I was seven words away from being spear-phished - <AUTHOR> https://robertheaton.com/2019/06/24/i-was-7-words-away-from-being-spear-phished/ <comment><USER3> It's impossible to overestimate the power of expectations to create trust (even in the face of contrary indications).

This just almost happened to me this week: A couple of days ago I wrote an email to a friend I hadn't been in touch with for several years. A day later I got a message from him on Facebook with what looked like a YouTube link and the cryptic message, "It's you?"

I didn't want to see myself on a random youtube video I had never heard of, so I wrote back that I didn't want to click.

Then the next day my friend announced that his account had been hacked and that those messages were spam/malware, with a bad impersonation of a YouTube link. But I was so sure it was a legit message from my friend that I didn't even notice that the link didn't actually go to YouTube. Fortunately I never clicked it, but just like the OP, it was blind luck.

[edit: fixed wording]

<comment><USER4> Okay but let's be clear. Clicking a link won't steal your information.

Going to a bad link and giving your details is how you are phished.

<comment><USER5> Couple of years ago a significant news site here in .no had their ad network hacked. The result was that if you were browsing that site that morning, and was a customer of the largest bank in .no, you'd silently got served some software which would do a MITM attack against the online account page of said bank, redirecting any payments you did without your knowledge.

All you had to do was to visit that site with Java installed on that computer, which most users of said bank did because their 2-factor login relied on Java...

So yeah, don't click on random links.

<comment><USER6> I use firefox which I've locked down pretty hard. No site gets to run active content of any kind by default. No java, not even javascript. That and all the ad-blocking really limits likelihood of my getting infected from just an initial click, but even that isn't foolproof. IE once managed to let attackers get you just by viewing an image (CVE-2005-2308)

<comment><USER7> 0-days are not limited to javascript - the next one might well be in the canvas/image/svg renderer. When someone has targeted you with a 0-day and you load the site they compromised website, all bets are off.

</comment></comment></comment></comment></comment><comment><USER8> The specifics of this - the request to judge a prize one is clearly unqualified for - are we as software engineers particularly vulnerable to? Most people would, I think, conclude "this is fake, because why would I be asked to do this?". But I often think that as software engineers we fancy ourselves to have more insight into other fields than we really do. Does this ring true to anyone else?

<comment><USER9> Nearly every contest I've ever competed in has had judges who I didn't believe were vigorously qualified. Perhaps not in the final round, or in the most competitive sections, but they were there, somewhere, filling in the gaps. On the other side of the equation, I regularly got "please judge this contest" emails I wasn't qualified for while I was still in academia.

Falling for this phish woudln't need to be a matter of inflating one's opinion of oneself, it could simply happen by knowing that at the low end of contests, the bar for judging is low.

</comment></comment><comment><USER10> > Looking back it's obviously completely absurd that the University of > Cambridge would ask me to judge an economics competition

I don't think this really matters all that much. I might click the link anyway to find out what it is, or to find out why I am allegedly being considered, or even just out of general curiosity. It doesn't _stop_ the attack from working.

<comment><USER11> I think a process like with unwarranted phone calls is in order. Take the name and contact info provided but Google for the information yourself and contact the official site/email/phone number for information.

<comment><USER12> A word of warning: go to the actual site and find the contact details there.

I've seen an attacker change the contact details listed on Google search results (the ones that appear in the boxes) to their own.

I saw it used as part of a Windows help center scam, but I don't see why it wouldn't work here too.

<comment><USER11> That is what I had meant but not how my wording ended up. Verify the contact info from the vendor/firm's site itself if possible.

</comment></comment></comment></comment><comment><USER13> This is a fascinating story. It's funny though how, with compromised accounts at a highly reputable university and a 0-day exploit in one of the most-used pieces of software out there, they still managed to make basic grammatical errors in their phishing email. I mean, these people were clearly not messing around. Their attack(s) were highly targeted. And yet they still didn't check their written english!

If it hasn't already been tried, perhaps it's worth building a spam-blocker which checks for bad grammar and increases the spam score for every mistake found.

<comment><USER14> Can any of you recommend a way to create a sandbox that can seal off processes within a computer?

One option is to use a VPC on a cloud-hosted machine to access whatever emails, links, websites someone sends you, but this can be time-consuming and costs money.

This article claims that Docker would also not be a good solution:

[https://security.stackexchange.com/questions/107850/docker-a...](https://security.stackexchange.com/questions/107850/docker- as-a-sandbox-for-untrusted-code)

"...container solutions do not and never will do guarantee to provide complete isolation, use virtualization instead if you require this."

So is there any other way to create a sealed off sandbox on your own machine that would create a type of moat between your machine and your adversary?

<comment> noir-york I had written a jail for Windows a long long time ago - it was inspired by Unix's jail.

For an app you could configure what filesystem and registry access was allowed and you could redirect FS access.

Implemented it as a kernel driver that hooked into the relevant system calls. It was easier to do kernel dev back then (we are talking mid 2000's) - <USER2> havent touched windows kernel coding in years.

I wonder if Microsoft has implemented a jail for processes in recent versions of windows. Running browsers in a VM can be cumbersome.

<comment><USER15> Agreed about VMs in everyday use, and I'm wondering if the new Windows 10 Pro/Enterprise sandboxes would be a sufficiently safe alternative in these scenarios. After skimming this white paper it seems like they would, but I'm no expert in this area:

[https://techcommunity.microsoft.com/t5/Windows-Kernel- Intern...](https://techcommunity.microsoft.com/t5/Windows-Kernel- Internals/Windows-Sandbox/ba-p/301849)

</comment></comment></comment></comment><comment><USER16> Cool post. One small nitpick:

> Neil describes his pre-university education as "High School". We don't have > "High School" in the UK - we call it "Secondary School"

Not true at all I'm afraid. Where I'm from (Norwich) we had First / Middle / High School / (Sixth Form or college) splits, alongside other schools that did the Primary / Secondary / 6th split.

<comment><USER17> I've also seen High School used in Scotland

<comment><USER18> Cane here to say the same thing, e.g. [https://en.m.wikipedia.org/wiki/Inverkeithing_High_School](https://en.m.wikipedia.org/wiki/Inverkeithing_High_School)

Although, there's a subtle difference vs US usage: in Scotland High School is only used in the context of the name of a specific school, not as a term for the generic concept. E.g. "What secondary school did you attend?"; "I went to The High School" (meaning the Royal High School in Edinburgh). You'd never say "What high school did you attend?".

<comment><USER19> Even that point varies regionally. Where I grew up, in Glasgow, it's really common to talk about primary school kids going off to high school or talk about which high school you attended.

<comment><USER20> Agreed. I'm in my 50's and even back in the late 70's in Scotland you'd hear folks use "secondary school" and "high school" interchangeably. I myself went to a Scottish "High School" for my secondary education in the 70's/80's.

</comment></comment></comment></comment></comment><comment><USER21> "Neil, if you are real and this is your real LinkedIn profile then I am so sorry. But if you're so real then why did you copy someone else's self- description?"

I would love to find out that the profile _is_ real, and that the JPMorgan dude is actually a fake profile for another scam (for trying to cheat people out of money), who stole this guy's self-description :P

The beautiful outcome being that he'd have publicly shamed and picked apart the guy's entire profile and foiled another scam in one hit :)

</comment><comment><USER22> It's always nice to get a good healthy dose of paranoia in the morning. This makes me think back to how my sec professor had a separate system that he'd use to access his online banking.

<comment><USER23> To be honest, that's probably overboard. You're pretty much never liable for fraudulent fiat transactions. Crypto on the other hand...

<comment><USER24> Part of the fallout from fraud isn't being afraid of losing money. Banks and credit unions are generally on your side when it comes to disputing fraudulent charges. The hassle is getting it all sorted out - verifying identity with sometimes completely inept telephone reps, replacing cards, entering new payment information for recurring charges, etc.

<comment><USER23> On the other hand, there's also a cost to taking security measures. The time needed to maintain/switch to that separate system has a cost. There's a study[1] on this, but it's done with simple security measures with an unrealistically high probability of getting hacked.

[1] [https://arxiv.org/abs/1805.06542](https://arxiv.org/abs/1805.06542)

</comment></comment></comment></comment><comment><USER25> A case of "flattery will get you everywhere":

> I received a very flattering email from the University of Cambridge, asking > me to judge the Adam Smith Prize for Economics ...

> I wouldn't say I'm an "expert" in economics exactly, but the university's > request wasn't that surprising. I do have a subscription to The Economist > ...

> I've read a few books by Paul Krugman, but aside from that have never > studied or practiced economics

<comment><USER26> Which, in my experience, is not a typical tactic employed by phishers. Usually it's greed (Here's $50 million for you) or alarm (You've been hacked!).

