their time outside of work being slowly corrupted by certain influences.

<comment><USER5> And yet the rate of terrorist hijackings, although tremendously small, is much larger than the rate at which secret service agents betray the president.

</comment></comment></comment></comment></comment></comment><comment><USER7> Google is betting on a system that depends really heavily on detailed mapping. I'd love to know their plan for determining when the map is out of date, because of road construction or whatever. That seems like the hardest part of the whole thing to maintain long-term.

<comment><USER8> AFAIK, pretty much everyone is. That's really been the big shift over the past few years that's allowed for fairly impressive autopilot levels without AIs having to "understand" and parse the world to nearly the degree people do. Presumably vehicles connected to the system will be able to contribute to updates but maintaining current, high resolution maps across a wide area will certainly be a challenge. It's not unreasonable to think that the government could play some role as well as it does for marine navigation.

</comment></comment><comment><USER9> In light of all the IoT bugs we've been hearing about, it's really nice to hear that they are being super cautious about development here. I hope they keep the same level of caution (or increase it) as they get close to market. My biggest worry here is that as the different car companies get close to market on SDCs, there will be more pressure on each to hurry.

<comment><USER10> My biggest worry is that Tesla's half-baked almost-self-driving-but-not-really will hurt someone and cause reactionary anti-self-driving-car laws.

<comment><USER11> Tesla is worrisome, but they backed off some on the automation. Everybody else who has Tesla-level autodrive (NHTSB level 2, or lane keeping plus radar cruise control) has sensors to make sure the driver has hands on the wheel, or is at least in the seat and looking forward. Tesla didn't put that in. Hence those scary Youtube videos.[1]

Cruise (YC 14) is just scary. They still have that advertising video online [2] that totally oversells what they can do. All they have is lane-keeping and smart cruise control, like the other entry level systems. It's automatic driving from the "move fast and break things" crowd; they're from web and app startups.

Google is being cautious and testing heavily. But they're spending enough money to test fast, with many cars on the test track. That's the auto industry way of doing things. It takes money, but not decades, to get it right.

The CEO of Volvo has the liability issue right - when in autodrive, the manufacturer is responsible. If you can't accept that, you shouldn't be doing this.

[1] [http://www.cnet.com/roadshow/news/tesla-autopilot-fail- video...](http://www.cnet.com/roadshow/news/tesla-autopilot-fail-videos- nobody-likes-to-listen/) [2] [http://www.getcruise.com/](http://www.getcruise.com/)

<comment><USER8> It's hard to come up with examples of consumer tech/products where it's considered just part of the way things are to have an event resulting in serious injury or death even though a properly maintained product was used as directed and there wasn't a clear external factor (e.g. brakes don't work on ice). I suppose some failures due to age. Drug side effects to a degree (but see Vaccine compensation fund). However, in general, such things routinely result in lawsuits in any case.

</comment></comment></comment></comment><comment><USER12> I asked this before: If they need to log many hours of driving and various conditions - why cant they hook the brain of the car up to playing videogames like GTAV and EU truck simulator etc... and have it play thousands and thousands of hours of the game without killing any pedestrians or getting any tickets

<comment><USER13> Something tells me you didn't read the article:

> At the end of the shift, the entire log is sent off to an independent triage > team, which runs simulations to see what would have happened had the car > continued autonomously. In fact, even though Google's cars have autonomously > driven more than 1.3 million miles—routinely logging 10,000 to 15,000 more > every week — they have been tested many times more in software, where it's > possible to model 3 million miles of driving in a single day.

<comment><USER12> Thanks - I hadnt completely finished the article. :)</comment></comment></comment>


MOSH - <AUTHOR> http://getmosh.io/ <comment><USER2> This is actually really well done. Nothing new technically, but presented really well.

(I thought this was going to be another posing of [https://mosh.mit.edu/](https://mosh.mit.edu/))

</comment><comment><USER3> I was really confused about what this site had to do with mosh, the mobile shell[1]. It seems the answer is nothing, if anyone else was wondering.

[1]: [https://mosh.mit.edu/](https://mosh.mit.edu/)

</comment><comment><USER4> Another one of those obscure pointless sites with no explanation. Of course you're free to produce as many of them as you want but putting something like that on HN is just very bad style. Not everybody is comfortable using a crystal ball to find out what this diversion is supposed to be. It's just wasting everybody's time.

</comment><comment><USER5> Really amazing !!</comment>


Google refunded $200 because I missed 5 lines of Code - <AUTHOR> https://aswinmohanme.github.io/why-google-refunded-200-because-i-missed-5-lines-of-code.html <comment><USER2> I once worked on a platform where you could buy ringtones, wallpapers, jokes etc by SMS pre App Store and play store.

Every night the platform would kick off a process to claim money from the telco using some key which was tied to an SMS the user had sent.

That process was responsible for more than $1 million a month, but it was buggy as hell.

Half of the billing attempts would fail, the retry logic was buggy, processes would crash so you would just start them again without proper semantics to ensure you don't bill people twice.

After a while there were so many retries outstanding that you couldn't get through them overnight, so we would try in random orders and we would have the process running from 3 days ago whilst try close off today's bills.

I'm sure people were billed incorrectly and a lot of money was left on the table from users who should have been billed. We never really heard a lot of noise about this either.

So I'm sympathetic to this process and glad that Apple and Google have improved the confidence around mobile commerce.

<comment><USER3> That's very interesting. I'm sure there are a lot of stories like this from back in the day - charging people has never been easier than it is now.

<comment><USER4> Not just back in the day, I have at least a couple of customers of which I know they are losing money because of billing issues.

Why? Because most accounting software is horrible and have minimal to no third party integration options. Many of them don't have an API, so the only option you're left with is manually (!) importing some XML structure every day. The logic is usually very limited so stuff like record mutations are often silently ignored during the import.

The accounting software world is evil. Deliberately engineered vendor lock-in, very limited third party integrations, ridiculous charges for 'custom' implementations, etc. I once build a migration tool for a well known accounting/ERP suite, and my partnership with them was immediately terminated due to 'breach of terms'.

<comment><USER5> Google themselves stole $75 million from Adwords customers by not coding up a particular kind of refund and ignoring it for decades. It is likely a similar thing is happening with banned account balances.

[https://www.businessinsider.com/google-emails-adtrader- lawsu...](https://www.businessinsider.com/google-emails-adtrader-lawsuit- refund-ad-click-fraud-2019-5)

[https://www.searchenginejournal.com/adsense- lawsuit/248135/](https://www.searchenginejournal.com/adsense-lawsuit/248135/)

<comment><USER6> That's interesting! I've often remarked that it's a giant competitive advantage for huge companies like Comcast to be able to net however many millions of dollars from billing "mistakes" that never get contested. On the one hand, I'm willing to concede they are mostly probably honestly mistakes and they only make up some tiny percentage of all their transactions, on the other hand, it probably adds up to a decent sized company's total revenue every year that they basically get just because they're so giant they can screw up a ton of transactions and plausibly claim it's not fraud.

