Cheap, Pressure-Sensing 'Electronic Skin' - <AUTHOR> http://spectrum.ieee.org/tech-talk/at-work/test-and-measurement/cheap-pressuresensing-electronic-skin-

<comment><USER2> The supplementary information from the original journal article has some cool videos. Check out video #2 - a beautiful video of a bouncing microdroplet on a superhydrophobic surface

[http://www.nature.com/nmat/journal/vaop/ncurrent/full/nmat33...](http://www.nature.com/nmat/journal/vaop/ncurrent/full/nmat3380.html#supplementary- information)</comment>


You are not your thoughts - <AUTHOR> https://roadlesstravelled.me/2017/02/03/i-think-therefore-i-no-not-thoughts/ <comment><USER2> ""I think therefore I am", the famous phrase uttered by renowned Philosopher Rene Descartes was perhaps one, if not the most, fundamentally flawed philosophical statements of all time (sorry Rene). To assume that I exist and I know that I exist because I think thoughts, sends us off on a dangerous trajectory where we believe that we are our thoughts"

1\. This is a wrong assumption, just because Descartes concludes thinking proves he exits does not mean Descartes believes he is his thoughts.

2\. There is nothing in what Descartes says that is "fundamentally flawed" let alone "perhaps one, if not the most, fundamentally flawed philosophical statements of all time"

<comment><USER3> The problem here is the conflation of consciousness and thought. The existence of an observer is proven by cognizance of thought, but conflating the observer with the thinker is erroneous.

A computer provides a useful analogy here. When I use a computer, I am aware of the output it produces via elements of the interface like the monitor. I also indirectly control what that computer produces as output. That does not mean that _I_ am the computer.

This is basically just what buddhists and hindus have been saying about the nature of consciousness for thousands of years.</comment></comment>


Former ICANN Chairman sets up company to profit off gTLD's - <AUTHOR> http://www.mindsandmachines.com/about/

<comment><AUTHOR> Specifically:

"Prior to joining Minds + Machines, Peter was the was Chairman of the Board of Directors of ICANN, and in that role managed the process that resulted in the historic decision to launch the new gTLD program in June 2011"</comment>


Can trees grow inside humans? - <AUTHOR> http://www.thomas-morris.uk/trees-do-not-grow-in-humans/ <comment><USER2> I once ate a watermelon seed and then 20 years later i have a paunch belly and am bad at sports. Coincidence? I think not!</comment>


Starting a Business in Silicon Valley - <AUTHOR> http://www.tlalexander.com/business/ <comment><USER2> These articles are always a guilty pleasure, because all of us reading them can point out countless mistakes the author made that we, of course, would never make. All the time failing to consider that we would simply make _different_ mistakes.

<comment><USER3> I like this tweet from Zach Holman [1]:

1\. Try something new

2\. Read all the advice from experts

3\. Nod and say "sure, no problem"

4\. Make all the mistakes anyway

5\. Finally understand for yourself what that advice really meant

6\. Advise beginners not to do that thing

7\. Repeat

\---

I've had that experience more than once.

* "Don't remove the credit card field from your sign up form."

* Hmm, but what if I remove the credit card field from my sign up form?

* Conversions went down

[1] [https://twitter.com/holman/status/990311600451076096](https://twitter.com/holman/status/990311600451076096)

<comment><USER4> LOL...Substitute "parents" for "experts" in 2 and your comment is an observation of youth growing up. I think it's a human condition.

</comment></comment></comment><comment><USER5> > I'd later learn from some hardware experts that you really want to price > goods like mine around 5x the cost to manufacture.

This. If you're doing hardware, your price needs to be _minimum_ 3x-5x the COGS.

If you think you're going to win some market by pricing with lower margins, like 1.5x-2x, you're setting yourself up for failure.

Interestingly, the same rule holds for restaurants: food input costs should be no more than 20-30% of the meal price.

<comment><USER6> I'm kinda curious where the rest all goes. Seems like there's a market opportunity to streamline operations & improve efficiency if 80% of the purchase price of a product goes into things that are not the product.

<comment><USER7> 5x the cost to manufacture, which would not include product development, not to mention sales, failed products, cost of returns or fixing defects, office rent, testing, certification, support, and on and on and on.

There is a market opportunity and many people capitalize on it. Amazon is full of things like this. Generic items or barely designed items with your brand stuck on them, built by somebody found on Alibaba and shipped to the consumer. They're fantastically cheap, the margins are much thinner, and the products range from adequate to terrible.

It's terribly difficult to build a high quality product people will want for many years (no new design costs) which you don't have to market or do anything with and can just manufacture and sell for a tiny profit. When it is done you'll usually find it as a small very specialized family type business which hasn't sold out yet.

<comment><USER8> But still, most of those things are one time costs: product development, failed products, fixing defects, certification. once you have completed those things, you can keep selling the successful product for decades right? especially now that the pace of innovation is slowing down. I mean just look at the clothing industry: a t-shirt today is the same as it was 10 or 50 years ago, right?

I would imagine things are super high tech and new, would need some iteration in their first 5 to 10 years, but after that, I don't know.

the costs that scale with each good sold is: Support, cost of returns, Sales, marketing, etc.

<comment><USER7> Name something built by a hardware startup in the recent past or imaginable future which would be designed once and built for 10 and 50 years exactly the same.

<comment><USER9> Jenkins valves. Same cast iron gate valves for a century.

Ad from 1924.[1]

Current product brochure.[2]

Jenkins used to advertise that one from a 19th century water main had been removed because the line was being re-routed by a water utility. The valve was cleaned up and put on display, and after a while, when everybody was tired of looking at it, it was put back into inventory and went back into the ground, probably to serve another 100 years.

[1] [https://s.ecrater.com/stores/260372/5725ed67b3cab_260372b.jp...](https://s.ecrater.com/stores/260372/5725ed67b3cab_260372b.jpg)

[2] [http://www.cranecpe.com/chem-energy/products/valves/gate- val...](http://www.cranecpe.com/chem-energy/products/valves/gate-valves)

<comment><USER10>
      recent past

      1924

I think you may've skipped a step.

<comment><USER11> It also says that will be built almost the exact same for the next 10 to 50 years. In this case I would consider recent past everything going back to around the start of the 20th century.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER12> The difference between the ancient way of working a lifetime for a salary, perks and a gold watch on retirement and the new one of building a breakout company in tech lies in a wholly changed business environment by which super- talented founders with a business sense can draw on a depth of knowledge/expertise (typically gained from work experience in a demanding tech environment) to conceive of a solid business model to profitably disrupt existing enterprises and thereafter apply grit, good sense, unbelievable perseverance, and basic street smarts to execute on that model via a startup world that affords amazing access to capital, an ultra-connected network of technically savvy persons with whom one can potentially ally, and a huge reservoir of resources by which founders can educate themselves to learn, grow, and develop.

One might sum this up by saying "Silicon Valley" but it really is most anywhere in the modern world where any modicum of freedom prevails, though Silicon Valley still offers unique advantages in my view.

The odds of failing are still stunningly high and those who make it to success are often bloodied by the process but the door is open today in a way it never has been before.

Another way of saying this is that, in the founder/investor partnering that is typically necessary to succeed, no arrangement was even possible for all but a rare few in mom/dad's ancient days, a reasonable arrangement that skewed heavily toward investors was possible just 20 years ago, and an even more reasonable one with founders and investors in near parity (when the founders are strong) is readily achievable today.

I actually don't believe that the story told in this blog post conveys a typical situation but what I have just said does so based on my having worked in depth in this world since the mid-1980s.

<comment><USER13> > The difference between the ancient way of working a lifetime for a salary, > perks and a gold watch on retirement and the new one of building a breakout > company in tech lies in a wholly changed business environment by which > super-talented founders with a business sense can draw on a depth of > knowledge/expertise (typically gained from work experience in a demanding > tech environment) to conceive of a solid business model to profitably > disrupt existing enterprises and thereafter apply grit, good sense, > unbelievable perseverance, and basic street smarts to execute on that model > via a startup world that affords amazing access to capital, an ultra- > connected network of technically savvy persons with whom one can potentially > ally, and a huge reservoir of resources by which founders can educate > themselves to learn, grow, and develop.

The length and structure of this sentence obfuscates its meaning.

<comment><USER14> After several minutes I was able to read it in full... and lots of reading and back-tracing.

He says our business model is "wholly-changed" and now founders need to be super-talented and a long list of other things in order to succeed in the modern world.

I would argue that founders have always needed incredible smarts and a good product/market fit to succeed. I don't think anyone would claim that the "titans" of industry (think Rockefeller, John Jacob Astor) didn't have street smarts, grit, and perseverance.

> _affords amazing access to capital, an ultra-connected network of > technically savvy persons with whom one can potentially ally, and a huge > reservoir of resources by which founders can educate themselves to learn, > grow, and develop_

For sure, there's more resources (cheaply) available than ever before.

IMO, this should all add up to make it easier to start a business and succeed. Maybe that's what he wanted to say.

</comment></comment></comment><comment><USER15> Oh wow I didn't expect this to get posted yet! There is also a video of this lecture, which I've now added a link to in the article.

[https://youtu.be/huOzokY_fME](https://youtu.be/huOzokY_fME)

It's part of a series of lectures I delivered are African Leadership University in March. Please check out the playlist here below. I just finished editing these videos last night! [https://www.youtube.com/playlist?list=PLP0dfLFk- anezfZZMB4Dh...](https://www.youtube.com/playlist?list=PLP0dfLFk- anezfZZMB4Dh-78x_6zVsxIm)

<comment> gurpreet- Wow this is was truly an amazing piece to read. I have a few questions:

1) How did you manage to keep working even after you realised you were $85k in debt after 2 years?

2) What drove you further into investing into the business after that point? Sheer motivation?

3) How did you stay sane throughout all this?

</comment></comment><comment><USER16> I'd like to see a essay about starting a business outside the SV. Maybe even outside a startup hippie communities in general.

* no investors interested in pre-seed phase - they all say that you should call them when you are already profitable

* nobody interested in being cofounder - cold cash only

* clients saying that they like your MVP - but you unknown, so they won't buy the product anyway

I don't mean that in SV things are magically happening on its own, but sometimes I have an impression that anywhere else you have to be twice as bold and twice as careful to get 1/10th of a result... Yet they are written in a way that suggest that you can easily reproduce SV results everywhere.