</comment></comment><comment><USER27> That's interesting - there is indeed a grh37 at Cambridge but he's an undergraduate studying Chemistry at Selwyn. No idea about how that happened, but there's been a bunch of really poorly written Emotet/Heodo spam emails floating around the email system the past few years. I'd guess that he managed to get his account compromised while logged into Windows on a UCS computer (which would be a feat in itself, given how poorly written the first stage dropper is), his UCS account got compromised, and someone uploaded the malicious website to his public_html folder.

EDIT: Apparently they've blocked new user signups for DS-Web, but this is kinda pointless given that every new student is automatically given their very own live website until they graduate.

</comment><comment><USER28> This "spear" was also for a MacOS vulnerability. No doubt most Mac people think they're immune to viruses and malware, making this even more effective.

It is very well thought out attack.

<comment><USER29> A lot of recent high profile targeted hacks have been against macos (poker stars, Saudi activist, Chinese activists, ...).

Let's just agree that all platforms are vulnerable and anyone telling you otherwise should not be trusted.

<comment><USER30> All platforms are vulnerable; it does not follow that running commercial anti- malware products is good idea, or even likely to make you less vulnerable, on every platform, which is the usual context for "Macs and viruses" arguments.

</comment></comment></comment><comment><USER31> I thought myself fairly well informed about macOS, having run it since the 10.1 days, administering it over the years, etc. But TIL that the quarantine bit and gatekeeper which normally prevent unauthorized executables from running is trivially bypassed, as was the case in this attack.

My paranoia level has increased.

[https://objective-see.com/blog/blog_0x43.html](https://objective- see.com/blog/blog_0x43.html)

[https://speakerd.s3.amazonaws.com/presentations/9e724ea23343...](https://speakerd.s3.amazonaws.com/presentations/9e724ea233434f9fb083bff26bc7fb4b/ShmooCon_2016.pdf)

Yeesh.

<comment><USER32> I just checked my login items and found runChmm, adware that was apparently installed as part of an FTP client used at work. I was trying to replicate a scenario we see at work and got adware. Paranoia level increased indeed.

</comment></comment><comment><USER33> > _But all it would have taken is for the attackers to add the 7 words "THIS > PAGE MUST BE VIEWED IN FIREFOX" to the top of their page, and I'd have been > toast._

Unless you were smart and ran the NoScript extension or something similar.

Landing into malicious pages happens; you're not going to avoid it with 100% accuracy and have to be prepared with some sort of countermeasure.

</comment><comment><USER34> Note for the nitpicky, the attack discussed made use of not one, but two 0-days to accomplish the sandbox escape.

[https://www.zdnet.com/article/mozilla-fixes-second- firefox-z...](https://www.zdnet.com/article/mozilla-fixes-second-firefox-zero- day-exploited-in-the-wild/)

</comment><comment><USER35> > The joke was at least partially on them, since I've never owned any > cryptocurrency other than a handful of Stellars that I got for free and have > lost the password for. If they or any other attackers can help me get them > back then I would be very grateful.

This also happened to me - and after returning to the Stellar site years later, my old login did not work, and the page looked nothing like it used to. Were the free Stellar tokens ever really granted?

</comment><comment><USER36> I presume that I can I take it from the lack of comment on the Firefox angle that there are no concerns that Firefox is inherently less secure than Chrome?

<comment><USER37> Chrome had a nasty one back in March, so your presumption seems correct.

Really, the best way to protect yourself is to use an obscure OS, or a separate machine for web browsing. Sounds paranoid, but the web is THE main attack vector these days.

<comment><USER38> There are disadvantages to using an obscure OS too, in that it is likely slower to get security fixes, and may have more security flaws.

<comment><USER39> The only logical answer is to write your own OS

The ultimate security by obscurity

</comment></comment></comment></comment><comment><USER40> <soapbox> Every time I open the UI for the Ubiquiti UniFi console in Safari it complains that Safari may not work correctly and suggest Firefox or Chrome. Every time I curse at it, ignore it and have had no issues. The simplest way for me to not do want you ask is for you to tell me best viewed in X. If it does it working in Firefox, Safari, Chrome and Edge, then £#&$*=+&$% you. Do your job and test on the major platforms. My current company has a web UI and I make it a point when using the product to open it in a different major browsers each time I touch it. If there is an issue I file a Jira ASAP vs the UI team. </soapbox>

Okay I know this is about the Firefox security bug, but just a general rant anyways.

</comment><comment><USER41> I suppose it's easy to "Monday Morning Quarterback" this one, especially after we now know it's a hoax, but honestly this is more fuel on the fire of: Never respond to random people on the internet asking you for information or to do something. Random people knocking on your door are almost always selling something, and random people contacting you over the Internet are almost always scammers.

The story could have ended at "I wouldn't say I'm an "expert" in economics exactly". Then why are you going and doing what this rando is asking you to do? Deep six the E-mail and move on with your life.

<comment><USER42> That's just really not true. Especially not in a professional setting.

I deal with this personally all the time, as the founder of a national conference series. We reach out to people cold all the time and invite them to prominent speaking roles. Sometimes people are surprised to hear from us or don't think of themselves as public speakers but we're most certainly real and serious.

I get it the other way all the time now too, people reaching out wanting to partner, work together, have us write articles about them, whatever.

These are all super common use cases. There's a lot of business that gets started by an introduction from a random person on the internet.

<comment><USER41> As is true for most HN posts, I should have prefaced with "In most but not all cases..."

People who do not happen to be conference organizers or frequent recipients of legitimate cold calls should, in most cases, ignore unsolicited messages from strangers.

<comment><USER42> Or business development executives. Or freelancers. Or journalists. Or academics.

Or like anyone who has some level of networking as part of their job. Which is a _lot_ of people.

The point being that most people need a better system than "ignore every email that you get from a new contact".

</comment></comment></comment></comment><comment> dan-robertson One thing the article goes into is all the signs that the mail was fake. I think focusing on how one can spot such attacks is slightly silly for two reasons:

1\. If these errors caused attacks to be unsuccessful then I expect (competent) attackers would stop making these mistakes

2\. Plenty of real people make spelling errors or write single sentence paragraphs or even plagiarise things (or have their own descriptions plagiarised). Real people also host group things on personal sites. I think relying on this sort of thing is too likely to lead to false positives (and its a lot easier to spot the "signs" once one knows the email bad) and too unreliable in the long term for reason 1.

One thing I wonder is how this sort of thing might be prevented. It seems that once one's pc is compromised there isn't much one can do; newer security mechanisms like security keys don't help much if the device is compromised. I don't know how hardware bitcoin wallets (or similar devices) work so I can't say whether they might have protected the targets of this attack, although I would guess they would not.

Sometimes I wonder if this is something there should be insurance for, but would anyone buy it? I think it would have to start as insurance for companies (which would require large numbers of companies to consider a breach like this a major financial risk) before people but such attacks would have to be unlikely enough to be successful for the insurance to be cheap. I suggest insurance with the vague hope that an insurer would want their customers to be more secure to decrease the chance they have to pay out. I don't know if it would work that way in practice.

<comment><USER43> A hardware wallet is safe even if the computer is hostile. That's why they exist!

However it's possible that some other attack method could be used, e.g. compromising the user's email account and going from there.

</comment></comment><comment><USER44> I thought 0-day exploits could be sold for a significant amount if money. I wonder if the hackers bought one, or, found one and thought they could make more on their own than by selling it? And, if they did buy one, what was the return on their investment?

<comment><USER45> If the 0-day can be sold, then what do the purchasers do to recoup their investment? Aren't attacks like this one of the main reasons that a 0-day will have value? Even malicious state-level actors will likely use the purchased vuln in an attempt to gain access to a target system (potentially via similar spear-phishing methods); although in that case their motivation will be access to information rather than financial gain.

</comment></comment><comment><USER46> I think the real moral of this story is that (like the fun vulnerabilities on Flash and Java that we might remember), a combination of keylogger or strange daemon might be running suddendly on your machine, scanning your files, either on OSX or Windows. Simply visiting a website. So better (as said) is to use a separate VM to access trusted domains (and yes, also VMs aren't these days so trustable). Better to use 2FA and ciphering on-disk sensitive info and loose the habit (if any) of storing a large number of files that streams from locally mounted cloud accounts, like Google file stream, Onedrive files-on- demand and so on.

<comment><USER47> _So better (as said) is to use a separate VM to access trusted domains (and yes, also VMs aren 't these days so trustable)._

I would use the VM for accessing untrusted domains. If an exploit has your host system, then it also has the trusted VM.

 _ciphering on-disk sensitive info_

If an exploit has root-kitted your system, encryption does not help much. Presumably you have the unencrypted volume mounted, moreover, the attacker could log keystrokes.

If your machine is compromized, it is basically game over. Change all your bank accounts, e-mail, etc. credentials immediately, wipe the disk. By suspicious about any file the malware may have touched.

</comment></comment><comment><USER48> Systematic dropping of definite article makes me suspect the author may be a native speaker of some eastern language with limited knowledge of English.