</comment></comment></comment></comment></comment><comment><USER7> Near the end of the article: _These kinds of incidents make us wonder the real cost of Code and the more real cost of messing up_

Imagine having an app about there ticking away and making pretty decent revenue. Little do you know there's a subtle error in business critical code (e.g. in-app purchases, ads, etc), reducing the revenue by over 50%. This is something I've seen first-hand and have become quite paranoid about. I suspect that it happens a lot. The reality is, no matter how many times one looks at their own code, there is no substitute for continuous testing of typical use cases in a production environment, ensuring that business critical code functions as expected. It's a continious process, because even if the code works properly at the beginng and isn't modified, the underlying OS or API's it interacts with can change and introduce unexpected behaviour.

<comment><USER8> I've worked for a company that went bankrupt over some accounting system they'd built and used themselves. It contained a subtle bug that made them think they had more money than they had.

It's really vital to thoroughly test and verify any financial code. Any code, but financial doubly so. And do it again in production. Even small errors can really add up over time.

<comment><USER9> Yes, testing is important but also sanity checking and in-flight checks as well

Why are you getting declined transactions? Why are you getting chargebacks? Are we getting one transaction per sale?

</comment></comment></comment><comment><USER10> > In order for Google Play to ensure a consistent purchase experience > regardless of where the user purchases your product, you must acknowledge > all purchases received through the Google Play Billing Library as soon as > possible after granting entitlement to the user.

Can someone who understands this domain better explain why this exists?

A superficial reading of the text triggers thoughts of "fraud prevention", but the code the author uses to fix it is clearly one a fraudulent app can also easily include.

Other thoughts about preventing poor user experiences such as dark patterns to trigger accidental purchases, or bait-and-switch functionality with Fremium apps also don't seem to be prevented by this.

So what's going on?

<comment><USER11> Play Billing 2.0 added the ability to purchase in-app items from outside of the application.

This ACK confirms that the application properly processed the notification and delivered the item to the user. Otherwise, Play assumes that the purchase was lost in the ether sometime before fulfillment (e.g. bug, the app crashed, etc.).

<comment><USER12> I assume that part of it is a psychologically-motivated desire to maintain a tight reward loop for Play purchasers, with no payment-processing delays.

<comment><USER13> How do you get that out of previous comments

<comment><USER14> Otherwise the item could only be available once purchase was confirmed.

<comment><USER15> How could it be available if the application didn't ACK that it received the purchase order and granted the item?

<comment><USER16> From the post, it sounds like the users receive the purchased item immediately but the app developer needs to confirm that the charge went through properly. Otherwise the funds are returned but the user keeps the purchased item.

 _Without acknowledging the purchase the money was refunded back to the people who purchased it. And the best thing was the dark theme would be activated even if the user got the money refunded._

</comment></comment></comment></comment></comment></comment></comment><comment><USER17> This seems like something that static analysis can correct before the new app is even allowed in the App Store. If you accept a purchase but have no calls the the acknowledgement APIs then bounce with a message. Hell, it could even be a compiler warning. This seems squarely Google's issue and the refund should be returned.

<comment><USER18> Static analysis aside, as soon as it happens even once, you'd think that there would be a big red warning on your dashboard saying "X purchases were refunded because they weren't acknowledged". The fact that the author had to figure it out through user emails and negative growth is strange.

<comment><USER19> Mobile games get frequent refund requests and devs are more than a few steps removed from the actual accounting from app stores. The analytics might throw an event if there's a hook for a refund request but Apple and Google own the bank in a black box. Basically devs get a monthly statement with refunds subtracted from their cut.

<comment><USER18> There's a huge difference between the user explicitely requesting a refund, and Google automatically ordering one because the purchase wasn't acknowledged.

I'm not familiar with the API, and I could see both of them looking the same on the dashboard, but Google themselves should be able to distinguish between the two, and one of the two cases is very likely a bug in the app code. I could not see a case where not acknowledging the purchase would be intended.

</comment></comment></comment></comment><comment><USER20> I was surprised when I read that he moved back from Fluter to Kotlin, down the line I read it's due to APK size.

I'm happy to hear some developers still care about size esp. for mobile, but on the other end, I'm sad because I'm currently using Flutter for building apps and I'm jealous of that 4.5MB difference :D

<comment><AUTHOR> I love everything about flutter except the size, and I would have stayed on flutter if it wasn't for the competition's app weighing around 1.6 MB.

<comment><USER21> Does the size of an app affects something besides the initial download?

Maybe it also lengthens the app loading but everybody here doesn't talk about it because it's well known of android developers, which I'm not?

<comment><USER22> Yes, bigger apps take up more space in storage.

<comment><USER23> I feel like most phones nowadays don't really care about a 5mb difference considering they have multiple GB's of space. At least on my phone, the space taken by the actual app binaries is negligible compared to media.

<comment><USER22> One app being 5MB larger is negligible. 50 apps being 5MB larger isn't a huge problem but it is significant. Modern phones have gigabytes of storage but not many gigabytes.

I also didn't see that the difference is just 5MB. Most apps are in the double or even triple digits.

In addition, caring about anything being 3 times larger than necessary stikes me as the right mindset. Individual items may insignificant but they add up. It's certainly better than the electron-ic opposite.

</comment></comment></comment></comment></comment></comment><comment><USER24> Shoutout to the people who cared enough to want to pay for it

<comment><USER25> I kinda thought that myself.

</comment></comment><comment><USER26> Wait a minute. 5 lines of code were missing in the app, causing users to be refunded. So does this mean a malicious user could decompile the app, remove this code, recompile, and get these auto refunds? This seems a way easier mechanism to get free in-app purchases rather than reverse-engineering the rest of the code.

<comment><USER27> Your recompiled version would not have the proper cryptographic signature as you don't have the keystore used by the dev on your pc

<comment><USER28> The version without those 5 lines will now be forever out there though. Malicious peers can download the apk and get the premium version for free. This feels like a poorly thought out design on Google's part.

<comment><USER29> Obviously if you decompile the application and modify it you can get the premium features for free. What's your point?

<comment><USER30> numerlo is saying that users don't even need to decompile the app - they can continue sharing the buggy APK with each other to get free stuff.

</comment></comment></comment></comment></comment><comment><USER31> did the same implementation one month ago (and also missed the acknowledgement step :/) and we are 1 month before release, first thing on Monday morning to add and test it. Thanks dude cheers :D

</comment><comment><USER32> Seems like this shouldn't be the default. As accepting and then refunding a payment is so uncommon, it should require extra code for that case instead.

<comment><USER33> The issue is that if you have a bug where the feature isn't activated even if they pay, the user would lose money. It's natural that as you activate the feature you should acknowledge the purchase. Otherwise you could have bugs like double charging and such.

It was an unfortunate mistake by the author, but it makes perfect sense why it happened. The person who made the mistake should lose out.

</comment></comment><comment><USER34> Little off topic. How was your experience with Flutter? How does it compare with other two?

</comment><comment><USER35> Building a successful business requires taking responsibility for all the boring details. Complaining that it is someone else's fault wastes precious time and hurts morale.

</comment><comment><USER36> New payment API, it was something they have mentioned.

A lesson for next time always read blog posts about new APIs you are planning on implementing, especially when it comes to payments.

</comment><comment><USER37> Just installed your launcher, exactly what I was looking for :)

One change I'd suggest, dragging to reorder custom apps.

</comment><comment><USER38> Also off-topic, but why move away from React Native?