<comment><USER17> Check out the MicroConf community - [https://www.microconf.com/](https://www.microconf.com/)

Read the The E-Myth Revisited (80's classic)

Check out MIT's Bill Aulet's Disciplined Entrepreneurship: 24 Steps to a Successful Startup & accompanying workbook.

</comment></comment><comment><USER9> _" I knew at that moment I wanted to run my own robotics company. I have been hell bent on it ever since."_

Robotics is a tough business. The problems tend to be way underestimated. Even by the big names, like John McCarthy and Vic Scheinman. There is progress, but it's slow. I've done some stuff there myself, but never made money off it, although I sold some technology off to the game industry.

Linear motors have never made it big. They exist, but they're a tiny niche and cost too much. I once was very interested in Aura, which made the electrical equivalent of a hydraulic cylinder, but they went off into strange directions, first subwoofers for gamers (the Aura Interactor), then some financial mess.

If you're building RF stuff, as this guy was, the test gear you need is quite expensive. More expensive than what you need to build the product. Big problem for startups.

This guy seems to have failed to research the history of the fields he was in. That's important in technically hard areas. Otherwise you repeat old mistakes.

<comment><USER15> Well I did have the help of Silicon Valley's most talented RF guy, who had met me and agreed to lend me his time and lab to help test my product. I never could have gotten this off the ground without him. Even if I got things working with my first layout, I'd never have been able to solve the manufacturing problem I had when the fab house swapped the RF crystal for 5 different clones.

I am forever indebted to Earl McCune for his help: [http://wirelessandhighspeed.com/](http://wirelessandhighspeed.com/)

I did get a functional RF design that passed FCC testing, but the fear of regulations around RF sunk me. I read the specifications for wireless in the US, EU, Australia and New Zealand and designed a frequency hopping wireless protocol that I believe satisfied all three regions rules. The protocol supported operating in the 902-928 MHz band, 915-928 MHz band, and the 865-870 MHz band with pseudorandom channel schedules picked as a hash of the network name.

But damn it was a lot of work. And then I found out about how the FCC also issues directives that maybe count as law too, so it's not just part 15 you have to comply to...

I suppose that could be called a lack of research. I saw it as naïveté and optimism, which might be the same thing. I learn everything else by doing so that was my plan for learning to run a business. I can't research everything so I just dive in and see what happens. I was desperate to do something.

As far as the linear motors, they were specifically sex toys. The linear motors worked, but only at the prototype stage and they needed better electronics and software to work at the desired speed and smoothness the application would require. Here's some videos I have not posted publicly, but have thought I should share (safe for work):

[https://youtu.be/Fm8lxtqEPk8](https://youtu.be/Fm8lxtqEPk8) [https://youtu.be/H3qLlZ6cJho](https://youtu.be/H3qLlZ6cJho)

See the mildly NSFW web page: [http://www.mobiusadult.com/investors.html](http://www.mobiusadult.com/investors.html)

And SFW images of the device hardware: [http://www.tlalexander.com/content/images/2016/12/IMG_7219_p...](http://www.tlalexander.com/content/images/2016/12/IMG_7219_phixr_sm.jpg) [http://www.tlalexander.com/content/images/2016/12/IMG_7185_s...](http://www.tlalexander.com/content/images/2016/12/IMG_7185_sm.JPG) [http://www.tlalexander.com/content/images/2016/12/robots_sm....](http://www.tlalexander.com/content/images/2016/12/robots_sm.jpg)

<comment><USER18> That is an incredibly large amount of engineering effort to compete with plain old vibrators, and also appears to misunderstand the target market.

Was your BOM cost 100x higher than the competition, or only 10x higher?

<comment><USER15> As a small business I was trying to compete with awkward or overly expensive "sex machines" for the niche kink market. Our closest competitor sold for $2k, and my bom cost was $200, so hopefully 2x-5x lower BOM cost than the competitor.

<comment><USER18> If you're trying to start a real business, your competitors are mass market sex toys with a $2 BOM cost, not one-off dildo-sawzalls pieced together in someone's garage.

<comment><USER15> I strongly disagree. Thrusting sex machines are not competing with a $2 vibrator. The goal is not to orgasm but to have an experience worth having, and thrusting sex machines provide a vastly different experience from a vibrator. The competition I describe was a functioning small business and not a sawzall. Honestly your comment seems super dismissive to me, and I don't really understand the vitriol after I've shared honestly my experience for all to benefit from.

I wasn't trying to start a billion dollar business. I was the only employee and I wanted to make enough to support myself while making a fun product. Unfortunately the product was too complex for me to do it myself, especially at that skill level.

</comment></comment></comment></comment></comment></comment><comment><USER19> This is the kind of stories we need in the valley. This more than any other story gives you a the sense of anxiety that goes with each phase of building, marketing and launching a product.

Thank you for sharing!

<comment><USER15> Thank you for the kind words! :)

</comment></comment><comment><USER20> _" I lost $100,000 over five years on my first halfway successful venture."_

Real World MBA.

<comment><USER15> That's what I tell myself!

</comment></comment><comment><USER21> Yeah, that's the experience of working on a hardware startup. The amount of anxiety is unreal. Great writeup, with a rawness that most people don't get in these retrospective pieces.

<comment><USER14> Does shipping 20 packages a weekend sound kind of low for a pre-manufactured product?

<comment><USER15> It's low. Remember that at this point, I was well past burn-out. I'd burnt out two years earlier and was still going. I worked a full time day job and had been doing this all by myself for years. I was tired of working on it, and sure as hell wasn't going to work 7 days a week for the Nth year. That meant I spent part of the weekend trying to live my life. It was a miserable balance and my productivity was super low. Nothing like what it would be if this was my day job.

<comment><USER22> Great article and appreciate the transparency/honesty.

FYI the link in your profile (www.reboot.love) isn't working - outdated?

<comment><USER15> Thank you for the kind words and for the tip! I forgot about that, but you reminded me that my server is not configured properly and the links should say [http://reboot.love](http://reboot.love)

I've updated my profile and I'll have to fix my server!

</comment></comment></comment></comment></comment><comment><USER23> "I found that the manufacturer did not use the part I specified, but something else." \- Everyone who works with manufacturers needs to watch out for this, especially if they're in the East.

I knew a small scale bicycle manufacturer and he worked with a well known & respected bicycle manufacturer in Taiwan. Even then he'd only get his bikes produced while he or someone else was on site as otherwise they swapped parts, or worse, change the alloy mix in the metals to something cheaper but a lot weaker.

</comment><comment><USER24> What a brutally raw narrative. Thank you for sharing! Things I never would have thought about.

<comment><USER15> :) Thank you! I'm glad my story is appreciated.

</comment></comment><comment><USER25> This was frustrating to read. He describes the romanticized notions promoted by silicon valley similarly to "making it" in Hollywood or as a singer. There, people waited tables and were peniless but at least they didn't borrow huge sums from their parents who borrowed against their home, and then said it was a huge success when they ended up in the red. Not to mention all the drinking drugs and stress.

In the end, the guy got crowdfunded, and his girlfriend helped him a lot. They could have done that from anyplace, living near his parents, and gotten married.

</comment><comment><USER26> I'd like to see more content like this. Find it 100x more helpful than the success stories. Karenina principle and whatnot. Would gladly subscribe and pay buku bucks for a more rigorous startupgraveyard-esque page. And would gladly contribute as well..

</comment><comment><USER27> Where to eat, University Ave PA:

\- Cafe 220 $

\- Oren's Hummus $$

\- Crepevine $$

\- Il Fornaio $$$

\- Coupa Cafe $$

\- Local 271 $$

\- Sprout $$

\- Madera $$$$ (Sand Hill Rd)

Man-bod approved.</comment>


How One Sickle Cell Mutation Helped Protect the World from Malaria - <AUTHOR> https://www.nytimes.com/2018/03/08/health/sickle-cell-mutation.html <comment><USER2> It turns out that if you want to correct sickle cell disease, you (just) have to revert the single the bit of genetic instruction that permits hemoglobin proteins to atomically interlock like legos. The aggregation only occurs when the protein structures are well-suited to aggregation. A single atomic 'feature' on the protein is the difference between a protein that aggregates easily and one that does not.

 _Further_ , there is actually a separate mutation to the hemoglobin protein that actively disrupts the interlocking of even those hemoglobins that would otherwise do so. So the presence of an additional atomic feature or bump on the protein actually inhibits aggregation when intermixed with proteins that would otherwise aggregate.

Companies [1] are right now developing gene therapies [2] that introduce that 'upgraded' version of hemoglobin in patients. The upgraded hemoglobin has a mutation from a threonine to a glutamine at position 87 of wild-type human hemoglobin: [https://serotiny.bio/notes/proteins/hbb/](https://serotiny.bio/notes/proteins/hbb/)

[1] [https://www.bluebirdbio.com/our-focus/severe- diseases/](https://www.bluebirdbio.com/our-focus/severe-diseases/)

[2] [http://www.nejm.org/doi/full/10.1056/NEJMoa1609677?query=fea...](http://www.nejm.org/doi/full/10.1056/NEJMoa1609677?query=featured_home&)

<comment><USER3> Hemoglobin is an interesting molecule. There are a lot of variations, and even the 'bad' variations aren't always 'bad' for everyone. I believe there is a significant portion of those with homozygous sickle cell trait (meaning they ought to have full on sickle cell anemia) who don't show any symptoms. I have thalassemia (a similar hemoglobinopathy), but I also carry the hereditary persistence of fetal hemoglobin (I basically have baby blood), which means -- if i were to have sickle cell anemia -- it wouldn't affect me as much, and my anemia symptoms from the thalassemia are greatly lessened.

There's a ton of other variations that can ameliorate all these things too. That's just my knowledge on one. In fact, for those with full-on thalassemia (or sickle cell too), they frequently give hydroxyurea, which causes the bone marrow to produce fetal hemoglobin, to aleve the anemia symptoms.

It's all very interesting

</comment></comment><comment><USER4> _Some West Africans captured in the slave trade brought the sickle cell mutation to the Americas. But in places like the United States, where malaria was uncommon or nonexistent, the mutation offered less of an evolutionary advantage. As a result, African-Americans have a lower rate of sickle cell anemia than Africans today._

I can't beleive how wrong the journalist got this paragraph. The whole reason for the African slave trade was Malaria as the European "slaves" (poor indentured workers) could not survive in the US south because of Malaria which was very common until the 20th C. Also the reason the rate of Sickle Cell is lower is USA is there has been a significant amount of European geneflow (~30%) into the African American population.