<comment><USER39> It's odd that they would have limited knowledge of English yet understand the prestige of Cambridge, be able to create genuine looking linkedin pages and target the attack so well. If you're going to that much trouble running a spell checker over he email would seem like a reasonable step?

Most likely it's a deliberate attempt to target people who are excited enough by the email to not notice the grammar.

<comment><USER49> Foreign language speakers aren't stupid. You can Google "famous school England" in any language.

There's no "second step" to this con. You don't have to get tricked into wiring them money. If you visit the page, you lose.

<comment><USER39> Exactly, they're not stupid. So you'd expect them to use a spell checker if they intended for the attack to have a high success rate on English speakers.

There may have been a second step for the attackers goals after the zero day, e.g. ransomware or some other social engineering

<comment><USER48> A spell checker still doesn't detect faulty grammar.

<comment><USER50> A sufficiently good one does, grammarly being the most well-known example I'm aware of.

</comment></comment></comment></comment></comment></comment><comment><USER51> Funny that the browser that has been selling so much on privacy falls victim to such a vulnerability.

In any case, if a site says "this site must be viewed in Firefox" that would be a huge red flag, and all the more reason for me to leave. There aren't really any features in Firefox that other browsers don't have.

<comment><USER52> > Funny that the browser that has been selling so much on privacy falls victim > to such a vulnerability.

All browsers fall to such vulnerabilities -- Chrome had one in March this year. The difference is that some browsers (again, Chrome) are malicious by design instead of only by accident.

</comment></comment><comment><USER53> There are valid points about being tricked here, but it's all kind of irrelevant in the presence of a javascript 0-day. You don't actually have to trick anyone to use one of those; just make an interesting post on tumblr and away the hacks go. Trying to never get hit with a 0-day is a pipe dream.

</comment><comment><USER54> The two questions that immediately jumped to my mind on this are

1) does Coinbase's user base skew more towards Firefox than the average, possibly because of perceived better security/privacy and a desire for that among cryptocurrency users?

2) did the zeroday impact Tor browser users, and does Coinbase have a lot of those?

<comment><USER55> I don't think Coinbase users are looking for security/privacy. To be specific, Coinbase is considered a novice cryptocurrency user platform since they have some relatively hefty fees in exchange for being simple to use AKA "It's for normies".

</comment></comment><comment><USER56> Is it still spear-phishing when it's not a phishing attack but an 0day? Is there a better term?

<comment><USER23> AFAIK spear phishing refers to the fact that the attack is tailored/targeted, rather than mass mailings.

<comment><USER57> The "spear" means it's targeted, but it's still "phishing" \- meaning the attack vector is a cloned version of a legit page

I guess this should be called spear-hacking?

<comment><USER58> This seems to fit the classic definition of spearphishing; the atack vector is an impersonated/fake version of a legit _email_ and its sender. No matter if the payload is in the form of an attachment or web link or a request for some physical action (e.g. please scan and send a copy of your ID) that would fit the phishing title.

</comment></comment></comment></comment><comment><USER59> If you have a significant amount of cryptocurrency, get a hardware wallet.

</comment><comment><USER60> I'm seriously thinking a dedicated Docker container just for reading email is a pretty good idea.

<comment><USER61> How would that help?

<comment><USER62> It would mean you need an additional vulnerability to escape the VM sandbox.

<comment><USER61> Yeah if you check email in a VM. But how would a Docker container help?

<comment><USER62> Maybe I'm using terms interchangeably when I shouldn't be (I haven't jumped on the containerization bandwagon), but a Docker container is still just a "VM light", right? Part of its purpose is to isolate the things running inside of it from anything else running on the system. I'm fairly certain my comment still stands if you just `s/VM/container`.

<comment><USER61> No.

Docker isolation is for convenience not security isolation.

</comment></comment></comment></comment></comment></comment><comment><USER63> So did the attackers get control of a Cambridge e-mail account and web page?

<comment><USER15> That was probably the easiest part of their escapade, sadly — spoofing a WiFi access point with a fake portal comes to mind. Or posing as IT and mass- emailing the university directory (which are rather easy to scrape at most universities), keyloggers on lab computers, etc. Always possible that it could have been as simple as just asking!

Out of ~20,000 students and ~10,000 staff, they only needed to get lucky once, unfortunately.

</comment></comment><comment><USER64> How can I check if I am infected?

</comment><comment><USER65> > Neil describes his pre-university education as "High School". We don't have > "High School" in the UK - we call it "Secondary School". This might make > sense if Neil was American, or trying to communicate with an American > audience, but there's no indication that this is the case.

Many secondary schools in the UK still have "High School" in their name. I've always used the two terms interchangeably, but maybe that's because I went to "<TownName> High School", or maybe it's because I'm old.

<comment><USER38> This particular school (the Perse, in Cambridge) calls its secondary section the "Upper School". It's also quite expensive.

</comment></comment><comment><USER66> I don't understand the point of using compromised Cambridge accounts for this. All they wanted people to do was to just click on a link. They could have easily registered some legitimate sounding domain name and linked to that instead. It wouldn't be unusual at all for an academic organisation to have a separate site.

<comment><USER67> It is a prestigious domain - with a high recognition factor. And, as part of that, it will almost never be blocked by URL / DNS filters.

In this case, it clearly worked. The user saw cam.ac.uk and trusted it.

<comment><USER68> I wonder if the attackers were also thinking that these users would more likely be using macOS. The exploit they were using only works in Firefox on macOS.</comment></comment></comment>


Origami Crease Pattern Design Proved NP-Hard - <AUTHOR> http://www.technologyreview.com/blog/arxiv/25591/?ref=rss

<comment><USER2> Erik Demaine is one of my favorite CS people. His MIT OCW course on Algorithms/CLRS is definitely worth seeing.</comment>


Ask HN: posting to blog+fb+Twitter+newsletter? - <AUTHOR>

Does anyone know of a tool where one can write a message which gets published onto a FB page, twitter stream, mailing list and blog? Something like buffer with additional outlets? Ideally a good looking easy to use desktop app? <comment><USER2> Can't you turn it around and use blogging software (hint: WordPress), which have the ability (hint: plugins/extensions) that publish your stuff to the different media?

</comment><comment><USER3> hootsuite?</comment>


Should governments vaccinate computers the same way they vaccinate children? - <AUTHOR> http://www.newscientist.com/article/dn18635-innovation-sending-botnets-the-way-of-smallpox.html

<comment><USER2> Upvoted because it's interesting that they're thinking like this, and relevant to HN. But it's still a horrible thought.

 _He says internet service providers (ISP) should have the power to sever internet connections if they detect a subscriber has infected computers_

They have that potential now. They just need a service contract that allows them to do so, and it's as good as done. I can only interpret the fact that they're not doing so to mean that ISPs believe the cost of doing so exceeds the costs of dealing with spam, etc.

 _When an ISP detects that traffic flowing across its infrastructure bears the hallmark of a botnet - such as data being directed to a blacklisted address or sudden torrents of email traffic from a single machine - they would be empowered to quarantine their subscriber, destroy any malware found on the user's machine, and vaccinate it by installing the latest security software._

What a horrible idea. Cutting the user off is one thing. Forcibly applying security software is something else entirely.

Without a knowledge of how my system is set up, they're as likely to destroy it as to fix it.

For them to do this in the first place, they'd need root access to my system. I can't even begin to enumerate the ways this is bad.

And it's probably not effective anyway. If there's an official security software, or even a small list of them, it creates an easy target for the bad guys to work around. They'll build their attack code with the knowledge of what they need to avoid.

<comment><USER3> _And it's probably not effective anyway. If there's an official security software, or even a small list of them, it creates an easy target for the bad guys to work around. They'll build their attack code with the knowledge of what they need to avoid._

Virus writers already do this _today_. They acquire a bunch of current AV programs, and test the virus on boxes with up-to-date AV. They don't ship the virus until it passes that test case.

<comment><USER2> That's true, but this would exacerbate the problem. Right now there's a relatively large list of possible AV programs that they need to get around.

But if it were known that, e.g., Comcast has a contract with McAfee to provide AV software, then the list becomes shorter, and may make it easier to target specific populations.

<comment><USER3> I think we're in "violent agreement". I absolutely agree the suggestion is a bad idea, and this will make it worse. My original comment was intended to bolster your argument.

I can't find the link right now, but a story claimed that the top 3 AV programs covered 75% of the market. I don't think dropping to 1 program to test against strains the virus writers significantly.

</comment></comment></comment></comment><comment><USER4> I don't know any statistics but I would say that the number 1 problem here is Windows and the almost-mandatory need for an antivirus they are trying to enforce.

So on one hand you have a widely-used but broken product (Windows) that needs another usually costly product (the antivirus). Both need to be kinda up-to- date in order to have this run smoothly and virus free.

So I'm not certain the government could just "vaccinate computers" (by upgrading Windows/antivirus): just think of the user-level applications incompatibilities.