</comment><comment><USER39> Alternative title: I missed 5 lines of code and lost $200 (and it's all my fault)

<comment><USER40> I'd have just added "of sales" or "of my sales" after the dollar amount to make it more clear.

I actually looked at this because I thought Google had refunded money to the author and I wanted to see what had actually inspired an act of customer service from a company known for not having it.

</comment></comment><comment><USER41> Seems like a PEBCAK</comment>


Help making WebP a responsive image format - smooth-graphics http://anselm-hannemann.com/blog/2012/04/14/a-chance-for-webp/

<comment><AUTHOR> One of the Mozilla devs articulates some of the more technical problems with WebP. One of the more noticeably shortcomings of JPEG is the lack of alpha transparency, which isn't address by WebP.

<http://muizelaar.blogspot.com/2011/04/webp.html></comment>


Old engineers have plenty to offer–just not to startups - <AUTHOR> http://qz.com/187700/age-bias-silicon-valley/ <comment><USER2> I'd question this premise even in its watered-down form. Startups often face a "wall" where the initial hacked-together code simply fails to work, at all, because the accumulated technical debt makes it impossible to push out any new features without breaking something important.

A company full of experienced engineers that's paying attention and willing to humble themselves enough to work on a risky project where their competition is 22 could easily take advantage of that. Let the young, overworked kids prove out the market, and once there's demand for the product, come out with a competitor that does the same thing but doesn't fall over. If timed right and executed quickly, you can provide an alternative right when everybody is frustrated by the fail-whale.

Facebook arguably did this to MySpace/Friendster. The initial version may've been hacked together, but Zuckerburg worked very quickly to hire experienced engineers from Google and ensure that Facebook scaled smoothly, while their competition floundered around.</comment>


Cassandra Documentation Now Available Online - <AUTHOR> http://www.riptano.com/docs/0.6.5

<comment><USER2> great, getting to understand how to use cassandra was a quite time consuming without a clear documentation. great work!</comment>


Show HN: An Inspirational Twitter Account for Motivation - <AUTHOR> https://twitter.com/cosmicsoulforge <comment><AUTHOR> Been trying to help myself & others and realized that there are moments when we all need that extra push of motivation.

So I made a twitter account dedicated to helping with motivation & inspiration during these confusing times.

Hope it helps you & everyone who sees this :) [https://twitter.com/cosmicsoulforge](https://twitter.com/cosmicsoulforge)

<comment><USER2> I think I could do with something with this. At least its nice to know that there's some Twitter accounts that are worth looking at and this twitter account is a diamond amongst many other accounts. Nice work there.

<comment><AUTHOR> Thank you, I appreciate it.</comment></comment></comment>


TimeSeriesDB - <AUTHOR> https://github.com/subes/invesdwin-context-persistence <comment><USER2> Since we have this title, any recommendations for open source time series database? Regarding pruning I'd prefer something more configurable than simple round robin, and it would be great to be able to store things like events (maybe logs), not only floats over time.

<comment><USER3> Logs are very much not a time series so storing them in a time series database is not something that I would recommend. Time series are essentially a sequence of numeric data points in chronological order. Though events are usually in chronological order, they're not numeric data points (though they can contain that too).

As a consequence of being two different things, storing and analysing them efficiently need different solutions. I've seen people stuff everything in Elastic Search and it's certainly possible if you really want to.

<comment><USER4> A time series database is anything that stores data with time attached, so log storage does count.

The more pertinent difference is event logging vs. metrics.

For the former the ELK stack is popular, and Prometheus.io is suitable for the latter.

<comment><USER5> Prometheus unfortunately has limited long term storage support and it's explicitly not one of their goals. Their goal is "operational monitoring", not analytics.

I found that by trying to see if it could be used as a metrics DB but stumbled upon a few issues like configuring retention times per target. See for example [https://github.com/prometheus/prometheus/issues/1381](https://github.com/prometheus/prometheus/issues/1381)

Prometheus has lots of potential but it's not a metrics DB at this point or in the near future. I just wish they'd made that a bit clearer on the page.

"We make design decisions that presume that Promtheus data is ephemeral, and can be lost/blown away with no impact."

That viewpoint pretty much limits them to be an ops tool. I wish they'd reconsider this point.

</comment></comment></comment></comment><comment><USER6> The link doesn't seem to have anything to do with timeseriesDB.

<comment><USER7> The section named ATimeSeriesDB talks about an approach to build a persistence layer for time series data. I agree, not a great submission, though.</comment></comment>


New Namecoin Mining Pool - <AUTHOR> http://namebit.org

<comment><USER2> Pays for stales and I got double paid!! WOOO!!!

NameBit FTW

<comment><USER3> Acct created 3 min ago, totally not spam.

<comment><AUTHOR> Spam because a user was happy with it? Happy enough to go to some new forum and proclaim it? I don't understand. Or was your sarcasm not sarcasm?

<comment><USER3> The comment seemed like nothing more then thinly veiled boosterism and reminded me of hundreds of spam emails.

I rarely click on usernames of random people but I did for his and again the timing seemed suspicious. The odds that "he" found your article and created the account in the 2 min that your article was posted seemed low.

I'm willing to believe he's a legitimate user and just happy about it but the whole subject reeks of penny stock juicing.

<comment><AUTHOR> My apologies, then. I've seen plenty of nmc/btc announcements here and did not think it out of place.

<comment><USER3> No you don't have to apologize for anything.</comment></comment></comment></comment></comment></comment>


New Conference in Atlanta Focused on Diversity, Inclusion and Angular - <AUTHOR> https://medium.com/@NgAtlanta/ngatlanta-kicks-off-this-january-ab6489801fba <comment><USER2> Really proud of the Angular community and the hard work of the organizers to make this happen.</comment>


How the Colombian army sent a hidden message to hostages using a pop song - <AUTHOR> http://www.theverge.com/2015/1/7/7483235/the-code-colombian-army-morsecode-hostages

<comment><USER2> It's a great feel-good story, but the whole thing is just _intelligence theater_ , à la Bruce Schneier's _security theater_.

That is, the coded message serves no intelligence or military objective. It sounds to me like the government concocted this idea because they felt they should be doing something, anything, no matter how useless( * ).

What's a hostage supposed to conclude from hearing, "19 people rescued. You're next. Don't lose hope". Should I run? Run now? Hide in the jungle? Run when the rescue starts? Stay put? Fight during the rescue? Don't fight? If you asked 10 different people what _specific_ action you're supposed to take based on this message, you'd get 10 different answers.

If this message had any tangible effect, why aren't there any first hand accounts from the hostages explaining what they did _differently_ as a result of hearing the message?

So 3 million people heard this song, yet the only ones who understood it were some of the hostages? Not one of the several thousand militants and no one in the public decoded it? This just proves the point that it's un-actionable. Case (1): Lots of people got it besides the hostages, but there's nothing to blow the whistle on. It's not as if the message says, "Raid at dawn". Case (2): Nobody got it, which also implies that the message had no effect.

( * )If the government claimed that the message was simply a way to make the hostages keep up hope, then OK (though it still seems like a lot of expense for little gain). But they're trying to make it sound like a big intelligence or military coup, which it is not.