I should add that while the selection pressure has been lower in the USA, this has not been the major reason for the lower rate.

<comment><USER5> I agree with you, clearly the writer has got his science mixed up.

<comment><USER6> But aren't you describing a statistical side effect? It's not as though this mutation imparts a 100% chance of having sickle cell anemia. If 87.5% (carriers and non carriers) survive significantly longer due to malaria resistance and 12.5% lack that extended lifespan due to anemia, isn't it still an advantage overall?

<comment><USER5> deleted

<comment><USER6> What I'm saying is even if it was 100% infant mortality, the statistical odds of getting it still leaves the malarial resistance as a genetic advantage.

<comment><USER5> Sorry. I don't get your point.

Assuming 100% mortality, how could there possibly be an advantage if the genes of the afflicted cannot be propagated ?

<comment><AUTHOR> People who have sickle cell anemia still have a life expectancy of years (>40 in US). On the other hand, getting malaria usually means you mortality is measured in days not years. Everyone has a "100% mortality" but the window of survival differs between diseases.

</comment></comment></comment></comment></comment></comment></comment><comment><USER7> This is another blood mutation that spread across Europe because it can protect from malaria: [https://en.wikipedia.org/wiki/Beta_thalassemia](https://en.wikipedia.org/wiki/Beta_thalassemia)

It's another example of odd evolution, people with Thalassemia minor were able to survive malaria, and because they were able to remain alive, they spread their genes, increasing the pool of people with Thalassemia

<comment><USER7> This blood mutation is so common in Sardinia, that 20% of the population is a carrier [https://www.ncbi.nlm.nih.gov/pmc/articles/PMC1013759/](https://www.ncbi.nlm.nih.gov/pmc/articles/PMC1013759/)</comment></comment>


Bucky Ball Founder being held personally responsible for recall - <AUTHOR> http://www.forbes.com/sites/michaelfertik/2013/11/13/buckyball-busting-is-bad-for-business-3/

<comment><USER2> This is fucking ridiculous. We should just ban everything kids could ever swallow, misuse, or touch. Is that not the precedent being set here?</comment>


Augmented Reality Twitter App Looks Awesome. Hope Apple Thinks So Too.  - <AUTHOR> http://www.techcrunch.com/2009/07/20/augmented-reality-twitter-app-looks-awesome-hope-apple-thinks-so-too/ <comment><USER2> This is kinda cool, but do you have to be following everyone that appears in on the screen?</comment>


Ask HN: Edit vs Delete - <AUTHOR>

You've just written a dumb comment. Someone has taken the time to point it out (downmods included), and you realise the comment is stupid.
What do you do now? Edit the post and put in an apology? Delete the post and through silence deny it every existed?
Perhaps I'm cynical, but isn't deleting incentivised? Fewer people will read the comment, you will obtain fewer downmods, and it's likely only your responder will remember what you wrote.
But isn't it more honorific (grabbing for a word there) to man up and apologise, even within the allowed delete time frame? <comment><USER2> What a ridiculous question. You, sir, are a moron.

Edit: I suppose I got a bit carried away there. Please accept my sincerest apologies. What I meant to say was that this is exactly the kind of insightful question I love to see on this forum. Huzzah!

Edit: Where's the delete button?

Edit: Shit! Fuck! Ass!

Edit: Again, my deepest apologies.

<comment><USER3> Well done, sir.

</comment></comment><comment><USER4> You've hit upon a good point. Personally, I think it needs to be left up to individual conscience. Why? In times past, you'd say something to someone and that would be the end of it. Sure, maybe it'd be repeated as hearsay, but people don't put such stock in that and you can deny it. Now, we're all going around with histories following us. If that's the case, we'll all become lame. None of us want certain crap out there. Maybe we shouldn't have said it, but if you take a hard stance on that, it just means people will be lame. They'll be hesitant to post, they won't be at all controversial, etc.

HN people generally have a good attitude and post cool stuff. It's a great community. I'd rather people retain the right to deny a bit of what they've posted than loose some of the awesome posts. Plus, maybe the delete function stops stuff from becoming flame wars with people deleting rather than continually fighting. I don't know.

</comment><comment><USER5> I'd just leave it. I left quite a bit of silly comments, but as the volume of stupidity scattered across the internet increases, the awareness of my thoughts does too. It helps me learn to develop my own viewpoint and respect those of others. If anything, leaving it up will show other people alternate opinions and will potentially allow others to learn from your mistakes.

edit: I edit mostly to add information that I forgot to add when posting rather than modify the existing post. And I love how wonderfully reflexive this comment is!

</comment><comment><USER6> Honourable. Honorific doesn't mean what you think it does.

<comment><AUTHOR> Thanks. Will remember for future usage.

</comment></comment><comment><USER7> I usually leave my stupid comments for all to see. If I intend to take credit for my good posts I should be man enough to do the same to the stupid ones.

Probably makes me look like a fool every now and then, but oh well that's not so different from life in general :-)

I don't mind admitting I'm wrong either.

</comment><comment><USER8> If I ran HN I would remove the delete button and keep the edit, but I would keep a record of changes so that users could look back through the edits made to a comment (a simple diff would do).</comment>


SEC announces 'Cyber Unit' - <AUTHOR> https://www.sec.gov/news/press-release/2017-176 <comment><USER2> The organizational structure of many US government organizations still seems strange to me.

The DHS's restructure after 9/11 seemed to make sense (from my viewpoint as an outsider) even if it looks like they outsourced the branding of it to the 3rd Reich.

The Secret Service has dual roles of protection of certain officials and their families and investigating financial crimes. I understand the Secret Service's history as a sub-department of the Department of the Treasury made sense, but it still seems weird to have two very different, yet very specialized roles.

And then there's this weird new requirement that very many US Government departments have their own tactical officer squads. Can't we just have a National Police (a merged FBI, US Marshals, etc)? The current silo system reeks of each silo budget hoarding.

All of this to say: The SEC now needs to compete with the other branches of government to hire the best InfoSec people at a time when companies are investing more in the same space. If only the NSA was more focused on defending our government's systems, we could free up other government resources to work on the non-redundant functions.

<comment><USER3> One criticism of having a centralized national police force, a common feature in developing countries, is it makes corruption easier and more attractive. In a sense you've also centralized corruption and given it just as many efficiencies. That being said I don't have a full solution to this issue, just a quick point from the other side.

EDIT: I think a while ago (2-3 years maybe) it came out that the EPA had their own SWAT team, which seemed pretty funny.

<comment> semi-extrinsic Apart from the US, what industrialised countries don't have a centralized national police force?

<comment><USER4> The French have their national Police and also 'Gendarmes' which are like police, but I think a branch of the Armed forces.

I'm not so sure of the history, but it's not so crazy that there are 'two' so long as roles are clear etc..

Nation states are funny things. They change slowly :)

One thing is for certain: there should be more control over who gets to be a 'cop' and the training and ultimate badge authority should be centralized at least at the state level.

This idea of 'Universities' hiring their own cops ... with authority to arrest ... who is in charge of them exactly?

I mean, in France they have 'two systems' but as far as I remember that covers _everything_ and there are only 2 kinds of police uniforms that I ever saw. If there is one goofball cop/gendarme, his case will go pretty high up. Not to the 'dean' of the local college or whatever. Or to 'an elected guy' from some village.

<comment><USER5> University cops, assuming we are talking about those that are actual police departments, are authorized by their respective states to perform that duty. It operates similarly to any other police department, which means they have the rights and responsibilities of any other police officer. In my state, they are also required to have a public oversight committee with elected representatives, and I assume this is not uncommon in other states.

In most, and perhaps all, states, there are state-level commissions to handle cases of problem cops. However, I will be the first to admit that they don't always work as intended.

<comment><USER6> They do also have their own kangaroo courts that lack due process for some unexplained reason though: [https://www.washingtonpost.com/news/volokh- conspiracy/wp/201...](https://www.washingtonpost.com/news/volokh- conspiracy/wp/2017/01/30/the-dangers-of-gutting-due-process-in-campus-sexual- assault-cases/?utm_term=.c4770734e241)

<comment><USER7> I'm not sure there's going to ever be a good happy ground on sexual assault cases that'll please everyone, just due to the nature of the crime. Ultimately a lot of the cases are going to boil down to a he said she said even with evidence that something actually happened. Given all that though there were definitely big issues with how cases were handled before though, as a reaction there's been perhaps an over correction.

</comment></comment></comment></comment></comment></comment></comment><comment><AUTHOR> Interesting bullet points include:

'false information spread through electronic and social media'

'violations involving distributed ledger technology and initial coin offerings'

<comment><USER2> > 'false information spread through electronic and social media'

I was about to make a "Ministry of Truth" kind of comment until I re-checked the article: "Market manipulation schemes involving false information spread through electronic and social media"

<comment><AUTHOR> yeah I should have included the full context, but I think it could end up being a gray line. It's something to keep an eye on because the difference between market manipulation and trolling/FUD could be hard to distinguish.

<comment><USER8> > but I think it could end up being a gray line.

The SEC can and does monitor social media, correlate it to trade data, and takes action based on that data.

[http://nypost.com/2017/09/07/ex-amazon-employee-pleads- guilt...](http://nypost.com/2017/09/07/ex-amazon-employee-pleads-guilty-on- insider-trading-charges/)

Credit to Matt Levine's Money Stuff Bloomberg article where I originally read about this, but cannot find the article with a bit of Google searching.

</comment></comment></comment></comment><comment><USER9> Off topic but the word/prefix "cyber" is so cool. I wish it was used more, like the "e-" prefix for internet applications.

<comment><USER10> Cyber is short for cybersex in some minds which makes official statements and words sound funny.

Was just thinking about how cool it must be for Gibson to have pulled a term like cyberspace out of his head years ago and for it to be such a widely used term now.

Edit, found video interview... [https://youtu.be/ae3z7Oe3XF4](https://youtu.be/ae3z7Oe3XF4)

<comment><USER11> What? I was not aware that cyber is short for cybersex. That's strange. I thought cybersecurity, cyberspace, cyberpunk are what most people would imagine if they hear "cyber". When I hear "cyber" the mental image I get is some sort of a scene from Matrix where Neo plugs a wire into his brain and goes into virtual world.