But the governments might think about what does it mean to have a critical global infrastructure product that depends only on one (foreign) company: Microsoft. I wouldn't like that... So while nationalizing stuff doesn't sound really nice, perhaps the government(s) should start defining some regulations on the quality of Windows as well as a control body. But this is an even less reliable, corruption-sensitive, bureaucratic situation.

In the end perhaps it's best we leave things the way they are.

<comment><USER5> In Germany there have been some initiatives to use open source in the government.

If nothing else, more diversity is good against class action breaks.

</comment></comment><comment><USER6> I think a better option would be mandatory training before being allowed to use a computer. Just like we certify you to be able to drive, you should be technically competent enough to use a computer. Taking the driving metaphor further, the gov't could enforce the use of security products to protect yourself much like we enforce the use of seat belts here in the US. We don't force you to wear seatbelts but if you're caught without one you get a ticket. No antivirus and running Windows? That'll be a ticket and a fine. Oh yes, I said "fine". Never underestimate the governments willingness to "tax" it's citizens.

<comment><USER7> over 40 million people have died in car crashes. That license thing doesn't work so well.

</comment></comment><comment><USER8> The difference is that with a human you vaccinate at a much lower frequency. With a computer you have weekly anti-virus updates, many different software programs to patch (not just the OS), and all the complexity of running a huge variety of software on a huge variety of hardware.

The simplest solution would be to compel operating system manufacturers (not consumers) to provide adequate safeguards similar to what the FCC does to the airwaves.

<comment><USER5> Consumers already have that choice. They tend to prioritize different things. (Though you could argue that we should interalise the externalities of running a bad system.)

</comment></comment><comment><USER9> As far as I know, something along these lines already exists in Canada. Not the "vaccinating computers" part, but I had a few friends in college who had their internet cut off until I ran a virus scan on their computer.

It was a pain in the ass, but I'm sure the ISPs appreciated being able to cut off infected PCs from their networks.

</comment><comment><USER10> It's too bad the author is writing for a prominent website, instead of terrorizing a homeowners association somewhere. It should be abundantly clear to anyone that has ever dealt with the government in any capacity that the incompetence is thorough and complete, yet people continuously invent new brilliant ideas to inject them into everything.</comment>


Dad Photoshopped Ewoks Into His Family Pictures to Convince Kids Ewoks Are Real - <AUTHOR> http://gizmodo.com/5843037/a-dad-photoshopped-ewoks-into-his-family-pictures-to-convince-his-kids-ewoks-were-real

<comment><USER2> Very cool. As a father myself, I can relate. It's really touches me when a simple thing like this (with all of our tech at hand) can just influence our children for the better.

I also used photoshop to replace my daughter making a funny face in our Xmas picture with another shot a few frames back. Voila...everyone got their Xmas cards and no one was the wiser.

</comment><comment><USER3> ", I think I'm pretty much going to brainwash them into thinking stuff " scares me.</comment>


Twitter has shut off the ability for some people to tweet after hack - <AUTHOR> https://www.theverge.com/2020/7/15/21326372/twitter-hack-bitcoin-scam-new-tweets-shut-off-verified-accounts <comment><AUTHOR> The hack itself, on HN:

[https://news.ycombinator.com/item?id=23851275](https://news.ycombinator.com/item?id=23851275)</comment>


Algorithms to Replace Marketeers. Here's How? Paddy Cosgrove, Websummit's CEO - <AUTHOR> https://www.facebook.com/events/480470448789572/permalink/522616867908263/ <comment><AUTHOR> Paddy explained how it is likely that future agencies would be run by mathematicians & statisticians. And how "for example, the next time you see an ad for Web Summit on Facebook, realise that that ad might only be shown to another 15-150 people out of Facebook's 1.5 billion users. And furthermore in some instances that ad might only be shown to you for a short period of time before that ad self-pollinates with something probabilistically even more creative or compelling, or is simply stopped. That's personalising not for the 1% but for the .000001% of users, without almost human intervention whatsoever."</comment>


How Microsoft killed off a massive botnet, with trademark law - <AUTHOR> http://www.washingtonpost.com/blogs/wonkblog/wp/2013/07/24/how-microsoft-killed-off-a-massive-botnet-with-trademark-law/

<comment><USER2> Along with FireEye and Pfizer: [http://www.businessweek.com/magazine/content/11_26/b42340727...](http://www.businessweek.com/magazine/content/11_26/b4234072712001.htm)

Disclaimer: Alex Lanstein is my brother

<comment><USER2> Note: We do not actually have a 65" computer monitor in our living room

<comment><USER3> I'm really curious why the article states that. So many questions. Do you not have a 65" monitor or is it just not in the living room?

<comment><USER4> I would hazard a guess that it's an HDTV, and Alex just hooked his laptop up to it for awesomeness purposes when the reporters were over.

<comment><USER2> Correct :)

</comment></comment></comment></comment></comment><comment><USER5> Fantastic but I am a bit concerned here. You seize my equipment if it is being used to violate some trademark? This may have been used good _in this case_ but I shudder at the thought of how it might be abused.

<comment><USER6> They seized the c&c servers, not the infected bots/clients</comment></comment>


HN continues to impress - <AUTHOR> https://news.ycombinator.com/newest?next=18566187&n=601999123417283478923742782987384789237894 <comment><USER2> HN is written in Arc that is written in Racket that has bignums, so you it can handle very big numbers.

(But if you add and stupidly amount of 0's, the server refuses to use the number and start with 1. I guess it has some kind of filtering.)</comment>


How companies test their mobile apps - <AUTHOR> http://blog.testmunk.com/how-companies-test-their-mobile-apps/

<comment><USER2> Automation testing is wonderful for all the test cases and issues you anticipate or understand - but it can't deal with the issues people see on real world devices. The right answer, imho, is a portfolio-based approach with unit test, automation and manual testing.

</comment><comment><USER3> Anyone know an affordable way for a bootstrapped startup to automate this? Testmunk looks like a good platform but the price (at least for us) is out of a small startup's price range.

</comment><comment><AUTHOR> Curious to hear about any other experiences? What are your best practices?

</comment><comment><USER4> I know from experience the hassles of point and click testing when a previous company tried to skimp on QA...my job was to write the user stories, but ended up testing half of them myself. Not enough testing at all, especially considering it only consisted of 4 devices, all of the same model. (PM, developer, a secretary and one QA guy later in the process testing on a company given device). The worst part was that even on the same device model, different results were happening. That ain't right. All in all, would have killed for some automated testing on that project. On a side note, wish I could provide some info (a warning)on what the company was that operated in this manner, but I can't.</comment>


Spotify Introduces a New Podcast API - <AUTHOR> https://podcasters.spotify.com/blog/spotify-introduces-new-podcast-api <comment><AUTHOR> Here are the endpoints they released.

[https://developer.spotify.com/community/news/2020/03/20/intr...](https://developer.spotify.com/community/news/2020/03/20/introducing- podcasts-api/)</comment>


Apple fans returning new MacBook Pros with Core i9 - <AUTHOR> https://finance.yahoo.com/news/apple-fans-returning-macbook-pros-154205304.html <comment><USER2> Headline: "Apple fans are returning their new MacBook Pros that cost a minimum of $2,800 because they can't reach the advertised speeds"

Actual data: two Reddit comments that say they're going to return their MacBooks

What's wrong with the headline "Youtuber finds New MacBook Pros Not Performing as Advertised" or "Youtuber finds Cooling Issues with High Performance MacBook"?

It's basically useless to read headlines from most online news sources these days.

<comment><USER3> The whole piece does have a general hot air feeling to it...

<comment><USER4> Something these macbooks produce a distinct lack of..?

</comment></comment></comment><comment><USER5> They could just rebrand it as a powerful tool designed for arctic climate research.

</comment><comment><USER6> i've decided to cancel my order (still 2 weeks out) and instead get the i7. so now you have 3 data points.

</comment><comment><USER7> Discussion on a similar article from yesterday: [https://news.ycombinator.com/item?id=17567729](https://news.ycombinator.com/item?id=17567729)

</comment><comment><USER8> What's up with Apple? Seems to me like they should have just dropped the i9 option altogether, since they couldn't make it work. It just further torpedoes their fading reputation for being able to build top-notch hardware.

<comment><USER9> They are re-living their 2003-2004 period when the IBM PPC G5 CPU was way too hot and power hungry to put in the PowerBook and it needed water cooling in the PowerMac. Back then their solution was to switch to Intel CPUs. Now it's probably going to be to switch to in-house designed ARM CPUs.

<comment><USER10> _> in-house designed ARM CPUs._

What could possibly go wrong!

<comment><USER9> With the CPU design or the transition to a new ISA? Lots of things can go wrong at any time even by doing nothing. But Apple does have a team of pretty good engineers that managed to design what's probably the fastest (best?) ARM cores on the market, and with good enough perf/Watt numbers. So I doubt their biggest hurdle will be to design a CPU.