<comment><USER3> >19 people rescued. You're next. Don't lose hope.

Me : I think it should mean, you might be the next to be rescued.

>If this message had any tangible effect, why aren't there any first hand accounts from the hostages explaining what they did differently as a result of hearing the message?

From the article : In his military psychological evaluation, Col. Espejo says that the soldier spoke of hearing "the code hidden in the song," and revealed how the message was passed from soldier to soldier. The song was even enjoyed by the FARC, who were oblivious to its secret message. "It makes me very happy to think of the hostages listening to our song," Ortiz says.

From the article : Someone who is a hostage, for over a decade, would think there is still hope. But I too find the article lacking in this.

> who understood it were some of the hostages? This just proves the point that > it's un-actionable.

From the article : Operation Chameleon — a sixth-month operation that involved 300 government soldiers and secret raids. Because the FARC shoots hostages dead at the first sight of a military invasion.

From the article : Espejo reasoned, "The FARC were peasants from the fields, they wouldn't know [Morse].

> But they're trying to make it sound like a big intelligence or military > coup, which it is not.

Me : No, they are not. It's an extension of Operation Chameleon - That's what I think.

> If the government claimed that the message was simply a way to make the > hostages keep up hope, then OK.

Me : Exactly, but it's an understatement. For those who are suffering, this news would mean a world to them.

<comment><USER2> > Me : I think it should mean, you might be the next to be rescued.

But what _specifically_ would you have done differently if you were a hostage and had received this message? Don't answer, "I'd keep up hope." "Not losing hope" is not an action.

The message has no particular call to action. That's my main point. My second point is that even if you named some specific action you'd take, someone else would have had a different idea because it's so vague.

A compassionate message could mean the world to a hostage. That's true. But a compassionate message and a _useful_ message are not the same thing.

<comment><USER3> As far as I understand, this messages was used in conjunction with Operation Chameleon. On it's own this message wasn't supposed to do anything, but it had to be discrete because this operation was clandestine.

The goal was to give them hope. That's the point. To let them know that there is help on the way, but there in't no accurate account by how far.

The `action` here is the Operation Chameleon, which is a secret.

</comment></comment></comment></comment><comment><USER4> The morse is subtle but if you listen closely you can hear it. Set the Soundcloud player to 1:25 or so and you'll hear singing as they finish up the chorus. As the chorus completes at about 1:31 the singing stops and instruments play. Listen closely, and try to remember what morse sounds like in the movies. It's there in the background, and once you hear it it's obvious. Don't listen to the drums or tambourine, it's not there in the beat. It's "behind" the beat as if a background instrument was playing.

(edit: it also kicks in again around 2:30 and 3:30. So the start times are at approximately 1:30, 2:30, and 3:30.)

Outstanding.

<comment><USER5> The lyrics make it even getter: "...escute este mensaje hermano - beep beep beep beep beep..."

<comment><USER6> As the article points out, this translates to:

 _" Listen to this message, brother"_

</comment></comment></comment><comment><USER7> Though I don't _know_ morse code (beyond S-O-S), I know _of_ morse code and roughly what it ought to sound like. I really wish the article had started out with the SoundCloud player, saying "Listen to this first... notice anything peculiar about the song?" since because I knew it contains morse code, I instantly recognized it in the chorus. I wonder if I would have been as oblivious to its inclusion as the FARC members had I not been made aware beforehand.

It reminds me of Evanescence's "My Immortal" song where people have speculated there's a hidden message in it. Take a listen and see if you can hear it: [https://www.youtube.com/watch?v=5anLPw0Efmo](https://www.youtube.com/watch?v=5anLPw0Efmo)

<comment><USER8> If you're listening to the Evanescence song, the supposed morse code is right at the end of the song.

I did a bit of reading and one of the band's co-founders said it isn't morse code but rather a preset synth effect on the keyboard they were using (see here: [http://www.netmusiccountdown.com/inc/news_article.php?id=610...](http://www.netmusiccountdown.com/inc/news_article.php?id=6106))

<comment><USER7> It's also in one other place that I can detect, though you may need to play it with sufficient volume to hear it. That you only heard it at the end lends credibility to the effectiveness of hiding morse code in a song.

</comment></comment></comment><comment><USER9> Clever! It reminds me of another story of broadcasting information such that only interested parties will receive it.

In 1997, during an auction of wireless spectrum by the FCC, some of the participants colluded by stealthily signaling the geographic region of the licenses they most valued. They made the last few digits of their bids (in dollars), which were visible to all, the area codes of those regions.

<comment><USER3> Interesting, can you link any article?

<comment><USER9> The Economist describes the incident here: [http://www.economist.com/node/149797](http://www.economist.com/node/149797)

</comment></comment></comment><comment><USER10> This is a fantastic example of steganography in action, in a context _other_ than hiding info in low-order bits of images.

<comment><AUTHOR> I know, right? It found it rather fascinating immediately.

</comment></comment><comment><USER11> I think I hear an additional bit of trickery that the article didn't mention: the morse signal keeps oscillating between the left and right stereo channels, which on headphones or a nice speaker system make it sound more like artsy synth and less like a coded message.

If the illustration in the article is accurate, the hostages are probably listening on a monophonic radio or one with limited stereo separation, which would make the code easier to pick out and understand.

</comment><comment><USER12> This is a pretty great story. I was in Bogotá in July of 2008 just after Ingrid Betancourt and several other hostages were rescued. In the face of such jubilation of their rescue, there was a small demonstration in Plaza de Bolívar to remind everyone that there were still people who needed help. [https://www.dropbox.com/sc/93d9g1ycgxamg3o/AAD4g5xPPyT3R-AWJ...](https://www.dropbox.com/sc/93d9g1ycgxamg3o/AAD4g5xPPyT3R-AWJxG_JEr9a)

It is inspiring seeing the steps that the government took, the planning, the rescue, and the demonstration of genuine care for all involved.

</comment><comment><USER13> It's very important to keep prisoners' morale high, so this initiative is very commendable.

But this isn't a new idea, there are a lot of pop songs with embedded morse code messages, for example, this Slipknots' song:

[http://en.wikipedia.org/wiki/Before_I_Forget_%28song%29](http://en.wikipedia.org/wiki/Before_I_Forget_%28song%29)

A tutorial:

[http://homepage.ntlworld.com/dmitrismirnov/MorseMusic.html](http://homepage.ntlworld.com/dmitrismirnov/MorseMusic.html)

Anyway, there are more creative methods to insert coded messages in radio shows, for example, some years ago, the italian police confiscated a commercial radio in Naple. That radio was controlled by a mafia family and used to send message to the inmates of Poggioreale prison. They used fake "inscription" related to the songs transmitted:

[http://www.corriere.it/Primo_Piano/Cronache/2007/06_Giugno/1...](http://www.corriere.it/Primo_Piano/Cronache/2007/06_Giugno/12/napoli_radio_camorra.html)

</comment><comment><USER14> I wonder if anyone would've picked it up? You would have to listen to the song over and over. Then figure out morse code and what letter each signal represented.

<comment><USER15> If you know Morse code already it's probably something you can work out in real time in your head.