<comment><USER10> Cyber is an adjective essentially meaning computer. It is well known from the word cybernetics and later cyberspace. However I was pointing out that it used to be common to use the word "cyber" in phrases in place of cybersex like "want to cyber?". Maybe it was just a late-90/eary-2000s thing.

<comment> vertex-four It's mostly been replaced by RP ("roleplay") or ERP ("erotic roleplay"), the latter of which can make business process discussions interesting.

</comment></comment></comment></comment></comment><comment><USER12> Should I take this to mean that cryptocurrencies are all scams that demand SEC intervention, or that cryptocurrencies are legitimate and here to stay?

<comment><USER13> Most crypto _currencies_ are regulated by the CFTC instead of the SEC, but DACs/DAOs and ICOs are within the SEC's remit. They recently announced a crackdown on some but not all ICOs: [https://www.sec.gov/oiea/investor-alerts- and-bulletins/ib_co...](https://www.sec.gov/oiea/investor-alerts-and- bulletins/ib_coinofferings)

</comment></comment><comment><USER14> So not that I am looking but where do I submit my application to this new division...Actually scratch that: "I am happy to announce my new security consulting firm to aid the SEC Cyber Unit called joshing.io"

</comment><comment><USER15> Whatever happened to the Cybersecurity Act (also called CISA) surveillance- bill-in-disguise championed so heavily by Dianne Feinstein and Obama that was supposed to help the NSA protect American individuals and companies against data breaches?

This is why any such legislation needs to come with annual reviews. If it doesn't work as expected after a few years, then it should be repealed.

But of course many of us know that the law was not about cybersecurity at all, despite its misleading name, but about allowing the NSA more direct access to companies' data.

</comment><comment><USER16> Its 2017 and they are just thinking about this after their embarrassing failure. Asleep at the wheel

<comment><USER17> This is the EDGAR system that was breached: [https://www.edgarfiling.sec.gov/Welcome/EDGARLogin.htm](https://www.edgarfiling.sec.gov/Welcome/EDGARLogin.htm)

Up until two years ago, that page used to recommend a minimum browser of either IE 5 or Netscape Navigator 3. If you look at the source and use of 'htm' extension, all signals point towards it being created using an extremely old version of Microsoft FrontPage (2000?). And that's not particularly uncommon on the government systems for unsexy tasks like filing regulatory reports. Limited IT staff and budget, paired with an unimaginable amount of red tape, lead to this type of breach. Also good InfoSec talent usually doesn't stay at the Federal space long. Anyone with strong skills within 50mi of the beltway can make $25k+ more per year by going private sector. Finally, let's not forget a much more limited talent pool is available because, in many situations, these jobs require you to be a U.S. citizen.

I would argue that the SEC breach is only a symptom of a much more systemic problem with IT at the Federal level. To fix it will be extremely costly and painful. To do nothing will be extremely costly and painful.

<comment><USER2> > To fix it will be extremely costly and painful.

The last few years of the Obama administration, the White House proposed budget included an interesting and useful (IMHO) line item to address this. The gist of it was that any department could draw up a plan to take a loan against their future budgets to pay down IT efficiency projects (including streamlining of processes and improvements to cybersecurity posture). I doubt a Republican Congress would go for larger federal spending now for future savings, but I hope that all "government should be small and efficient" advocates would give this kind of proposal serious thought.

</comment></comment></comment><comment><USER18> Violations OF WHAT? Where are the rules for ICOs so far?

</comment><comment><USER19> The SEC is a dept with teeth. I expect the SEC Cyber Unit to catch many an internet scammer, likely to be more effective than regular law enforcement.

This is good news for your average citizen, and bad news for financial criminals.

<comment><USER20> Based on the press release, this really seems to be focused specifically on cybercrimes related to taking advantage of stock markets, such as stealing non-public trading information or using exploits in trading software to trigger market fluctuations and profiting from it. I really doubt this SEC "Cyber Unit" is going to have anything to do with stopping your average phishing scam or even stealing things like SSNs.

<comment><USER21> Well no, they wouldn't do those things. They are concerned primarily with securities.

</comment></comment></comment><comment><USER22> Can't continue to have an inflation tax (our government outspends what it takes in year after year after year) if the population moves to cryptocurrencies.

<comment><USER23> How do cryptocurrencies prevent the government from borrowing?

<comment><USER22> It doesn't. But using non fiat currencies prevents value from being extracted from your dollars value. A 6 nuclear aircraft carrier armada and hundreds of military bases across the earth isn't free.</comment></comment></comment>


XNU kernel heap overflow due to bad bounds checking in MPTCP - <AUTHOR> https://bugs.chromium.org/p/project-zero/issues/detail?id=1558 <comment><USER2> I don't see how C will ever be free of buffer overflow bugs without language changes. Probably the simplest and most effective would be to not have arrays decay to pointers when passing to a function.

[https://www.digitalmars.com/articles/b44.html](https://www.digitalmars.com/articles/b44.html)

<comment><USER3> Rust-style lifetimes. The work by deallocing when the lifetime goes out of scope. No more memory leaks from non-reference-counted stack pointers (heap allocs).

Or: use Rust.

<comment><USER4> Rust lifetimes prevent use-after-frees, but they're totally orthogonal to buffer overflows. Rust mitigates buffer overflows by automatically inserting bounds checks and panicking on out-of-bounds access. Your program still crashes, but you don't potentially open yourself to RCE.

Ultimately Rust's automatic bounds checks rely on higher level facilities in the language for dealing with slices that C just doesn't have.

<comment><USER5> Rust has more than just bounds-checks.

Rust heavily encourages the use of iterators and functional-programming both of which prevent buffer overflows by making code that could overflow less idiomatic.

<comment><USER6> This can also be provided by C++ by .at() or iteration through containers.

<comment><USER7> If we're talking about switching to a new language from C, why only go almost safe with "modern" C++ and not all the way to fully safe Rust?

I'm not trying to be snarky, but the thread was about Rust as an improvement to C and you just threw C++ into the mix... which isn't as safe.

<comment><USER8> Actually the thread was about C and someone threw Rust into the mix, as is typical.

One could go to almost safe C++ because C code compiles with a minimum amount of changes and turning on compiler warnings, using vector, string and smart pointers already gives a massive saftety improvement, without a complete rewrite in a language that's quite different from C, like Rust is.

Smaller costs and still significant benefits in other words.

<comment><USER7> > Actually the thread was about C and someone threw Rust into the mix, as is > typical.

I was referring to the thread that started a conversation about pointers and safety in Rust, not to the general post.

You are correct that C and Rust require some more bridging between the languages, but C++ also requires this when going from objects to C datatypes and vice versa. Mostly you save a little bit on the header definitions, but even there, the headers are generally #ifdef'ed to almost illegibility. With Rust's bindgen tool, getting C headers into Rust is actually quite easy: [https://rust-lang-nursery.github.io/rust-bindgen/](https://rust-lang- nursery.github.io/rust-bindgen/)

<comment><USER8> Ok, so then we could agree that the more general general topic is safety, so different options could be discussed: D, Ada, Rust, C++, etc.

The bindgen tool allows integrating C code with Rust code, which means than an existing C code base can be replaced with Rust step by step.

A C code base can be compiled with some modifications as C++ and then it can be slowly refactored to use safer C++ idioms. In this case the safety improvements will be available much faster, even if the resulting code base won't be as safe as a Rust code base. The culture shock will also not be as large for the C programmers.

These are non-negligible benefits, and a big reason why C code bases are moving to C++.

<comment><USER7> Staying a little more focused, I have reasons for none of the languages you mention, but in terms of ease of integration of C and Rust, here's one real world example: [https://people.gnome.org/~federico/blog/librsvg-build- infras...](https://people.gnome.org/~federico/blog/librsvg-build- infrastructure.html)

Which recently passed a milestone of having less C than Rust: [https://www.reddit.com/r/rust/comments/8ofa0w/librsvg_has_no...](https://www.reddit.com/r/rust/comments/8ofa0w/librsvg_has_now_more_rust_code_than_c_code/?st=JI35DG9U&sh=2e2ab3ec)

At this point I personally find it much easier to move C to Rust than C++, and end up with a much safer codebase.

</comment></comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER9> FYI this was fixed in both macOS and iOS last updates: [https://bugs.chromium.org/p/project- zero/issues/detail?id=15...](https://bugs.chromium.org/p/project- zero/issues/detail?id=1558#c2)

</comment><comment><USER10> > Note that the MPTCP code does seem to be quite buggy

> ...but is indicative of untested code

That's not encouraging.

<comment><USER11> I'm definitely guilty of not unit testing my error paths robustly. Line-by- line code coverage reports showed pretty consistent gaps, especially when operations become no-ops by returning early in case of certain errors.

Kind of surprising that other kinds of testing didn't reveal that bad log line, since it will always KP...

<comment><USER12> Unit tests are just example-based tests. They cannot test the code does nothing wrong in any case, they just test that in 1 specific case, it works.

Only proof-based methods can prove code works under every case.

If you're interested, see Coq [1] (including the first guaranteed-correct C compiler) or Isabelle.

[1] [https://en.wikipedia.org/wiki/Coq](https://en.wikipedia.org/wiki/Coq)

</comment></comment></comment><comment><USER13> This would be caughtable at compile time if the C programming language supported unions in a better way than it currently does.

Ada, for example, has discriminants, which allows binding of a specific view of a byte buffer to a specific constant.

There are also other solutions, for example making values to be types.

</comment><comment><USER14> For those unaware, this is not the bug most jailbreakers will use for iOS 11.3.1, because I believe it requires a developer certificate. There is another, hard to exploit bug that does not.

<comment><USER15> [https://twitter.com/i41nbeer/status/1004130737174515712](https://twitter.com/i41nbeer/status/1004130737174515712)

""" The trigger is here: [https://bugs.chromium.org/p/project- zero/issues/detail?id=15...](https://bugs.chromium.org/p/project- zero/issues/detail?id=1564) … If you're in to iOS exploit dev take a go at it and blog about it! I'll publish what I have soon, hopefully this week. """

<comment><USER16> Wow, the thread seems to have attracted a bunch of people that think all that needs to happen is for someone to sneeze the right way on the exploit and it'll promptly turn into a perfectly-polished jailbreak app.