It will be to split the "MacOS" ecosystem in 2 and maintain two branches for x86 and ARM. And while they also have a team of pretty good software engineers with x86 and ARM experience they are already having major quality control problems lately. Having to maintain a dual ISA MacOS will be a challenge. Then they have to provide the legacy compatibility in order to convince people to buy into something with little to no support for most of what's out there today.

But you know... we could use some diversity in this space. I wish them all the best.

<comment><USER9> @394549, I don't doubt that they can do it, as I was also saying a couple of comments above this one. But at what price? The difference is that now they have big QA issues _before_ having to maintain the 2 branches. Their software (and possibly the software team) a decade and a half ago when they were moving to Intel was in a lot better shape. Unless I'm looking at this through nostalgia goggles. :)

<comment><USER10> They were also moving to a well established architecture from their own bespoke one and now they're going the other way ...

<comment><USER9> ARM is a well established ISA. The customization Apple might bring to the CPU architecture will make no difference to a user as long as the compatibility is there.

The problem is that as established as ARM is they really don't have a meaningful presence in the desktop/laptop ecosystem. You have probably tens of thousands of apps for the mobile space but even if Apple magically adapted them for a non-touchscreen, keyboard and touchpad world the vast majority still won't cater to the regular or professional user wanting to buy a laptop, not a glorified tablet. And that's a hard sell. Why am I buying a MacBook if all I get is an iPad with a keyboard? And don't get me wrong, having used both iPads and CoreM ultraportables (Apple or otherwise) the iPad offered the better experience more often than not. But if I compare it to the regular CPU it just can't compete. The productivity with mobile apps is not where it should be to convince a normal buyer to switch, let alone a more demanding user.

<comment><USER10> _> The problem is that as established as ARM is they really don't have a meaningful presence in the desktop/laptop ecosystem_

Yes. Not established. That's what I said.

<comment><USER9> "Not established" and "not established in a specific segment" are two vastly different things. So no, most definitely I didn't say what you said, or what you think I said. ;)

<comment><USER10> Aye, but you said what I meant.

Look at another way - Apple moved from PowerPC to Intel. It's not that Motorola ISA weren't well established but they simply weren't as well established and didn't have access to the same mindshare in terms of high performance hardware and software engineering.

So in this sense it's a step back the other way - except for perhaps Intel seem to be stuck in the mire these days.

</comment></comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER11> It's not the CPU - it's the combination of the GPU and CPU. The CPU only benchmarks run without throttling

[https://www.geekbench.com/blog/2018/07/macbook-pro- mid-2018-...](https://www.geekbench.com/blog/2018/07/macbook-pro- mid-2018-throttling/)

<comment><USER12> Geekbenchmark runs it tests in bursts with short delays between them to allow for the SoC to dissipate heat. They implemented that so laptops and cellphones wouldn't overheat, or thermally throttle while running the benchmark.

[https://www.xda-developers.com/geekbench-ceo-fireside- chat-p...](https://www.xda-developers.com/geekbench-ceo-fireside-chat- pt-1-64-bit-mobile-throttling-scores-design-a-benchmark-and-more/)

I get that Geekbenchmark is extremely accessible, but it is not rigorous.

Citing a benchmark that's designed to avoid thermal issues, as proof a chip doesn't have thermal issues is just bad.

<comment><USER13> The article in question above is from the geekbench team compiling their geekbench suite over and over to force the overheating issue.

The blog post is not about benchmarking with geekbench at all.

John Poole found that using only CPU bounds tasks (compiling) wasn't that bad for the thermals.

</comment></comment></comment><comment><USER14> Surely, Apple saw these issues in their internal tests. I don't understand how Apple (or any other company that does something similar to this) decides to release the product knowing all of the issues beforehand.

</comment><comment><USER15> Why is the Aero 15x so much faster? It seems to be an i7 with a slower SSD.

<comment><USER16> The specs show it available up to gtx1070 maxq which sounds pretty powerful for 15".

</comment></comment><comment><USER17> Meta: Can the link be changed? The one right now is:

[https://www.google.com/amp/s/www.yahoo.com/amphtml/finance/n...](https://www.google.com/amp/s/www.yahoo.com/amphtml/finance/news/apple- fans-returning-macbook-pros-154205304.html)

It looks like a (AMP) copy of a (AMP) copy of a web page. Just [https://www.yahoo.com/amphtml/finance/news/apple-fans- return...](https://www.yahoo.com/amphtml/finance/news/apple-fans-returning- macbook-pros-154205304.html) or [https://www.yahoo.com/finance/news/apple- fans-returning-macb...](https://www.yahoo.com/finance/news/apple-fans- returning-macbook-pros-154205304.html) would work.

<comment><USER18> Yahoo uses oath and doesn't adhere to GDPR. The HN link does, though I dislike AMP anything is better than oath.

</comment></comment><comment><USER19> Lol, AMP showing a google.com domain. Why are sites opting to send traffic through Google?

<comment><USER20> A Google-AMP version of a story published on Yahoo Finance syndicated from Business Insider. What a time to be alive!

<comment><USER21> A Google-AMP version of a story published on Yahoo Finance syndicated from Business Insider about a Reddit thread, no less. Turtles all the way down.

<comment><USER22> A Hacker News post about a Google-AMP version of a story published on Yahoo Finance syndicated from Business Insider about a Reddit thread.

There are a lot of turtles!</comment></comment></comment></comment>


Why won't anyone buy my apps? - <AUTHOR>

So I'm pretty new to the world of software development but I believe I've put together at least a couple of good apps for Android, but getting found in the Android Market is a joke. I've tried getting apps reviewed by review websites but this has its own set of challenges, so now what do I do to get word out about my apps and get people downloading them?
Here's an example of one of my apps - https://market.android.com/details?id=com.platinumapps.platinumtasks&feature=search_result
All suggestions & feedback welcome. <comment><USER2> No one's said the magic word yet, so I'll bite: Freemium?

Replace the gray checkbox app icon with a smart looking man/woman winning at life all thanks to Platinum Tasks.

Give us a promo code to try it for free, so that we can post reviews.

Note in the search results for "Google tasks", a lot of the apps on the first page also have "to do list" in their names. Maybe yours should too.

See this discussion for more ideas - <http://news.ycombinator.com/item?id=2768376>

And don't give up. The thing with selling is, _you've got to sell_.

<comment><AUTHOR> Great advice, thanks for the insight. Would love to look at Freemium but flat out working on other improvements and functionality at the moment to include it, but here's an idea - do you think (in your opinion, and anyone else who is reading) that doing a short-term promotion here and reducing the app to $0.99 (the lowest price I can make it, because it's not possible to swap between paid and free in Android Market) would be enough to entice people who read about the app here to try it and provide reviews to help get the word out?

I'll certainly spend time working on the wording in the Market listing to see if we can get moved up closer to the top, or at least start appearing on the first page and I'll also check out that link. Thanks again for your feedback, I really do appreciate it.

<comment><USER2> Can you make a free version with reduced functionality, called, say, Gold Tasks? Cross promote from there or do in-app purchases/upgrades if Android has that.

<comment><AUTHOR> Yeah that's sounding like a pretty good idea so people can get a feel for the app and then hopefully upgrade to get some of the more advanced functionality. Thanks for the feedback.

</comment></comment></comment></comment><comment><USER3> I tend to only download apps that are recommended to me, since random downloads have never worked out so great. For instance, the one I use now for task management is called Wunderlist. Google them and see how much effort they put into their marketing and brand. It works!

I'd suggest using them as a template for how to arrange your marketing / user adoption and go from there.

Best of luck!

<comment><AUTHOR> Thanks for the advice - I'll definitely take a look at Wunderlist and see what we can learn from them. Much appreciated.

</comment></comment><comment><USER4> This isn't really my forte, but, if it helps..

Since you're tablet-focused, and we have an upcoming Amazon Tablet, any chance you can leverage some of Amazon's promotional techniques with their store (keeping <http://news.ycombinator.com/item?id=2837185> in mind, of course)

<comment><AUTHOR> Yeah I've heard plenty of horror stories about the Amazon Store and that link you provided is a good example, plus there are plenty of others out there too. Once the Amazon tablet arrives it may be worth looking at it again because everyone is obviously tipping it to be a huge seller thanks to the popularity of Amazon, so we'll definitely have a look. Thanks for the advice.

</comment></comment><comment><USER5> When I search for "Google tasks" in the Android Market, you're not on the first page of results. If you can't break in that way, and you don't have some spit-take inspiring new feature that would generate special press, you're simply going to get lost in the crowd.

<comment><AUTHOR> Yep, I agree, being on the first page would certainly be helpful with people finding the app, but trying to game the keywords system CAN result in the app being suspended so I'd rather not risk it.

While the app doesn't have a revolutionary feature, the design & functionality are exceptional (from customer e-mails, not just my thoughts) and it does what it's meant to do, well, and the feedback I get from customers is overwhelmingly positive.