<comment><USER16> If you know Morse code already, you just hear it.</comment></comment></comment>


How Can Programming Ability Be Used to Help People in Poverty - <AUTHOR> http://programmers.stackexchange.com/questions/47558/how-can-programming-ability-be-used-to-help-people-in-poverty

<comment><USER2> Start a company and create jobs

Edit: Even if you can't hire poor people, you probably will need services from them, like cleaning for your buildings, construction of them, etc. It is more about the implying effects than the direct effects.

<comment><AUTHOR> Hm. I don't mean to start a political argument but I'm not sure I agree with this sentiment. I completely see how starting a company can be justified as helping people by providing jobs. But I don't know how reasonable it is to say that starting a tech company will help impoverished people.</comment></comment>


Why "non-true" wireless earbuds are better than true wireless - <AUTHOR> https://blog.ailon.org/im-switching-back-to-non-true-wireless-earbuds-here-s-why-f8bf4c52b731 <comment><USER2> I would rather just have wired earbuds, period. Wireless is insecure and unreliable; wires are secure and dependable.

The headphone jack is a marvel of engineering!</comment>


A warning to anyone who wants to contribute to OSS - <AUTHOR> http://blog.udby.com/archives/3

<comment><USER2> I am having difficulty reaching your site.</comment>


Found on GitHub: Bomb calendar widget for Android apps - <AUTHOR> https://github.com/CleverPumpkin/CrunchyCalendar <comment><USER2> I'm new to Kotlin and programming in general so I like this libraries that can save your time. Are there other libraries you can share?

</comment><comment><USER3> there's so many calendar libs out there. not many really great options, though, most of the time they lack customization and good maintanance. i see, customization is quite good, hope you'll maintain it and the community adopts your lib, looks nice

<comment><AUTHOR> totally agree. are you working on some android apps right now?

</comment></comment><comment><USER4> once we've made our own calendar for the app. It took us soo long. next time we will use some library for sure. thanks for sharing!

<comment><AUTHOR> haha. we haven't made this mistake. was searching for libraries and decided this one is perfect for android apps.

</comment></comment><comment><USER5> Wow, that is actually gold

<comment><AUTHOR> Agree! I like how it's fully customizable with this Sketch file.</comment></comment>


Physical Unclonable Function - <AUTHOR> https://en.wikipedia.org/wiki/Physical_unclonable_function <comment><USER2> Quantum effect based PUFs using IR lasers would be really neat for things like authentication tags. A provably unclonable key would be incredibly useful, especially if it doesn't need contact.

There's also QKD variants based on mutual access to PUFs, using the PUF as the equivalent to a signing keypair in a key exchange. QKD in general might be pretty redundant, but that particular use would certainly have its niches.

</comment><comment><USER3> I believe credit card chips are examples of PUFs. CC terminals do a challenge- response through the chip in order to verify it, and the only way to pass the challenges would be with a perfect copy of the embedded chip (which is presumably difficult to physically steal). This is why chips+pin is an improvement on the CC swipe: because anybody can steal a magstripe code.

<comment><USER4> Nah, a good example of PUF in that space is that company making stuff that fingerprints the magnetic strips. The manufacturing leaves impurities that vary on a device by device basis. Each has different magnetic properties. Developing a stripe with exact same properties might be quite difficult. Hence, it's a PUF.

Whereas, chips get cloned all the time. Sometimes, they do it down to the transistors.

<comment><USER5> In fact magnetic stripe cards are simply digital data and easily copied (and have been for decades). "Chip and pin" was introduced specifically to combat this, and is indeed an example of an attempt at implementing a PUF.

<comment><USER4> I think you're missing the concept. PUF's are ususlly based on electrical or other physical properties of underlying hardware. For credit cards, the data is stored on a stripe and easy to copy. The stripe itself has certain magnetic properties due to manufacturing variances and impurities that can be fingerprinted. Readers, upon inserting card, both read data and profile stripe itself then send both for authentication. See magnetic topic here:

[https://en.m.wikipedia.org/wiki/Types_of_Physical_unclonable...](https://en.m.wikipedia.org/wiki/Types_of_Physical_unclonable_function)

Survey of other techniques here:

[https://www.google.com/url?sa=t&source=web&rct=j&url=http://...](https://www.google.com/url?sa=t&source=web&rct=j&url=http://digital.csic.es/bitstream/10261/96029/1/Using%2520Physical.pdf&ved=0ahUKEwj_77qK0_3KAhWLuB4KHci6AykQFggnMAE&usg=AFQjCNFnC7vuH1pHCYuWJBpjfCYCJEVlwA&sig2=_tNNuLOacl3QOhb3QP5yUQ)

</comment></comment></comment></comment><comment><USER6> Is it necessary to clone such a device, or would it suffice to implement only the challenge/response pairs stored on the device that sends the challenges and checks the responses?

<comment><USER7> You would need to clone the device, as the possible challenges are infinite as they are mathematically-generated. The scheme would just be a glorified one time pad otherwise.

<comment><USER6> But what can be done with the challenges that uses the "infinite" set of possible challenges instead of a finite subset that has been stored on another device?

In other words, if a fake responds with anything it wants for challenges that aren't stored on the other device (the challenger), how would the challenger know the response didn't match what the real PUF would send?

<comment><USER7> The responses are verified mathematically in a manner akin to a hash function. It's hard to know what the PUF will send, but easy to verify that it actually came from the PUF.

<comment><USER6> Do you have a source? I don't see that detail in the Wikipedia article and didn't find confirmation in a few Google searches.

<comment><USER7> It's right there in the first sentence.

> a physical unclonable function (PUF, sometimes also called physically > unclonable function) is a physical entity that is embodied in a physical > structure and is easy to evaluate but _hard to predict_.

<comment><USER6> I'm not sure "evaluate" means "verify that it actually came from the PUF", though it is one possible interpretation.

<comment><USER7> Think of it like this. Forget that the PUF is a physical device and just consider the "function" part. A function is a piece of math that maps input to output. For example, f(x) = 2x. This function is easy to compute and easy to predict. A hash function is easy to compute but hard to predict.

A function doesn't have to rely on any kind of arithmetic, you can have a random function that simply maps all inputs to random outputs, or something silly like a function that hands its input to a two-year old, who then points out a star in the sky, then an astronomer takes a picture and gives that as a return to the function.

A Physically Unclonable Function is a function baked into hardware in a specific way that, like hash functions, allows computation but resists prediction. The article describes in a general sense how this is accomplished, by making the output of the function rely on impossible-to-replicate physical features of the circuit. Even though the actual output is unpredictable, you can still tell it's from the PUF due to purposefully-added design constraints.

<comment><USER6> I understand the idea, I'm just looking for confirmation - more than one vague, uncited sentence on Wikipedia whose meaning is unclear.

Have you worked with these?

<comment><USER7> There's plenty of references at the bottom, why don't you dive into these yourself instead of asking me to do it for you? I found the article perfectly clear.

<comment><USER6> I ask because you seem to be acting like an expert. Have you based everything you said here solely on your interpretation of the Wiki article?

<comment><USER7> I took an intro to crypto course on Coursera a few years ago.</comment></comment></comment></comment></comment></comment></comment></comment></comment></comment></comment></comment>


Distinguishing Necessary and Sufficient Conditions (philosophy) - <AUTHOR> http://dailymis.com/?p=79

<comment><USER2> Also [http://en.wikipedia.org/wiki/Necessary_and_sufficient_condit...](http://en.wikipedia.org/wiki/Necessary_and_sufficient_conditions)

<comment><AUTHOR> Thank you for reading villageidiot.