Kind of depressing :(</comment></comment></comment>


Android Will Be Number 2 Mobile Operating System Worldwide by Year-End - <AUTHOR> http://www.readwriteweb.com/archives/android_will_be_number_2_mobile_operating_system_worldwide_by_2010.php

<comment><USER2> While the Year of the Linux Desktop may forever be a joke, 2010 is the Year of Linux on the Small Computer you Carry With You Everywhere.

<comment><USER3> And the Small Computer you Carry With You Everywhere is the new Desktop so in the end Linux will get there.

<comment><USER4> If and when android tablets are going to be sold in numbers the 'small computer' may not even be all that small.

<comment><USER2> I think Chrome OS tablets and netbooks/desktops are more likely to succeed than Android tablets actually. They both run the Linux kernel so for this discussion perhaps the point is moot.

</comment></comment></comment></comment><comment><USER5> I've never understood the point of these marketshare prediction pieces. What does it matter if some form of Android runs on more phones? Who actually cares? I know that emphasizing the horse race drives up page views, but is it actually worthwhile news?

Market share numbers for Android have to be interpreted differently. A phone can run Android without using any Google services, or running any third-party Android apps. This will become more common as Android becomes more popular on low-end devices, as this article predicts. If a phone doesn't run Google services, then it's not generating any more revenue for Google than a non- Android smartphone. If it's not running third-party apps, then it's not relevant for developers deciding which system to invest in.

On desktop systems, we have a clear idea of what market share means. A higher Windows market share means more revenue for Microsoft, and a better return for their investors. It also means a larger market for third party developers. The same can be said of Mac OS, and even Linux, to an extent. It doesn't work for iOS and Android. I think we need a better metric than market share when evaluating the mobile market.

<comment><USER4> It helps if you are not large enough to support both platforms. Even though yesterdays relaxation of the app store rules goes a long way towards making it possible to run the same app on both (that will never be the 'optimal' solution on either platform though).

</comment></comment><comment><USER6> A big question for me is what are the implications for Apple iOS given the quick diffusion of the Android OS. Will Apple iOS and the iPhone go the way of the Macintosh? A niche player in a very big market?

<comment><USER7> Once the iPhone is available on more networks, I can see these numbers changing DRASTICALLY.

Here in Canada, the iPhone is available on all carriers and you rarely see an Android phone. The iPhone totally dominates the market. Most smart phones are iPhones and Blackberrys.

<comment><USER2> It's pretty hard to buy an Android phone in Canada actually. I live in Montreal and I'm an iPhone 3G owner, and for the last month or so every time I walk by a phone kiosk in a mall, or a Bell or Rogers store, I ask if they sell Android phones. The answer is usually "No", but occasionally "Yes". I think Bell is the only company that actually let me look at an Android phone itself, all others have told me that I'd have to buy one without seeing it first.

It's almost like the carriers here are trying to hide the Android phones. Anyway, I am certain that low Android adoption in Canada has more to do with it being difficult to get than about consumer desire.

If a developer and nerd who _knows_ about Android (me, for example) has a hard time buying one, think about the average consumer. There's _no way_ an average Joe would buy an Android phone in Canada over an iPhone.

<comment><USER8> I've been trying to buy the Samsung Galaxy S for a week but they've been completely sold out in all of Montreal and Laval until today. This afternoon I finally found a FutureShop that had one.

And they refused to sell it to me.

The girl at the counter said that because it's such a popular phone they only sell it with 3 year contracts.

I bought the at&t version on ebay a few hours ago but still, it's ridiculously hard to get an Android phone whereas iPhones are everywhere and pushed hard.

<comment><USER9> Really interesting. Here in Slovenia (Europe), iphone is not even officially available for purchase (people that want it, mostly go to Italy to buy it). On the other hand, Android is everywhere. Htc desire, Samsung Galaxy S, SE experia x10, Motorola Milestone ... you name it. And people buy them a lot.

</comment></comment></comment></comment></comment><comment><USER10> It seems they are not counting iPod touches / iPads. For a developer, total ecosystem size and probability that owners will buy apps is a little more important.

On a tangent, Nintendo Wii had really good sales numbers, but I wonder if the number of games bought per console was around the same amount as the PS/3 or XBox 360? I have my doubts. I think the game console market shares is a more probably predictor of phone market share than PC sales (i.e. no highlander).

<comment><USER11> The article clearly mentioned, "mobile operating system". iOS powers iphone, ipod, ipad, etc.

On a tangent, there hasnt been much talk about how the corporate policies have evolved since the smartphone era. I bet we will see companies rolling out custom android OS deployed on stock hardware such as EVO given out to employees, with restricted permissions and access.

<comment><USER10> Well, I would dispute the numbers then. It doesn't look at all like the iPod touch is really given consideration.

I could see that if Dell was a bigger android player, but it really takes a vendor with sales / support leading the charge. HP would be a probable except for the Palm purchase.

</comment></comment></comment><comment><USER12> Nobody in HN pays attention when you say that Apple doesn't really matter that much, but I'll try it anyway: Apple's share in the smartphone market is too small and decreasing. Source <http://news.cnet.com/8301-1035_3-20015799-94.html>

The real contenders are Android and Symbian. Blackberry is small but seems stable. Windows 7 might become a surprise. Apple will not lead the pack.

<comment><USER13> Symbian is dead - or will be as soon as dumbphones die. That leaves iOS and Android and, perhaps, RIM. For WinMo 7 to be measurable, Microsoft will have to pull one heck of a miracle.

</comment></comment><comment><USER14> Given the iPhone's exclusivity with AT&T in the US, Android's US growth isn't surprising.

However, it is interesting to see Gartner worldwide projections. Does anyone have links to Android vs iPhone market-share-data for countries where they are both available on all/most carriers ?

</comment><comment><USER15> I always get a laugh out of people who get excited about this, I think the far more interesting statistic would be stickiness factors - once you are on a phone platform, how likely are you to stay. For example, what percentage of people get an iPhone and then when their 2 year contract expires - get another iPhone because they love it (despite AT&T). It is hard to judge Android in that context right now because for all the noise it has made in the past year it is still relatively new in the scope of phone devices and carrier contracts. I think RIM has been pretty strong historically in this kind of metric and iPhone has proven well here too.

<comment><USER16> On Stickiness - It doesn't look good for RIM (this was back in March):

Some 40% of Blackberry users, according to CrowdScience, prefer the iPhone as their next smartphone purchase. Even more, some 32% of Blackberry users said that they would drop their Crackberry for the latest Android offering, the Nexus One.

[http://thenextweb.com/mobile/2010/03/15/blackberry-users- iph...](http://thenextweb.com/mobile/2010/03/15/blackberry-users-iphone- android-envy-report/)

</comment></comment><comment><USER15> Unless Google gets a handle on consistency in the user experience then this wont last long. I love my EVO and left iPhone for it but the 3rd party app market is crap and I feel like I have a phone with multiple personalities.</comment>


Jeeves is back - <AUTHOR> http://www.guardian.co.uk/technology/blog/2009/apr/20/ask-jeeves-resurrected

<comment><USER2> I wish PG Wodehouse's estate would put this lame trdemark out of its misery. Ask.com has no discernible reason to go on living: I predict they'll get asset stripped when the economy turns, assuming their server hardware is worth selling off.

Let's perform a little experiment...

Search the web for 'why is ask better than google' »

Result #1 Is Ask.com Better Than Google? Like you, I've been watching what looks to be a very powerful campaign by Ask.com quoting a bunch of folks I know as saying that its search engine is better than Google's. I'm a big Google user and have developed a set of skills that allows... <http://www.technewsworld.com/story/commentary/53184.htm..>.

Result #2 _Why is google better than ask jeeves?_ From: Recommended Search Engines UC Berkeley - Teaching Library Internet Workshops Google alone not always sufficient, however. Less than half the searchable Web is fully searchable in Google. Overlap studies show that more than 80% of the ... <http://answers.yahoo.com/question/index?qid=20080311053..>.

Result #3...oh wait, that's it.

Hmmm.</comment>


Embrace the Static Web with Punch - <AUTHOR> http://laktek.com/2012/11/04/embrace-the-static-web-with-punch/

<comment><USER2> This trend, hosting blogs on static html, is kind of ironic, given how popular it is among developers. I can't make up my mind whether it's some sort of hipsterish-nostalgic thing, a general distrust of running other people's dynamic blog code, or just plain Occam's razor (stick to barebones).

<comment><USER3> For me, it's a way of avoiding having to trust / pay for someone else's server, but also avoid worrying about keeping my wordpress install up to date.

I had a little blog I posted to every few months, and one day I found it vandalised from my out of date wordpress.

<comment><USER4> I think this is a huge reason for the popularity of static blogs. For dynamic blog software, your choice is basically WordPress. Unfortunately, WordPress has a pretty bad security track record. Things might be different if there were a reliable second-place blogging engine, but as far as I know there isn't.

Another reason is the rise of version control for small projects, and the way static sites fit nicely into a Git workflow.

<comment><USER5> I use DotClear instead of Wordpress for the blog of a local non-profit, and it's nice, and according to them, easier to manage.

</comment></comment></comment></comment><comment><USER6> As everyone has, I built my own static site generator called Fairytale (<https://github.com/46Bit/fairytale>). Unlike a lot of them, it wasn't intended as a simple magic-incantation tool: I reimplemented the relevant parts of Sinatra for static-site compilation. You program everything and in development can just use the sinatra gem instead of the fairytale one to get a server.

I've been using it on <https://46bit.com> for something like a year now, and the thing I've realised is that it's largely a luddite thing. The movement is a rebellion against POS software like Wordpress, but ignores the fact that building a nice, Markdown-driven app with caching and a lovely interface is actually quite easy & friendlier in the long run.

It might be great for people afraid of servers, but I'm not. I don't want to be - I'm still serving a bunch of dynamic apps off the same two servers I use for a few static sites, and I enjoy learning how to tune them.

I'm planning to transition away from static sites. Initially to just serving a Sinatra app, then later to a custom Padrino or Rails blog engine. Would love to hear if anyone's got any suggestions for something off-the-shelf and hacker friendly in Ruby though.

<comment><USER7> I think calling it "a Luddite thing" is perhaps a little overkill.

Sure, it's easy enough to scale Wordpress, but I literally won't use 99% of the features that Wordpress offers, and all those features are potential attack vectors. On top of that, with every blog engine / CMS I've ever used (including the ones I'd custom-written), at some point I end up needing to use an iframe with static content because a CMS is only so flexible.