Another issue: Google still haven't made it possible to submit app reviews on Android tablets (you have to go to the Android Market website) and given this app is for tablets, it means users aren't writing reviews which would certainly be helpful.

</comment></comment><comment><USER6> You appear to be targeting the Android tablet market exclusively. That's a pretty small segment (Android beats iOS in phone sales, but appears not to be doing well in tablets), so don't be surprised if phone-friendly apps get a lot more users.

<comment><AUTHOR> Yeah, we deliberately targeted Android tablets because of the functionality & user-experience we could deliver on the larger screen, but you're right to say Android tablets haven't caught on as fast and Android phones have. Hopefully they'll take off as better devices become available (as was the case with Android phones - remember the G1?) but until then we just need to try and reach all the current Android tablet users. Thanks for the feedback.

<comment><USER7> I co-developed a paid app on the iOS app store and we have and iPhone and iPad version. The iPhone version sells on the order of 10 times the iPad version. We also have an android phone version which probably sells about the same as our iPad version. So I would agree with the analysis that an app that targets Android tablets exclusively at this point is probably aiming at a very small market.

</comment></comment></comment><comment><USER8> One thing--the curved edges feel very iOS'ey, Android is usually characterized by less to no rounding. Probably less for your case. Other than that it looks great.

<comment><AUTHOR> Thanks for the feedback. We focused on the design with the goal of designing an app that is not only functional & easy-to-use but also looks slick, which isn't as common in the Android Market as it is in the iTunes App Store. Hopefully users will notice the difference between this app and other apps that are built by without the same consideration, and so the challenge continues.

<comment><USER8> The only reason I said anything was because I noticed how much you had put into making the app look as good as it does (very good). Everyone's a critic, right? :)

<comment><AUTHOR> Yep, everyone is a critic :-) Thanks for the feedback, I appreciate it.

</comment></comment></comment></comment><comment> mkr-hn Have you done any promotion outside review sites? Try emailing Lifehacker and some of the major Android-centric blogs.

<comment><AUTHOR> Not much so far, but will certainly drop Lifehacker a line and focus on reaching out to Android-centric blogs. Thanks for the advice.

</comment></comment><comment><USER9> >I've tried getting apps reviewed by review websites

Which review websites? And did you write to them asking nicely to be featured or did you give them a "back-hander?"</comment>


Life and death of Microsoft Kin: the inside story - <AUTHOR> http://www.engadget.com/2010/07/02/life-and-death-of-microsoft-kin-the-inside-story/

<comment><USER2> This is great reading for any young engineer graduating from school and considering where to place his talents.

I would draw such attention to the 'death march' that occurred - where people knew the project was a failure but the company continued to build and ship because of a contractual obligation. This is the stuff of big enterprise, where the costs of shipping a failed product are less than the cost of missing an obligation.

Even if you have decided you don't want to work at a startup, there are big companies (SME's) and and there are BIG companies (massive corporations). Microsoft is obviously one of the latter, and so you gotta ask yourself whether this is a situation you would want to risk finding yourself in.

It's fine if you are a middle-aged "9-5 career programer" who doesn't really care what he is building and just wants to earn money to give his family a comfortable life, pay for his golf habit... but it is not an environment any young aspiring engineer should end up in.

Sadly many do and I fear this very eventuality for friends who tell me how excited they are to be applying to Microsoft... :(

<comment><USER3> Microsoft is a very different company depending on what division you're in and what you're working on. Sure, there are parts of the company that are less exciting for your typical just-out-of-college hire, but as someone who joined a little over a year ago in a similar situation, I can say I'm quite happy with what I do and with my experience so far. Don't paint the entire company with a single broad brush.

<comment><USER4> I imagine that's exactly what the folks on the Pink team were saying right up until Lees pulled his coup and wrested control away from Allard. Mobile was moribund and Pink was a fresh break from the past. They must have been exciting, heady days full of optimism and fighting spirit.

Then suddenly it all changed, and that's the problem with companies run as warring city states. You're at the mercy of a change of weather.

</comment></comment></comment><comment><USER5> _While it's hard to argue that Kin is an awful product, the saddest part of the story is that many of the people responsible for it knew it was -- they were largely victims of political circumstance, forced to release a phone that was practically raw in the middle._

Oh god, how much infighting could Microsoft chuck if Microsoft could chuck products? A lot apparently.

</comment><comment><USER6> I think the saddest part in all of this is that the people who say 'no' are always vindicated. Could the Kin have been a hit? Who knows. But by cutting impassioned people from the project and gutting backing, it was doomed to fail.

And the skeptics get to say, "Look how much I saved by not investing any more in this product! God, imagine if we spent ten thousand more hours working on this, how much more we would have lost!"

<comment><USER7> I read an interview with Dean Kamen a while back where he said the hardest thing about inventing things is knowing when to quit.

<comment><USER8> The problem here is not just when they quit but how they quit. I think MS is going to take a hit in their reputation over this and it is going to carry over into soured trust from crucial carrier partners (and really any other business partner) going forward.

Had they gone to Verizon and said "hey, I know we had a deal, but our business plans have changed and here is something that will be much better for both of us" then they could have killed it cleanly. It might have cost them some amount in terms of a dollar figure but it would have cost them a lot less in terms of reputation. Deliberately sabotaging something that you are doing in collaboration with a partner so that it fails on launch is a real trust breaker. How much faith would you put in Microsoft for the launch of WP7 now if you were Verizon? You certainly wouldn't be putting your business on the line.

<comment><USER4> Even without the Kin debacle, if I were being paid $1,000 an hour to advise partners about their relationship with Microsoft, I would suggest they look at PlaysForSure. It is NOT news that Microsoft will screw its partners, and they know it when they go into business with Ballmer.

 _Your father did business with Hyman Roth, he respected Hyman Roth... but he never trusted Hyman Roth!_

<comment><USER9> " _'You made a mistake, you trusted us,' said 3Com founder Bob Metcalfe, quoting an unnamed Microsoft executive._ " ([http://www.pbs.org/cringely/pulpit/2002/pulpit_20020620_0007...](http://www.pbs.org/cringely/pulpit/2002/pulpit_20020620_000736.html))</comment></comment></comment></comment></comment>


How money is created [pdf] - <AUTHOR> https://www.snb.ch/en/mmr/speeches/id/ref_20180116_tjn/source/ref_20180116_tjn.en.pdf <comment><USER2> Money is not _created_ , money is _printed_. Goods are created.

<comment><AUTHOR> "The subject of my speech is the creation of money in our economy" \- he then literally talks about it being _created_ by the act of issuing loans which are credited to individual bank accounts - most money that is created is _not_ physically printed.

<comment><USER2> And this supposedly "created" money is not backed by any thing of value, so it's akin to a number printed on a sheet of paper, unlike a chair that gets _created_ from planks of wood. You can "create" as much such money as you like, limited only by artificial rules you set yourself (with "you" being a government, because government has the monopoly on issuing money). It really doesn't matter whether it was actually printed on paper or just recorded electronically, it behaves just the same.</comment></comment></comment>


Construction begins on world's biggest liquid air battery - <AUTHOR> https://www.theguardian.com/environment/2020/jun/18/worlds-biggest-liquid-air-battery-starts-construction-in-uk <comment><USER4> The technology sounds fantastic. The synergy with heat power plants is particularly cool (heh). The same goes for desalination: waste heat can be reduced by recycling heat between the processes, increasing the overall efficiency of the system.

Now for the rant: reputable news organizations need to stop enabling "creates x jobs" propaganda through repetition. It doesn't create 200 jobs, it briefly employs 200 to build the thing. Maybe 5-10 full-time jobs will be "created" to maintain a giant mechanical battery. This lie is particularly popular around pipeline projects. "You don't think we should spend billions of dollars on this pipeline? Do you want tens of thousands of imaginary people to lose their imaginary jobs?"

End rant.

<comment><USER5> I think the "creates 200 jobs" usage is completely fair here. The thing is due to be operational in 2022, so that's two years of work for 200 people, and the ongoing operation jobs will be "a few dozen", not 5-10. The article makes all this clear.

More broadly, infrastructure jobs are still jobs, even if they only last a few years instead of indefinitely. The average tenure of a software engineer at a big tech company is less than that; is it fair to say they don't have jobs? It's not like we're ever going to run out of projects to improve the world, so these 200 workers will hopefully finish this job and move onto the next "job- creating project".

<comment><USER6> ==The average tenure of a software engineer at a big tech company is less than that; is it fair to say they don't have jobs?==

I don't follow, after a software engineer leaves the big tech firm, the job still exists. They hire someone else to do it. In this instance the job doesn't exist after 2 years. It's also probably not 2 full years for those jobs as they are typically brought in with teams to perform their function (dig, foundation, build, framing, electrical/water/gas, finishing) then move on.

<comment><USER7> Software projects finish just like civil engineering ones do.