I did not mean the post to introduce sufficient and necessary conditions; instead to communicate my methodology. Thought it might be helpful to a few.</comment></comment>


Covid-19 business relief: an overview for startups, consultants, freelancers - <AUTHOR> https://microconf.com/latest/covid-19-business-relief-overview <comment><USER2> If there are any provisions for bootstrappers who haven't pulled a paycheck in 2020.. Let me know. I can't find any.

</comment><comment><USER3> I'm paying most of my team as remote contractors. Seems most of this only applies to W2 employees correct?

<comment><USER4> It sounds like they would be eligible to apply on their own.</comment></comment>


Gamified Visualization of Facebook Privacy (fb app, flash, sorry) - <AUTHOR> http://apps.facebook.com/bigpicturehero

<comment><AUTHOR> This is just out and I'm looking for feedback. It's a slide show with crude, line-drawing visualizations and drag and drop exercises. It doesn't sound sexy, but I hope its Head First-like approach will slip a lot of info your brain.</comment>


Triangle Startup Factory Re-Launches Accelerator; Promises $50K To Each Startup - <AUTHOR> http://techcrunch.com/2012/01/17/triangle-startup-factory-re-launches-accelerator-promises-50k-to-each-founding-team/

<comment><USER2> This is big news for the Triangle! People in the RTP startup community saw how important Launchbox Digital was. I have high hopes for TSF and know Chris Heivly will do a great job.

<comment><AUTHOR> Agreed. Absolutely great for the Triangle.

The surprise part was the promise of an additional $20-$150k in convertible notes. That's going to be huge for startups just starting out after the program.

</comment></comment><comment><USER3> Will companies actually stay in the area after the program?

<comment><USER4> Why wouldn't they? The cost of living here is a lot cheaper than a lot of places, the weather is fairly mild year round, we're relatively close to either the beach or mountains for when you want leisure activities, there's tons of stuff to do here in terms of live music, arts, sports (college sports in particular) etc., and there are lots of well educated, interesting people who come here to attend UNC-CH, Duke, NCSU, NCCU, etc., or to work for some of the major employers in the area.

Honestly, one of the bigger knocks against the Triangle for the "typical HN reader" is the lack of early stage funding / seed capital. And this program is a nice step in the direction of helping with that. If a startup manages to get off the ground initially here, they might as well stay... at that point, they've already conquered the big challenge.</comment></comment>


Show HN: stup – Daily notes in the Terminal - <AUTHOR> https://github.com/iridakos/stup <comment><AUTHOR> The implementation started few weeks ago but due to great contributions it's already on version 0.1.9

The next feature to be added that is on the top of the list is tab completion (bash, zsh) which will allow users to add notes easier and faster.</comment>


Barcelona opera house reopens with performance to 2,292 plants - <AUTHOR> https://edition.cnn.com/style/article/barcelona-opera-plants-scli-intl/index.html <comment><USER2> Kinda similarly, Black Pink did a no-audience, live performance of their new single for the tonight show and had electric candles placed in front of the stage, where you'd expect an audience to be.

[https://m.youtube.com/watch?v=yBZKk- cCv64](https://m.youtube.com/watch?v=yBZKk-cCv64)

</comment><comment><USER3> Seems like a weird gimmick but whatever keeps that government grand money flowing I guess...

<comment> vertex-four Opera houses are designed to sound right when they're packed with people. Singing to an empty opera house will sound wrong to the people listening to a stream or recording, and to the singers which might throw them off.

You could pack the room with some other material, but plants work!

<comment><USER4> Don't plants have different properties from humans?

I can imagine they are better at absorbing high frequencies while humans are probably better at mid ranges.

<comment> vertex-four Honestly, I have absolutely no idea. It's probably better than an empty house no matter what though.</comment></comment></comment></comment>


Mastercard and Visa start banning VPN providers - <AUTHOR> https://torrentfreak.com/mastercard-and-visa-start-banning-vpn-providers-130703/ <comment><USER2> And that is why Bitcoin like stuff is needed. Aren't these companies regulated as common carriers?

</comment><comment><USER3> Anyone have a master list of services affected? Currently building a VPN provider myself, and I run a proxy provider that accepts Visa/Mastercard. Obviously very interested in this. Fuck.

</comment><comment><USER4> This is more about control of information than hindering pirates. This is one volley of a large scale attack.</comment>


Timehop Security Incident, July 4th, 2018 - <AUTHOR> https://www.timehop.com/security <comment><USER2> There are more technical details of the attack here - [https://www.timehop.com/security/technical](https://www.timehop.com/security/technical)

" _On December 19, 2017 an authorized administrative user 's credentials were used by an unauthorized user to log into our Cloud Computing Provider. This unauthorized user created a new administrative user account, and began conducting reconnaissance activities within our Cloud Computing Environment. For the next two days, and on one day in March, 2018, and one day in June, 2018, the unauthorized user logged in again and continued to conduct reconnaissance._"

So someone logged into their Cloud Provider backend using a user/pass, created an admin account, and watched for 6 months before trying database extraction.

Means a few things went wrong:

* First, they had a guessable user/pass or, more likely, it was compromised some other way (social engineering, former employee, or it was in an email account that was itself compromised).

* Second, they had no 2FA on their cloud provider logins. Given that this login allows the creation of admin accounts, that's a pretty big oversight

* Third, they had an account with admin privileges running around for 6 months without anyone noticing. It kept its activity very limited, but a routine audit of all admin accounts would have found the new account. An alert that warned if a new admin account was created would have found it.

So well done to TimeHop for coming forward with such a full and clear explanation, but this was a very preventable attack.

</comment><comment><USER3> Some thoughts:

 _" Once we recognized that there had been a data security incident, Timehop's CEO and COO contacted the Board of Directors and company technical advisors; informed federal law enforcement officials; and retained the services of a cyber security incident response company, a cyber security threat intelligence company; and a crisis communications company."_ \- Good response! Don't try and do everything yourself. Pay someone to handle the important response stuff that you're not an expert on.

 _" We have no evidence that any accounts were accessed without authorization."_ \- Not so good: this just means they didn't _see_ accounts being accessed. It may be more truthful to say "we have no way of knowing that someone did _not_ access them."

<comment><USER4> The "technical information" page says they contacted the social media services those keys were for, and the social media services confirmed the keys hasn't been used by anyone else.

</comment></comment><comment><USER5> The best part of this story is no passwords were compromised. Because Timehop deals with access tokens only, they were able to invalidate those access tokens to eliminate the risk to its users. They basically lost 21m customers by doing that, and props to them for doing the right thing.

Imagine if we still used the "enter your twitter password on our web site so we can look at your data!" anti-pattern. What a mess this would be.

Now if only we could get MFA by default on every service.

<comment><USER6> You don't need to use tokens to not have passwords leaked. Hashing has existed for a very long time.

<comment><USER7> The parent post refers to access credentials held by third parties. Password hashing is of no use here unless Twitter/Facebook/whoever implemented an API that permitted you to submit a hash of the password, which they _could not do_ unless they didn't salt their own hashes (or publicly revealed all the salts, which is effectively the same thing).