Instead of all that, I can put up a static page that is infinitely flexible, use Disqus for comments, and be pretty much free of risk. No database to hack into, no patches to apply, etc. On top of all that, it's even easier than using Wordpress.

So, while I don't disagree that there are people using Jekyll and ilk to rebel against Wordpress, an equally valid wonderment would be in trying to figure out how Wordpress got so carried away.

Editing to add that your approach is pretty much the same thing I did, but in Django instead of Ruby. I kept using the "CMS"-like methods of Django, but then completely render them out as static pages to be published to S3.

<comment><USER6> You sum up exactly why I've long since not cared about WordPress, but you seem to assume anything dynamic has to have an admin interface.

The ideal engine for me still uses flat files for content, but doesn't compile the files to HTML. Let a cache like Varnish handle the load. That way I can implement things like comments without running off to the latest service-of- the-month that might shut down and take everything with them.

I've spent enough time dealing with third-party javascript and issues on their end screwing up the first-party to want no part of a remote comment service.

<comment><USER7> So what's an example of a flat file that isn't HTML? If you have flat files, what value does Varnish provide?

If you're accepting use input to write files, then you have vulnerability. I'm not saying you do or don't, but it's an attack vector. As for Disqus, sure, I'm at their whimsy when it comes to security, but they haven't bitten me yet, and I'd hardly consider them fly-by-night as they've been around for years now, and has been profitable since their first year.

For what it's worth, I wasn't considering the admin site as vulnerable, as those are generally disabled before deploying, but if you're running a database, or varnish, or Apache, or whatever, your risk is increased for vulnerability, but I suppose that's neither here nor there really, as I think it comes down to a matter of taste and, as you said, I'm trading system vulnerability for third party vulnerability. The upside though is that while sure, somebody could munge my site up, fixing it is just uploading another copy.

<comment><USER6> > So what's an example of a flat file that isn't HTML? If you have flat files, > what value does Varnish provide?

Sorry, that's probably confusing language here. I was referring to structuring Markdown files in a flat-file database, not the concept of compiled HTML files.

</comment></comment></comment></comment></comment><comment><USER8> Here is a list of static site generators (you should add your own): <https://gist.github.com/2254924>

I'm big fan of Jekyll. I use it intensively on my binaryage.com site: <https://github.com/binaryage/site>

I also started working on my own client-side static-site post-processor: <https://github.com/darwin/terraform>

This is not yet another static site generator. The idea is to have browser- based editor for static site with live preview. Saving your changes would go directly to github, which will trigger site regeneration.

Right now I'm waiting for PhantomJS to upgrade internal webkit version. Terraform depends on the new DOMMutationObserver API (resp. on <http://code.google.com/p/mutation-summary>).

<comment><USER9> Aww, I thought I was gonna be the guy who talked about my server-side static site generator first. Haha, anyway, what I like about generating static sites on the server, at least for my situation, is that you can hand over control to anyone and they're immediately familiar with how it works from having used Wordpress or some such for years.

I won't like to mine because it's still full of code written for the original use case but mine started as a blog engine for a few of the non-technical people in my department. They needed a blogging engine but because of some stupid beaurocratic reason we couldn't use a database. So the options were to add blog posts manually and fake it, teach them to use Jekyll (that would never happen), or, what I chose, a static site generator on the server that no one would ever think is a static site generator. They love it and think I'm a genius (and it only consists of like 3 files which I think is funny).

</comment></comment><comment><USER10> I've gone back to static generators almost exclusively - full circle really as some of my first web pages were generated with Userland Frontier (anyone remember Clay Basket?) nanoc (<http://nanoc.stoneship.org/>) is currently my tool of choice. WordPress and (popular) plugins are a huge target these days - happy to not be worried about security with static pages. Comments can be handled by Disqus, mobile publishing with dropbox and some plumbing. Certainly not as easy as a "one click install" at a webhost, but fast, scalable and infinitely configurable. Generating feeds in the build process is not difficult either.

</comment><comment><USER11> Previously on HN about 195 days ago : <http://news.ycombinator.com/item?id=3877954>

But why the repost - I ask? The last time it was arunoda, who seems to be a friend.

As somebody who'd love to post a pet project on HN sometime in the hopefully- not-too-distant future, I sorta get that you might want people to try your software and that maybe you'd like more eyeballs than you got the first time around; but couldn't you be explicit about it? I'm sure that something like "Guys, I know this has been posted before, but I'd like you look at it once again" would be more welcome and transparent.

Update: I read through the comments on that thread. THAT was a repost. This is the original: <https://news.ycombinator.com/item?id=3862269> (199 days, poster: you)

Whats going on? Have you changed anything since then that you'd like to highlight?

<comment><AUTHOR> Yes. This was not actually a project announcement, but a tutorial published on Appliness.

Of course, there had been lot of new features and changes to the process since the initial release.

Also, it's up to you to decide whether to vote it to the frontpage or not.

</comment></comment><comment><USER12> I still prefer LAMP. One trick to improving cache on LAMP is converting or caching files into HTML. I know there are a number of templating engines like Smarty out there that will do just that, but what I mean is actually converting dynamic parts of the site that only change when an admin writes new content. Convert those pages into static HTML files when the admin adds new content, etc.

For example, a number of ecommerce website run off shopping cart systems that use a database. Why not have them convert into a HTML version of the site after the admin adds new products, edits products, ect. That would take a huge load off the server and database.

<comment><USER13> You can do that with nginx very easily with the Proxy module. Something like this [http://mark.ossdl.de/2009/07/nginx-to-create-static-files- fr...](http://mark.ossdl.de/2009/07/nginx-to-create-static-files-from-dynamic- content/)

</comment></comment><comment><USER14> Anyone have thoughts on deploying static sites to S3?

I have a few static sites and single-page JS apps, and right now I just serve them with Nginx off a shared server. I've tried looking for a definitive answer on "Where should I host static sites?" but it hasn't appeared yet.

<comment><AUTHOR> Easiest option would be to use GitHub pages - <http://pages.github.com/>

But if you prefer to have more control and availability, you can use S3. Punch makes publishing process to S3 really easy - <https://github.com/laktek/punch/wiki/Publishing-a-Site>

</comment></comment><comment><USER15> This seems to be the Node equivalent of Jekyll in Ruby. Pretty awesome!

</comment><comment><USER16> I've written something similar in 150 lines of code, if anyone is interested: <https://github.com/olegp/mcms>

</comment><comment><USER17> I really like Middleman for my static websites because of the livereload support: <http://middlemanapp.com/>

</comment><comment><USER18> The use of Mustache is a bit off putting. I'd prefer a template language that lets me put all the gory code I like in my templates.

<comment><AUTHOR> You have the option of changing the template engine to any one you prefer - [https://github.com/laktek/punch/wiki/Adding-a-New- Template-E...](https://github.com/laktek/punch/wiki/Adding-a-New-Template- Engine)

For example, here's a handlebars plugin for Punch - <https://github.com/laktek/handlebars></comment></comment>


Simple and Impressive Design Techniques - <AUTHOR> http://www.smashingmagazine.com/2009/04/02/10-impressive-simple-design-techniques/

<comment><USER2> Where is reflection?

</comment><comment><USER3> _some Web browsers and operating systems automatically smooth out HTML text a bit, but as a general rule, HTML text has no anti-aliasing._

Errr what?</comment>


Response to the use of "crowdsourcing" to flag inappropriate content - <AUTHOR> https://www.youtube.com/watch?v=NLJDveCFuck

<comment><USER2> Note: There's a few NSFW clips in that video (audio and video).

Also I note the irony of the Youtu.be URL shortcode ending with a swear word. (What are the chances of that?)</comment>


Kippt (YC S12) adds social lists and discovery features - <AUTHOR> http://www.readwriteweb.com/archives/kippt-reinvents-the-internets-favorite-hobby-sharing-links.php

<comment><USER2> I'm currently using Kippt to keep track of awesome plugins and libraries that I find on my travels around the web (eg. cool javascript libraries).

Adding social lists means that I can now share these with my colleagues/friends. Great addition.

</comment><comment><USER3> I'm not using this anymore, for several reasons:

I didn't get warm and fuzzy at the site by registering and spending some time.

I'm not a fan anymore of site being developed with all their intended features (read, as they go along experimenting) while we use (depend) them for daily chores. I'd rather site display all its cards right upfront.

The bookmarking site model is following the same trend as it existed for many years, i.e, there is nothing innovative in this area.

<comment><USER4> We understand that many things have been broken in the bookmarking model in the past. That's why we try to keep Kippt as simple as possible. Feel free to send me an email any time (firstname.lastname@example.com), we would love to hear what didn't work for you so that we can improve things in the future.

</comment></comment><comment><USER5> I like Kippt but wish it had a tagging mechanism. The only way to simulate tags is to put the link in multiple lists - which can be a pain. The Chrome extension only allows the link to be added to one list, and so I was often adding a link with the extension, only to then navigate to the site to add it to other lists. I ended up just giving up and using the search feature in Chrome bookmarks.

<comment><USER4> Tagging is something we're adding soon but we're doing it a bit differently: You can use hashtags in notes which will work as filter for search.

<comment><USER6> ha, that's a good idea. Small amount of lists for simplified browsing experience, but indexed hashtags for blazingly fast search. Good thinking, guys.

</comment></comment></comment><comment><USER7> I just signed up and will give it a spin. I was going to install the Chrome Extension but the prompt says:

Add Kiptt?

It can:

\- Access your data on all web sites.

\- Access your tabs and browsing activity.

Why would the extension need all that above data if it's just bookmarking the page into Kippt?

<comment><USER8> > Why would the extension need all that above data if it's just bookmarking > the page into Kippt?

It doesn't _just_ bookmark the page. C'mon, spend a minute and actually look at what features it provides. It's on the actual Chrome plugin page.

It's obvious what it needs access to the page's content and the tabs that contain that data.

Next time, please do a little bit of reading, a tad bit of research. Don't just click next next next.

<comment><USER7> Uhmm...I'm going to ignore your snarkiness and condescension and just present the below data from Google's Support page for Chrome plugins:

" Your data on all websites

This item can read every page that you visit -- your bank, your web email, your Facebook page, and so on. Often, this kind of item needs to see all pages so that it can perform a limited task such as looking for RSS feeds that you might want to subscribe to.