<comment><USER6> Hiring a software engineer as a full-time employee for a temporary software project, then firing them, is a poor use of company resources.

If you are talking about a contract software engineer, then you are correct that the worker rolls off. We typically don't see those considered "full-time jobs created" because they have a well-defined term and are never employees of the company.

</comment></comment></comment></comment></comment><comment><USER8> Compressed air storage seems like a really appealing method, especially considering the low carbon footprint and massively longer lifetime than lithium batteries. This post covers it quite well [https://solar.lowtechmagazine.com/2018/05/ditch-the- batterie...](https://solar.lowtechmagazine.com/2018/05/ditch-the-batteries- off-grid-compressed-air-energy-storage.html) , I'd be really keen to see if compressed air can also be successful for independent households looking to go off grid or reduce dependence on the grid.

<comment><USER9> While it is appealing compared to many alternatives and is more portable for smaller settings, when used on an industrial scale like this giant battery, I wonder how it compares in overall utility to gravity batteries [0].

The nice thing about gravity batteries is that they can form a closed loop with water supply, too, pumping reclaimed water back up into reservoirs when there's excess power. I'd expect compressed air to have much higher energy density, but it would be interesting to see if anyone has the numbers.

[0] [https://en.wikipedia.org/wiki/Gravity_battery](https://en.wikipedia.org/wiki/Gravity_battery)

<comment><USER10> Those methods are actually quite similar, they're all ultimately related (limited by) tensile strength of materials. So costs and specific energy densities (per construction material unit) are similar. An important figure is cost/tensile strenght I guess.

(Compressed air: limited by container tensile strength; gravity batteries: limited by strength of cables)

I suspect even the constants involved are the same (given the materials are almost uniformly under nominal load), although I don't have time to investigate right now (a good curiosity research topic!).

<comment><USER11> I believe these ones are not limited by tensile strength: [https://interestingengineering.com/concrete-gravity- trains-m...](https://interestingengineering.com/concrete-gravity-trains-may- solve-energy-storage-problem/). They are a bit limited by available geography, but far less than say pumped hydro.

<comment><USER10> Indeed! In this case it's the integrity and friction of the soil (of the hill) that's keeping the potential energy contained, and this hill soil is "free".

</comment></comment></comment></comment></comment><comment><USER12> Here's an article with some of the technical details of chilling the air to liquify it:

[https://www.bbc.com/news/science- environment-19785689](https://www.bbc.com/news/science-environment-19785689)

"IMechE says this process is only 25% efficient but it is massively improved by co-siting the cryo-generator next to an industrial plant or power station producing low-grade heat."

"More energy is saved by taking the waste cool air when the air has finished chilling, and passing it through three tanks containing gravel" as a thermal store.

"their kits could be up to 70% efficient, and IMechE agrees this figure is realistic."

</comment><comment><USER13> Sorry for the rant but this is just so poorly designed that I don't see any relevant content when I open the link without scrolling right away:

With adblocker: [https://imgur.com/a/fWuoJEi](https://imgur.com/a/fWuoJEi)

Without adblocker: [https://imgur.com/a/cvmu3dm](https://imgur.com/a/cvmu3dm)

Plus ublock origin says it blocked 30% of requests. I'm all up for paying for good journalism but part of me wonders their paid customers aren't getting a great experience either.

<comment><USER14> I've found the Fanboy Annoyance List to be pretty effective vs the sort of GDPR cookie acceptance things you see in your blocked version: [https://easylist.to/easylist/fanboy- annoyance.txt](https://easylist.to/easylist/fanboy-annoyance.txt)

</comment></comment><comment><USER15> I mistakenly interpreted the headline as a battery with some kind of liquid electrolyte and outside air as a reactant. Kind of like a [https://en.wikipedia.org/wiki/Zinc%E2%80%93air_battery](https://en.wikipedia.org/wiki/Zinc%E2%80%93air_battery) . But nope, it's just the liquefaction of air, no chemical reactions involved.

<comment><USER16> Yes. The term "battery" is being thrown around too much. Are hydroelectric dams to be called "rain batteries"?

<comment><USER17> Yep. A lot of people call pumped storage "water batteries" or the like[0]. It baffles me as well, but now that language is evolving to redefine a battery as pretty much anything that generates electrical power than can be recharged with electrical power, I guess that's the world we're walking into and I should get used to that.

[0] [https://www.hydropower.org/sites/default/files/publications-...](https://www.hydropower.org/sites/default/files/publications- docs/the_worlds_water_battery_- _pumped_storage_and_the_clean_energy_transition_2.pdf)

<comment><USER18> Have you seen where "battery" comes from? Electrical batteries are called that since they were made of sets of electrical cells working together, analogously to a battery of artillery.

<comment><USER17> Yes I'm aware of that - good point. I could have included that in my post above to highlight that this word itself has gone through plenty of language change already, from meaning "a number of pieces of artillery used together" to "electrochemical energy storage" to "energy storage." While it keeps most of those original definitions as well - including "to strike" etc. The only definition I don't think has really survived to the current day that I see when looking at its etymology is "metal articles wrought by hammering." Wonderful word.

</comment></comment></comment></comment></comment><comment><USER19> Wondered what they were doing with the thermal energy from the process. The manufacturer has a video here that helps explain the technology a little bit: [https://www.youtube.com/watch?v=kDvlh_aG7iA](https://www.youtube.com/watch?v=kDvlh_aG7iA)

</comment><comment><USER16> The "air" gets stored in liquid form... but what I don't understand is what parts of the air? The gasses in air mix as gasses, no so much when liquid. Will the tanks include a layer of liquid oxygen? What prevents those layers vaporize selectively as the tank temperature is raised again? That would seem very dangerous. Or am I misreading this and they are only liquefying nitrogen and aren't playing around with liquid O2?

<comment><USER12> This article says they remove CO2 and water because they freeze solid, and it implies oxygen remains in the mix: [https://www.bbc.com/news/science- environment-19785689](https://www.bbc.com/news/science-environment-19785689)

I am guessing they pump the liquid air and then "boil" it, so there is no risk of selective vapourisation as they are not boiling the bulk liquid within the tank.

<comment><USER20> If they did something with that CO2, the whole setup could be carbon negative.

<comment><USER11> Dry ice is actually a precious commodity among algae growers - <USER2> alternative energy source - algae diesel. Or any frozen food dealers - <USER3> sometimes they run into shortages: [https://www.marken.com/alerts/dry-ice- shortage/](https://www.marken.com/alerts/dry-ice-shortage/)

<comment><USER21> Not just alge but ag in general. CO2 makes plants grow fast, farmers would buy it for greenhouses if it was produced on a large scale, although finding a way to stop it going back into the atmosphere would be better.

</comment></comment></comment></comment></comment><comment><USER22> > will use spare green energy to compress air into a liquid and store it.

Is that really right? It's not just green energy sources that benefit from energy-storage. Fossil-fuel plants and nuclear plants prefer to run at a constant output, but demand varies depending on the time of day.

See the 'Duck curve' [https://en.wikipedia.org/wiki/Duck_curve](https://en.wikipedia.org/wiki/Duck_curve)

<comment><USER23> This seems like useless pedantry on the word "green", no? The electric field is not coloured, you can't really attribute grid power to a specific source sensibly.

Coal is almost entirely gone from the UK. Nuclear does indeed prefer to run at constant output, but almost all the remaining fossil generation in the UK is CCGT which can ramp up and down fairly quickly.

</comment></comment><comment><USER24> Cool. Technology like liquid air, compressed air, electrolysed hydrogen etc. has a very different use case to lithium ion batteries.

Batteries are good for short cycle times, if you need to balance your grid and even to some extent if you need to correct for diurnal patterns, you want batteries. The high capital cost is compensated for by the high round-trip efficiency.

For seasonal storage or even inter-year storage, batteries do not work. You spend a fortune on them and then cycle the system once a year or less.

The advantage of these other systems is you can decouple three elements:

The conversion in

The storage

The conversion out

and match the capacity of each to what you need. For long term storage of hydrogen for instance, you want relatively small electrolysers with fast response times so that you can use excess electricity during sunny windy periods, a massive geological storage that can hold a year+ of production, and modestly sized fuel cells to turn it back into electricity in the winter (in Europe anyway) with good heat recovery.

In the case of this technology, you can again size the charging, discharging, and storage separately. The scaling for tanks is much cheaper than batteries.

Flow batteries use a similar idea by separating out the charging/discharging membrane and the electrolyte tanks but I don't think anyone has gotten satisfactory performance from them yet.

You can't build a lithium ion battery where you specify the storage capacity separately from the charge and discharge rates with anything like that kind of freedom. You can adjust the battery chemistry of course but nothing like the same.

<comment><USER25> This is why pumped hydro using existing dams is so nice. I think constructing enough storage to handle months of lower solar output will be difficult.

Phase locking human activity, including economic to the energy cycle would obviate the need for many technical solutions. We should just hibernate.