</comment></comment></comment><comment><USER8> > The breach occurred because an access credential to our cloud computing > environment was compromised. That cloud computing account had not been > protected by multifactor authentication. We have now taken steps that > include multifactor authentication to secure our authorization and access > controls on all accounts.

Wow. Unbelievable that these companies take security for their prized assets way less seriously than I do. And I have much less at stake comparatively.

<comment><USER9> What is more unbelievable is that the were able to create a new admin account on 17th December, which is the account that was used (from the tech report):

> _On December 19, 2017 an authorized administrative user 's credentials were > used by an unauthorized user to log into our Cloud Computing Provider. This > unauthorized user created a new administrative user account_

They had 6 and a half months to spot this new admin account, and didn't. This is terrible security practice anyway you look at it, and in that context, their statement that "the attacker used an account without MFA" is disingenuous at best.

<comment><USER10> I think they're saying the initial compromised user didn't have MFA, not that the attacker's new account didn't.

But indeed, I almost thought this attacker was pretty competent (given the wait until the holiday) until I saw they made a completely new account and left it there for half a year.

</comment></comment></comment><comment><USER11> > If you used a phone number for login, then Timehop would have had your phone > number. It is recommended that you take additional security precautions with > your cellular provider to ensure that your number cannot be ported.

Curious if related to the spike in "verification code" texts people have been reporting from AT&T et al, c.f. [https://twitter.com/jonrog1/status/1015984756037545984](https://twitter.com/jonrog1/status/1015984756037545984)

</comment><comment><USER12> You gotta appreciate the naming:

> On July 4, 2018, Timehop experienced a network intrusion that led to a > breach of some of your data. We learned of the breach while it was still in > progress, and were able to interrupt it, but data was taken...

> Some data was breached. These include names [...] numbers. This affects some > 21 million of our users.

> To reiterate: none of your "memories" [...] were accessed.

I don't know what TimeHop is or does, but we're not far off from when this will mean something very different.

</comment><comment><AUTHOR> More technical info is at [https://www.timehop.com/security/technical](https://www.timehop.com/security/technical)

</comment><comment><USER13> Is someone compiling a list of these? I'd love a spot to review everything, especially summarizing key "trends" and common attack vectors.

<comment><USER14> Some of the recent attack vectors I can remember:

* An employee account was compromised - usually because they re-use their password and that password was exposed in an unrelated breach. And then failure to require 2 factor authentication for 'internal' accounts - (github organisations, aws, internal administration tools, etc.) \- Timehop, Gentoo

* Failure to patch known vulnerabilities \- Experian

* Running untrusted code client side (Webchat) \- Ticketmaster (although unclear what the vulnerability was that allowed the compromised scripts to be uploaded to Inbenta)

* Unsecured database backups \- Typeform (although it's unclear yet what the original compromise entailed)

* Data left 'accidentally' exposed publicly (no credentials required to access it) \- Exactis

</comment></comment><comment><USER15> As with the Gentoo attack, it seems that proper 2FA might have prevented this from happening. Amazing that people aren't more paranoid about that.

</comment><comment><USER16> Wow they're still around?

<comment><AUTHOR> My dad is very proud of his 600+ day streak checking Timehop.

</comment></comment><comment><USER17> Username + password is a huge attack vector, especially for services where users signup and eventually stop using or forget. I wish there was some obligation to reset password or require some form of MFA for applications that experience no usage on my account (especially if the service typically encourages continuous usage)...

<comment><USER5> What does this have to do with this attack? Timehop does not store any passwords, just access tokens.</comment></comment>


Inside Uber: Math, Money, and Metrics - <AUTHOR> http://venturebeat.com/2011/12/15/uber/ <comment><USER2> I have been using Uber a LOT - several times a week, for work.

I live in an area of SF where it is difficult to get a cab - and was previously banned from a couple cab companies because they would never show up and I would call 3 different companies to get them to pick me up.

FUCK THAT.

I never use any other cab service if I can help it.

I fly in and out of SFO several times a month - a metered cab to/from SFO and my house is $55 not including tip. Uber is flat of $65 - its more professional, includes the tip - already has my CC details and no money exchanges hands. ITS AWESOME.

Plus the drivers are typically really cool, have candies and water bottles in the cars for you.

The only complaint I have about Uber is the receipts.

I want to be able to TAG my ride with information about what project it should be billed to.

I want the little map details that you can see on the uber.com site included in the receipt.

This is the best cab services there is. I have been probably spending ~$400 a month on it - and its totally worth it.

<comment><USER3> If it's just in one city (e.g., SF), I wonder why people don't find a good private car service and save the X% Uber overhead.

I'm as far from SFO as you can get in SF and my Mercedes car service to the airport is $45, and $20 for anywhere within the city.

<comment><USER2> I used to have several black car drivers I would call, for date nights etc. and had similar rates.

With Uber, I have the convenience of the CC handling, the receipts and the power of many more cars available to me than I would if I was only calling one guy, like I used to.

Uber takes 20% of the sale, the car company then splits the 80% remainder at some % level. The last driver I had mentioned that he was trying to hire three more drivers. He has the cars - but has a hard time trying to find drivers.

He said that the drivers can make between 3 and 4 thousand per month. Which is great. I recommended a friend who has a degree in cartography but cant find a job. 4K/month is a great salary for anyone struggling in this economy.

The iphone app is fantastic. Call the car, see it on the map, get a txt when they arrive - or the driver calls if he needs better directions.

You don't get that with a private car.

Although - There is CERTAINLY a market for an open version of the Uber app.

Imagine the open-cab concept - works just like Uber - but drivers register their availability in the app and users make pickup requests just the same. The drivers select the client they are going to get - and the app manages the queues.

Totally doable.

</comment></comment></comment><comment><USER4> It's good that they acknowledge politics, but I'd still be very worried.

The U.S. is more lax than Europe or the South American countries I know in that regard - Uber or AirBnB would have been shut down as soon as they showed up on politicians' and unions' radars.

Software for taxi dispatch works reasonably well, here in Uruguay the main taxi fleet has GPS and a maximum of 3 minutes for showing up.

</comment><comment><USER5> On marketing, the article mentioned...

"This may never be needed, however, as he also points out that they have a "blessed" viral loop of seven: for every seven rides, a new rider is acquired."

What exactly does the last line mean?</comment>


Why Does Time Fly By As You Get Older? - <AUTHOR> http://www.wbur.org/npr/122322542 <comment><USER2> "Put your hand on a hot stove for a minute, and it seems like an hour. Sit with a pretty girl for an hour, and it seems like a minute. THAT'S relativity." - Albert Einstein

</comment><comment><USER3> Maybe this is naive, but the younger you are, the larger the ratio of each unit of time to your total time lived. So each unit of time seems longer.

<comment><USER4> I think its a mix of both, but mostly yours.

When you are 4, turning 5 is another 20-25% of your life. When you're 39, turning 40 is more like .025% of your life.

Perception of time changes because we have more of it to compare it to, making it feel like its accelerating. But that is all relative.