Caution: Besides seeing all your pages, this item could use your credentials (cookies) to request or modify your data from websites."

I think it is not unreasonable to take pause when an extension asks for such permissions.

<comment><USER8> > Often, this kind of item needs to see all pages so that it can perform a > limited task such as looking for RSS feeds that you might want to subscribe > to.

This is Google's issue. They provide a limited set of permissions (you want access to data about the site, you need to give permissions to read the site).

Maybe you could answer this: how else is the plug supposed to get the title of the page you are looking at without having access to the contents of the page? The title, after all, is part of that content.

> I think it is not unreasonable to take pause when an extension asks for such > permissions.

It's not. It is, however, unreasonable to unfairly and dishonestly characterize a plugin without doing any research yourself.

</comment></comment></comment></comment><comment><USER9> Awesome tool. I would be nice to add just notes, without links at all. It would make it easier to keep/share lists of code snippets, useful phone numbers, organizations, people, addresses etc. EDITED

</comment><comment><USER10> it sucks when you see startups doing what you've been building solo for some time, but not yet launched... :/

<comment><USER11> This isn't a zero-sum game; just launch it :)

<comment><USER10> yes, I'll do that. I'm learning a lot along the way (I'm not a programmer, just learned some things from Udacity and Codecademy), so it's not wasted time :)</comment></comment></comment>


Show HN: Nadeeni – an online community built entirely with Dart - <AUTHOR> https://play.google.com/store/apps/details?id=com.nadeeni.android <comment><AUTHOR> Serendipitously meet and engage with people from around the world in a fun online community. App and backend written entirely in Dart.</comment>


Bitcoin Gold hit by 51% attacks, $72K in cryptocurrency double-spent - <AUTHOR> https://thenextweb.com/hardfork/2020/01/27/bitcoin-gold-51-percent-attack-blockchain-reorg-cryptocurrency-binance-exchange/ <comment><USER2> A current thread about 51% attacks is here: [https://news.ycombinator.com/item?id=22160523](https://news.ycombinator.com/item?id=22160523)

<comment><USER3> That is a thread about the cost for a 51% attack against various crypto currencies, not about Bitcoin Gold actually being hit.

<comment><USER2> Yes, that's why we didn't merge the two threads.

</comment></comment></comment><comment><USER4> ELI5:

Lots of cyptocurrencies use the same mining algorithm, i.e. they require the same type of puzzle to be solved to make money creating blocks. In recent years, lots of online services have sprung up to offer cloud mining, which people usually use to mine blocks on the bigger cryptocurrencies, like Bitcoin Core or Bitcoin Cash.

However, since the smaller cryptocurrencies, like Bitcoin Gold, have less users/miners, they also require easier "puzzles" to be solved, which opens an opportunity for any random person to pay some $$$ to hire a bunch of these cloud servers for a limited time and point them at these easier puzzles, which can cause such a smaller blockchain to get confused about account balances. The attacker can then re-spend the same currency multiple times to make a profit.

AFAIK there aren't really any good solutions to prevent this problem- For complex game-theoretic reasons, simply changing the mining algorithm to something different doesn't really offer much protection. (Some folks believe if these smaller currencies were to move to "proof of stake" it could help solve this problem, but this is an extremely contentious topic.)

<comment><USER5> IMO proof of stake is a lot less contentious than you imply. ETH2's slashing algo should make these types of attacks very hard.

For the curious a simple breakdown Ethereum 2.0's Proof of Stake (PoS) plan is:

-Minimum 32 ETH to stake

-Staking locks the currency in the staking pool

-Your node votes on the validity of the transactions (this is super light weight and fast, can run on a rPi instead of huge mining nodes).

-If the network agrees you was acting maliciously your locked stake begins to be slashed/burnt.

-Voting with the majority gives you a % of the block reward.

This means a 51% attack on the chain requires 51% of the currency staked which would be extremely hard to get without skyrocking the price (making 51% exponentially harder to achieve). They've also done some spooky proofs I don't understand that make the actual number to take over the network >51% (70% or so IIRC).

So it's green, fast, and harder to attack successfully. And unlike PoW, if you fail your "attack money" gets nuked.

<comment><USER6> Some of the contention is directly in your choice of words: "should" and "plan". So far no Proof of Stake system has made it into the wild. There's a lot of talk about Proof of Stake, a lot of planning, a number of "almost attempts", but still no one running it at a big scale. It's trapped in "Soon™" the way Ethereum has talked about it, for years now. That's certainly an easy form of contention when even the biggest group talking about Proof of Stake have remained slow to pull the trigger.

<comment><USER7> Tezos isn't in the wild nor at scale?

<comment><USER6> First I've heard of it, so equating "wild/at scale" to include general mainstream acceptance/word of mouth (or at least the impression of such to the average HN reader such as myself), the short answer right now is, based on my personal barometer: no.

I will look into it later, and decide on the longer answer if it would meet characteristics that I would ascribe to "in the wild" or "at scale" given a deeper understanding of what it has accomplished to date.

</comment></comment></comment></comment></comment><comment><USER8> Since the other post got buried in a subthread: This is about Bitcoin Gold, not Bitcoin itself.

Bitcoin Gold is the least relevant of the forks (worth ~$12 per coin while the main chain BTC is worth ~8750 and the two major forks BCH/BSV are worth around 300, and only 7 of the 20 largest exchanges (by liquidity, according to coinmarketcap) list it - even though most of them list plenty of altcoins/shitcoins. For comparison, Bitcoin Cash is listed on all of them, Bitcoin SV on 14 of them. Additional stats here: [https://news.ycombinator.com/item?id=22160458](https://news.ycombinator.com/item?id=22160458)

<comment><USER9> clearly you've never heard of Bitcoin Diamond

<comment><USER10> I prefer Bitcoin Platinum.

<comment><USER9> Is that real?

<comment><USER11> I'm fairly sure it's a Pokémon joke.

<comment><USER12> Doesn't mean it's not also a cryptocurrency :)

</comment></comment></comment></comment></comment></comment><comment><USER13> > He then provided a screenshot showing that Binance had since increased their > BTG withdrawal requirement to 20 confirmations.

The journalist has missed an important part of the github gist that their story bases on:

> Based on Nicehash market price data for Zhash we estimate the cost of > generating each reorg at around 0.2 BTC (~$1,700) and the attacker would > have recouped around the same value in block rewards. Therefore, it is > possible that the attacks were profitable if the double-spends succeeded at > defrauding the attacker's counterparty, or break-even if the double-spends > were unsuccessful. This suggests that a confirmation requirement on the > order of tens of blocks for BTG is still far too few to make the budget > constraint to launch an attack significant.

<comment><USER14> Double spends are an inefficient way to profit from an attack, they're merely the advertising/marketing angle.

The real profit will come from shorting the currency and capitalizing on the subsequent crash due to the crisis in confidence.

<comment><USER15> _If_ you can short such an obscure coin and _if_ there's a crash. Sometimes these attacks are already priced in.

<comment><USER16> I think the point they were making is that you keep double spending until it does. You profit or you profit very very big. It doesn't seem like news of a double spend would ever cause a pop.

<comment><USER17> But how do you go about shorting these coins? There's not an obvious way to short them, like traditional stocks.

<comment><USER18> Cryptocurrency exchanges are pretty involved nowadays, iirc they offer short on most

</comment></comment></comment></comment></comment></comment><comment><USER19> Second time this has happened to BTG. Boggles the mind that people continued to use this coin. [https://fortune.com/2018/05/29/bitcoin-gold- hack/](https://fortune.com/2018/05/29/bitcoin-gold-hack/)

<comment><USER20> Do other coins have any countermeasures against this? Other than it being expensive to control 51% of the networks hash rate?

I guess raising the amount of required confirmations helps but even then it's just a matter of time.

<comment><USER21> Yes, Ethereum is transitioning to proof of stake.

Proof of stake is more secure than proof of work because an attacker must acquire a large amount of ETH each time they attempt an attack. Attacks against proof of stake are incredibly capital-inefficient.

<comment><USER22> Ethereum has been announcing "proof of stake" since before their original launch. Yet, years after their deadline and their second deadline and their third deadline... it still isn't there. Multiple hardforks to push back the logic bomb in their consensus rules that was originally supposed to guarantee its successful deployment... Now their target has been to create a new parallel cryptocurrency (eth2) and let you buy into it with your eth.

If your goal is a decentralized system POS is just a fundamentally broken idea, as was known years ago (and long before ethereum existed [https://download.wpsoftware.net/bitcoin/pos.pdf](https://download.wpsoftware.net/bitcoin/pos.pdf) ). Ethereum isn't a decentralized system-- as demonstrated by them editing balances to recover coins the ETH administrators personally lost by gambling on an ill-advised contract-- but they have to keep up the pretext.

<comment><USER23> >Ethereum isn't a decentralized system-- as demonstrated by them editing balances to recover coins the ETH administrators personally lost by gambling on an ill-advised contract

Uh, I'm fairly sure this never happened but you're welcome to provide a source.

<comment><USER24> [https://en.wikipedia.org/wiki/The_DAO_(organization)](https://en.wikipedia.org/wiki/The_DAO_\(organization\))

<comment><USER23> Not what he is referring to, the DAO was not a gambling contract and the funds lost accounted for ~14% of all ETH, not some administrators' personal losses. Those who disagreed with the proposed hard fork stayed on what became Ethereum Classic and everyone else jumped ship to what is now Ethereum.

<comment><USER22> That is exactly what I was referring to. DAO was an "investment" with an unspecified way to make money, it was essentially a gamble. The funds in it were a majority coming from ethereum foundation members. The reason that they were 14% of all ethereum at the time was that at the time something like 85% of ethereum in existance had been premined by the ethereum foundation (at the moment it's 75%).

Most people who opposed the fork also stayed with ethereum because the ethereum foundation, which they'd collectively invested millions in, announced it would not support the fork. (in fact, it announced that the fork wouldn't even exist-- which caused companies like coinbase hundreds of thousands in losses from replays due to not being prepared for it)

<comment><USER23> >That is exactly what I was referring to. DAO was an "investment" with an unspecified way to make money, it was essentially a gamble.

The DAO was supposed to be a VC firm. If you want to say that the DAO was gambling then so is all Venture Capital.

> The funds in it were a majority coming from ethereum foundation members. The > reason that they were 14% of all ethereum at the time was that at the time > something like 85% of ethereum in existance had been premined by the > ethereum foundation (at the moment it's 75%).

What a laughably stupid thing to say. Ethereum did an ICO before that term was a thing, mined a shit ton of ETH and sold almost all of it for Bitcoin. By the time the DAO was a thing the Ethereum foundation controlled ~12M ETH, which did not overlap with the ~11.5M ETH in the DAO (The funds were for the development of Ethereum, not speculative purposes). There was an additional some 60M ETH from the initial sale + ETH from newly mined blocks, not in the DAO and not part of the ETH foundation.

>Most people who opposed the fork also stayed with ethereum because the ethereum foundation, which they'd collectively invested millions in, announced it would not support the fork.

The Ethereum foundation announced it would not support what exactly? If you mean Ethereum Classic well that is not a fork of anything - but a continuation of the original DAO chain. 11% of people voted against the Ethereum fork and presumably did not migrate (or likely just used both).

>in fact, it announced that the fork wouldn't even exist-- which caused companies like coinbase hundreds of thousands in losses from replays due to not being prepared for it

Er, what? Assuming you are referring to ETC, which again is the original chain, the Ethereum Foundation does not have the power to determine its existence or non-existence. The original chained continued to be mined and supported by nodes.

</comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER25> Note this is "Bitcoin Gold", not Bitcoin.

<comment><USER26> This is just a warm-up for taking on Bitcoin.

<comment><USER27> There isn't a state actor or company that overturn Bitcoin with computing power.

<comment><USER26> You can't be serious.

Bitmain does.

<comment><USER28> Source?

I mean, real technical capabilities not just mention of facilities in Texas or whatever.

<comment><USER26> They manufacture the bulk of Bitcoin mining gear. They hold all the IP. They have all the manufacturing contracts. They have heaps of their own hardware and the capability of manufacturing more at cost.

They are the prime mover in the Bitcoin space, and have an outsized impact in other crypto mining spaces. They are the undisputed ASIC leaders.

<comment><USER29> What's your point? If Bitmain decided to 'overturn' Bitcoin all their gear would become worthless.

<comment><USER26> What if crashing Bitcoin helped them in some way, like pushing people to Ethereum where they also sell metric tons of mining equipment?

You're saying it's impossible, and now you're saying nobody would bother. Don't move the goalposts.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER30> Note there are plenty of other cryptocurrencies that are susceptible.

[https://www.crypto51.app/](https://www.crypto51.app/)

<comment><USER2> Current discussion at [https://news.ycombinator.com/item?id=22160523](https://news.ycombinator.com/item?id=22160523)

Also in 2018: [https://news.ycombinator.com/item?id=17173051](https://news.ycombinator.com/item?id=17173051)

</comment></comment><comment><USER31> Meta: I spend a lot of time in crypto(currency) subreddits, and of course approach those conversations differently than I do when I see the same topics pop up on HN. That said, I see a lot of the Reddit-style comments and terminology ("altcoins", "shitcoins", derisive names, etc) show up where when there's a crypto discussion. Does this happen in other subjects and I'm just unaware of those topic's subcultures? Or am I correct that the level of discourse for crypto is that much lower?

<comment><USER32> I wouldn't necessarily call the discussion "lower" but you can see similar colorful language in forums dedicated to trading equities/options.

<comment><USER31> I imagine so. I think my question (maybe I missed the mark) was is that does as much as that leak into HN (where I consider the level of discourse far higher than the Internet as a whole) as much for other topics?

<comment><USER32> Oh, I guess I misunderstood. Not sure about that but that is an interesting question.

</comment></comment></comment></comment><comment><USER33> How disconnect the market is from facts. Price of Bitcoin Gold is not even affected by this news at all

[https://www.coingecko.com/en/coins/bitcoin- gold](https://www.coingecko.com/en/coins/bitcoin-gold)

The market may not even understand what 51% is about

<comment><USER34> Or maybe all buy orders have disappeared. Looking at the last exchange price does not measure the value of a cryptocurrency, you need to look inside order books to see if anyone is even interested in buying your cryptocurrency. It's not relevant to the value of your cryptocurrency that someone was once willing to buy it.

</comment></comment><comment><USER35> Just an observation: 51% attacks are happening there days in some countries in governments. When 51% gives you the absolute power in a bitcoin, it gives you enough to rule a country and push it to 100% (there are a few real life examples). Maybe 51% is a threshold too low for some things.

<comment><USER36> That's never really true, because even in a dictatorship the government doesn't have total control of everything. And a 51% govt in a democratic country is constrained not only by rival political parties but also the business sector and public outrage.

<comment><USER35> Just 2 words: North Korea.

</comment></comment></comment><comment><USER37> And all of that costed just about $1.2k, what a joke currency.

</comment><comment><USER38> [https://en.wikipedia.org/wiki/Sybil_attack](https://en.wikipedia.org/wiki/Sybil_attack)

</comment><comment><USER39> > Binance had since increased their BTG withdrawal requirement to 20 > confirmations.

Perhaps they should require some multiple of (amount of the transfer / cost of the hashpower needed to mine one block)?

</comment><comment><USER40> One point nobody is hitting on is that the price of BTG pumped a few weeks ago for no apparent reason. I guess we know why now. Pump the price and then attack it for even more profit.

</comment><comment><USER41> The block which includes double-spent is invalid. When an honest node chooses the "strongest" chain it should check block If it's valid, not just look at a number of confirmations.

This is also true for blockchain browsers(and their api), which apps use to confirm the transaction(most of users don't run full node). The only way how 51% attack can be successful in the long term is that honest nodes(and blockchain browsers api) are re-configure to ignore double-spent(at least for a particular time period).

<comment><USER42> How do you know which side of a blockchain fork is the double spent, and which is the original?

<comment><USER41> This is a valid point. Sorry for my post. Blockchain has few moving parts, but the whole game theory around it is very complex.

</comment></comment></comment><comment><USER43> BTG might collapse as a result.

This might help general awareness that minor coins without a differentiating technology are simply highly vulnerable uninteresting clones, not worth any attention and thus, value. Perhaps some would just disappear, in a spiral of lower value, lower hash rate, more vulnerability, till all miners leave towards other, stronger coins?

This might sanitize the whole cryptocurrency domain a little.

Or not?

<comment><USER44> It's been known for some time that anything out of the top 10 that uses a pow algorithm for which you can buy hashpower in the market is pretty easy to run a doublespend on. It doesn't seem to have had a huge effect on adoption of those coins though.

</comment></comment><comment><USER45> The question now is: was hiring the cloud mining services cheaper than the reward of $72,000?

</comment><comment><USER46> Looks like they took a loss doing that attCk

<comment><USER31> There are a lot of Bitcoin advocates that would attack out of motivations other than (short-term) profit.

</comment></comment><comment><USER47> Oh. Again.

</comment><comment><USER48> i wonder if this will cause a fork.

<comment><USER49> No, this won't cause a fork. To be specific, little forks happen all the time as different clients get information about new blocks at different times. So blockchains are very resilient to that kind of thing. Clients only continue from the longest legit chain they have seen, so whichever side of the fork has more hashpower on it will win in a way that's pretty transparent. So the attacker did cause a fork, so that they could spend coins once on each side, but all clients other than the attackers' would agree on which side was legitimate. So once the attack is over, it settles down immediately.

<comment><USER50> It _was_ a fork! That's how the double spends work. The attackers generated a new chain of blocks from just before their transaction, and produced their chain so fast that it became longer than the 'real' chain, causing miners to accept it as the legitimate record of all transactions.

As for 'resilient', try telling that to the people who were robbed of their coins because of this attack!

</comment></comment></comment><comment><USER51> This is good for Bitcoin. /s

<comment><USER52> Well it is, any copy cat coin sharing the same hashing algorithm as Bitcoin has this risk. So stay away from shitcoins.

Edit: I was wrong about BTG sharing the same algorithm.

<comment><USER53> I think it's more complicated than that. You'd need enough computing resources to "beat" half of the Bitcoin network's current hashrate, which is absolutely massive compared to BTG's.

Oops: I see what you mean though. Because there's so many BTC miners, they can easily swap over to BTG to overwhelm the much smaller network.

<comment><USER54> This is part of the reason why it's most likely everything will converge on a single money. Currencies will be issued on top, rather than dividing the global effort.

</comment></comment></comment></comment><comment><USER55> who on earth has got Bitcoin Gold in his pocket ??? ;)

</comment><comment><USER56> 1 for 1 so far on my 2020 decade predictions

[https://news.ycombinator.com/item?id=21943830](https://news.ycombinator.com/item?id=21943830)

<comment><USER57> Sorry, but this doesn't seem related to quantum - I don't think you get credit yet.

</comment></comment><comment><USER58> I wonder why this ended up in the front page of HackerNews? It's not news that altcoins are much much easier to attack than the top coin(s). Lesson to learn here: top coins are not only better due to the network effects (users and developers), they are also better in terms of security (it's much more expensive to carry out an attack in BTC or ETH, for example).

<comment><USER59> Would it be fair to say altcoins are the "penny stocks" of the cryptocurrency world? Easily subjected to price manipulation and typically the perpetrator doesn't have to spend too much.

<comment><USER58> I think altcoins are not even penny stocks, they will die soon in the same way there are no other networks these days that try to be the internet. The penny stocks are the Ethereum tokens.</comment></comment></comment>


Fake Hire, Staff Departures Roil SoftBank-Backed Security Startup - <AUTHOR> https://www.theinformation.com/articles/fake-hire-staff-departures-roil-softbank-backed-security-startup <comment><USER2> Someone comment with a brief of the article please. I don't want to subscribe to read it.</comment>


Emails considered "abandoned" if older than 180 days - <AUTHOR> https://informationgovernance101.com/2013/12/13/emails-considered-abandoned-if-older-than-180-days/ <comment><USER2> article is from 2013</comment>


Hackers Hid Backdoor in CCleaner Security App with 2B Downloads - <AUTHOR> https://www.forbes.com/sites/thomasbrewster/2017/09/18/ccleaner-cybersecurity-app-infected-with-backdoor/#66c75fe8316a <comment><USER2> The discussion is substantial, and over here:

[https://news.ycombinator.com/item?id=15274339](https://news.ycombinator.com/item?id=15274339)</comment>