<comment><USER5> You mean 2.5%... or maybe your perception really has accelerated. :)

<comment><USER4> Thats what you get when you divide 1/40 in the calculator and forget to move the decimal over.

</comment></comment></comment></comment><comment><USER6> It seems like the argument presented should be testable using amnesia patients. Assuming that their past memories are erased and that all experiences are "new" and need to be fully encoded, shouldn't science be able to question them to see whether, novelty is in fact linked to our perceived length of time?

</comment><comment><USER7> I think that the hypothesis proposed in this article sounds like it's certainly a part of the effect we feel, but there is likely some support that the percentage of our live thus far that each moment adds up to plays a role in our sense of time passing as well.

Think though, to your novel experiences later in life and how time passed. I can certainly say that even though just recently I left Canada (my home country) for the first time, to go to Mexico, I can recall every second of it, and it did seem to take a long time.

So I would argue memories are encoded based on what is perceived, and I think we perceive what is most important to us at the time. This is often something we are learning; something novel. Routine is not encoded carefully because it is not important to us. We aren't learning anything new when we follow our routines. But when we experience new things, we are learning. The density of the memory at this time gives a prolonged time passage effect I imagine.

There is a similar psychological effect: Think in terms of your closest acquaintances or, better yet, a new love interest. Because you spend so much time with them, getting to know them, you encode a lot of memories that involve them, and so when you are apart for a short period of time, it seems like much longer. This is quite noticeable after a break up, when you're time with someone goes from very high to zero.

Those are some of my thoughts anyhow.

</comment><comment><USER8> because you don't have the same amount of free time as before.

When you are a kid, all you have is a little bit of school. And then most of the day is free to do whatever you want.

When you are an adult, you work from 8 to 6(counting commuting). You come back from work, you don't relax, you go cook yourself dinner. Then you eat your dinner. And have 3 hours of relaxation before you go to sleep and repeat the process. On weekends? You go to home depot, you go through the mail etc.

As a kid, you might have 30 hours of "free" time when you have nothing to do. While as an adult, that number might be 5-6 hours, since you have so many more obligations.

<comment><USER9> The same seems to happen with learning languages, and generally, learning.

It's much harder to learn something drastically new as an adult, as you don't have free time, you perceive a year as a short milestone etc.

</comment></comment><comment><USER10> My personal theory is that the novelty of an experience is not the only factor. I think the notion that time passes slower when you're young is because you didn't have much of it yet. When you're 10, 1 minute compares to your experience: 10 years. Now when you're 30 that same minute is now compared to 3 times more, based on your experience.

</comment><comment><USER11> Many years ago an older friend of mine made a comment whose full truth has become clearer to me as I've grown older.

 _The older you are the faster time goes. The telescoping effect can be quite startling._

<comment><USER12> I think when I reached 30 it occurred to me that, not only is life short, it's shorter than you think.

</comment></comment><comment><USER13> There is a relatively new form of psychology called Acceptance and Commitment Therapy (ACT). It basically marries eastern philosophy and meditation with western science. One thing it does try to do is combat this sensation by living in the moment. In one of my ACT books (written by the founder of the movement), he advocates that as you drive to work you should practice staying in that moment, take it all in, don't let your mind wander. Doing this makes that 20 minute drive feel like 20 minutes.

<comment><USER14> Sounds interesting. But I'm really not interested in having my commute feel any longer than absolutely necessary.

<comment><USER13> It's just an exercise :) But I guess rereading my comment I didn't really make that clear.

</comment></comment></comment><comment><USER15> Some novelties are newer than others. Those you remember best are those that don't fit with your generalizations about the world. As you grow older your generalizations get better and less things surprise you. The more you've seen, the more generalizations you need, because you don't have time to review the whole of your experience everytime you take a decision. The generalizations become a gut feeling, you know how to react but you forget why. The gut feeling makes you more efficient but by unconsciously generalizing from what you perceive you lose sight of the details. If this explanation is correct, there must be ways to reverse the process, at least for some events. Try meditation maybe, or drugs? I haven't. Tell me if it works.

On the other hand it might just be your memory getting worse at recording new things, because your brain gets old and no longer works so well.

Or maybe your brain is becoming more careful about what it records because there's not as much free space as there used to be.

Or maybe your brain is just bored, at first it really loved this shiny new recording thing and played with it the whole day, but then got used to it. Nowadays it only gets it out for the really big occasions.

Anyway, this is really about the pace at which you record informations, and about the amount of informations you discard. I'm sure these questions also arise in algorithms or machine learning. Certainly some knowledgable scientist on this forum is going to point out a parallel with some machine learning algorithm or information processing theorem?

</comment><comment><USER16> I would peg it somewhere in the memory pathways too. Still, generally, when I for example see something for the first time - an ad, say - it feels much longer than it will on any subsequent view.

Then there are the dreams: an immense amount of information, minutes or hours of "dream time" but only seconds to minutes of real time. (For the adventurous: you can actually get to a state where you can experience this while awake by causing yourself severe sleep deprivation which leads to, essentially, waking dreams.)

There is a flipside, too: the slow-motion feel you get in a dangerous situation.

Maybe it is simply that the brain is capable of a higher processing rate than what it usually uses, and it is employed when necessary. Usually in cases of manipulating the memory pathways (including dreaming), but also triggered by survival situations.

</comment><comment><USER17> Slow motion in film seems to approximate this density of memory. Rather than making a moment so memorable that it is drawn out when we think back on it, they can just slow the moment down to begin with.

</comment><comment><USER18> I've wondered if Feynman's counting rate -- <http://calteches.library.caltech.edu/607/2/Feynman.pdf> \-- varied with age.

(tl;dr While a grad student he got interested in this question of subjective time rates and started counting in his head while doing different things. The story doesn't say if he ever tried it again decades later. Unfortunately I don't remember timing myself the first time I read it -- enough time's gone by that I could have looked for a change now.)

</comment><comment><USER19> I think there's a component where the older I get, the easier it is to lose time and suddenly realise hours have passed.

Both because I know more / recognise more things so I have more mental world to wander around in, and also because I work on longer tasks, can concentrate for longer and take more interest in details so am not tripped up and awoken as easily.

</comment><comment><USER20> At least for me, I'm not buying the novelty effect. I have two kids and everyday is not only something new for them, but it's new for me as I watch them grow and as I grapple with parenthood, all of which is filled with unique and novel experiences and feelings. Instead of slowing down time, it feels like time has only sped up even further.

</comment><comment><USER21> It's well-established in the literature that a year feels like it takes (20 square years / {your age in years}) to complete.

<comment><USER22> _(20 square years / {your age in years})_

What is a square year?

</comment></comment><comment><USER23> I think, when you're young you just don't think about time all that much. When you're older, you do.

</comment><comment><USER24> Cause its like a toilet paper roll</comment>


HN: Give it a rest with the CSS debate, please. - <AUTHOR> http://i44.tinypic.com/f3xq1c.jpg

<comment><USER2> It's two links out of 25. Surely you can just refrain from clicking on them?

<comment><USER3> Yeah but there were many more links over the last few days from two different sides of an argument who both have very good points and frankly, it's not adding anything constructive anymore, it's just people jumping on the blog wagon.

I actually took a screenshot of when those two links were right next to each other, wish I had saved it...</comment></comment>