<comment><USER24> Pumped hydro using existing dams is brilliant and should be maximally exploited but we already have dams on all the really good sites. We can improve by adding the pump-up stage to many of them but there is simply no scope for massive expansion in total reservoir / energy storage capacity.

</comment></comment></comment><comment><USER26> I was looking into this briefly when I was investigating molten salt batteries. Can anyone who has expertise in this field tell me a bit about why molten salt batteries aren't more common? From what I can tell, the materials used are more renewable than Lithium Ion batteries, and with comparable (potentially higher) density. I can see why molten salt isn't as common in the more portable form factor, but it seems like it would be a great fit for large energy reservoir/grid type applications.

<comment><USER27> I believe the main use of molten salt batteries is for high heat applications e.g. in solar collectors

The heat is essentially "free" which makes the molten salt heat retention properties perfect for storing energy overnight.

</comment></comment><comment><USER28> I wonder what is the round-trip efficiency for this cycle. I read that you can improve it by matching with large scale but low-grade heat source.

<comment><USER29> The article says 25%.

<comment><USER14> That's a pretty tough sell versus pumped hydro which is generally 70%+

</comment></comment></comment><comment><USER24> The power cycle used here is quite an interesting one.

The heat from the compression cycle and cold from the expansion cycle are stored separately and re-used which substantially increases storage efficiency.

Waste heat from co-located industrial plants is used to further boost expansion performance. A lot of "low grade" industrial heat is available but when you're re-heating from cryogenic temperatures, 100 C is actually high grade heat.

I suspect that the time over which it's efficient to store is limited by losses from the temperature stores.

<comment><USER30> > Waste heat from co-located industrial plants is used to further boost > expansion performance.

Let's not greenwash this. The "waste heat" is fossil fueled.

<comment><USER24> That's not "greenwashing" because it's obvious. Thermal input in industrial processes is essentially all fossil fuel, high temperature input is 100% fossil fuel. To the extent that we need these processes, we may as well get as much bang for our CO2e buck as we can. Even if and when these processes can be driven using hydrogen combustion or other heat sources, there will still be low grade waste heat to use.

<comment><USER30> It's greenwashing because it's not obvious, and the wording is deliberately deceptive. An accurate description would give readers the relevant facts, not assume they can figure out the hidden catch.

</comment></comment></comment></comment><comment><USER31> The question is, would it be possible to use large scale liquid air storage to speed up removing CO2 from atmosphere?

I have no idea if removing CO2 is easier in liquid form but if it is feasible then ff we already had huge infrastructure to store energy that requires pumping astronomical amounts of air back and forth, it might make sense make sense to add a bit to it to remove CO2 while in liquid form.

<comment><USER32> The energy required to liquefy air is probably too large. Say we have 400pm CO2 in air - that's ~630mg of CO2 per kilogram of air.

Given that the specific heat of air sits at around 1kJ/kg[0], you'd have to spend over 125kJ of heat energy to get just one gram of CO2 - that's 35Wh.

If you used wind power(14g CO2/kWh) and a heat pump with a coefficient of performance of 1 (not sure how possible at these gradients) you'd "emit" 0.5g of CO2 in the process.

[0] [https://www.ohio.edu/mechanical/thermo/property_tables/air/a...](https://www.ohio.edu/mechanical/thermo/property_tables/air/air_Cp_Cv.html)

<comment><USER31> Well, you missed the fact that the plan is already to liquefy the air. So the air will already be in liquid form.

Also I don't think they are going to cool it but rather compress it. Cooling would require constant expenditure of energy to keep it cool whereas you can compress it and leave it in the vessel at room temperature. It takes 33 atmospheres to liquefy nitrogen and 50 for oxygen.

</comment></comment></comment><comment><USER33> >The new liquid air battery, being developed by Highview Power, is due to be operational in 2022 and will be able to power up to 200,000 homes for five hours, and store power for many weeks.

Is it just they're expecting many leaks in the system? I don't see why they couldn't just store things for years basically.

<comment><USER18> Liquid air is cryogenic - they'll have to either bleed off or spend energy to keep it cooled. The "many weeks" measurements is probably some measurement of bleed off rate assuming no top offs (but I'm just guessing - the company website [https://www.highviewpower.com/technology/](https://www.highviewpower.com/technology/) doesn't seem to call it out clearly).

<comment><USER33> If the tanks are strong enough, is cooling required? My understanding is that you'd only need to cool the liquid if the structure holding it wasn't sufficiently strong enough to handle the pressures.

<comment><USER18> Approximating air as nitrogen... nitrogen cannot exist as liquid phase at room temperature - it can exist as a supercritical fluid though at 5MPa (so 50 atm). At that point it has a density of roughly 56 kg/m^3. At ~1 atm, nitrogen becomes liquid at -194C and has a density of roughly 800 kg/m^3. So your mass density of the system is like 14 times better with liquid nitrogen, and the pressure loading requirements are stupidly lower.

</comment></comment></comment></comment><comment><USER34> When you compress air it produces quite a bit of heat that is usually cooled off... anyone that has an air compressor can attest.

Help me understand the thermodynamics, are they storing the heat too?

</comment><comment><USER35> What kind of pressure is required to do this?

</comment><comment><USER36> This cannot possibly be more efficient than lithium batteries...

<comment><USER37> > This cannot possibly be more efficient than lithium batteries...

It really depends on what you perceive to be efficiency.

<comment><USER36> Lifepo4 has 99% coulombic efficiency

</comment></comment></comment><comment><USER38> At first, I thought this was interesting. And then I read the part about the battery only lasting for a few weeks, before it must be recharged. This sounds terribly inefficient.

I recall reading about a spring type of battery made of diamond nano fibers a few weeks ago. They were saying this was even more efficient than lithium ions, since it was a physical process of releasing its energy, instead of a chemical process. It behaves like a child's wind up toy, but at the molecular level.

Would it be better instead to have a physical battery, instead of a chemical battery?

Perhaps something like a big wind up spring can be built. Then it can hold its charge indefinitely. And you stack thousands of these together, and they can just sit there for a long time, until they are needed.

Or even that idea to use large cement blocks stacked into skyscrapers. Each block holds potential energy, and when released, it can glide down a magnetic track and generate electrical energy. This is also a concept of a physical battery.

Even a hydroelectric dam is physical energy. You're moving the water uphill.</comment>


Ask HN Alumni: HN job posts success rate compared to other job site postings? - <AUTHOR>

I am wondering if your job posts on HN result in more hirings than job postings on other sites. Also, curious to know which job sites generally bring in the most resume submissions? <comment><USER2> From PageLever's latest ad[1]:

      I posted this a month ago, and received 126 applicants

[1] <http://news.ycombinator.com/item?id=3778290></comment>


AWS Federation Portal – Authenticate AWS Console Sessions via Active Directory - <AUTHOR> https://github.com/josephglanville/aws-federation-portal

<comment><USER2> What does this do better/differently than an ADFS set up?</comment>


Ask HN: How is ruby web dev centered so much vs. Python having flask and Django? - <AUTHOR> Hey HN. I might be having a confirmation bias observation here but it seems that in the world of ruby web dev, THE option being used today is just rails. I rarely see Sinatra mentioned in open source projects or job openings. In the Python world however, we have flask as the go to micro framework and is used in many production scenarios especially for small web apps. But it is also balanced well with Django being used for larger scale apps. I find that in the ruby world, all sizes of apps get developed on rails to the point where ruby is almost synonymous with rails for a newcomer. If this is true, curious how this mono framework environment happened over time. <comment><USER2> Not much experience in Rails, but I think that this is because Rails is much more modular than Django which in turn is quite large out of the box and it would not be great for smaller web applications. That's where Flask comes in. Whereas Rails can be used for applications of all sizes and that's why there's no need to learn another framework if you already have used it.

Although I feel that Flask is slowly becoming more popular than Django and contrary to popular belief, it's quite good even for large projects.

I think that the situation with Rails inside the Ruby ecosystem is similar to Express within the Node ecosystem. Highly modular frameworks that are used by almost everyone inside their respective ecosystems and even though there are other alternatives that cover specific niches, these two can cover much more than one single niche.

<comment><USER3> I'm curious why you say "Rails is much more modular than Django" when Rails includes more out of the box, and is more opinionated than Django. In fact, I would say that the opposite is true. Django is completely appropriate for tiny web projects, not just large ones. And how is Flask becoming "more popular" than Django? By what metric?</comment></comment>


A Mother Whose Lapse Led to Child's Death Seeks to Prevent Hot-Car Casualties - <AUTHOR> https://www.wsj.com/articles/from-a-mothers-tragedy-a-call-to-action-1525274572 <comment><USER2> Wow, that is a tragic, terrifying story. I hope the mother can find some peace. It's good work she's doing.

One thing not discussed yet:

Could cars could be smarter? I wonder how hard it would be for them to detect the presence of a child still inside?

That's probably really quite difficult to do, actually. :/

<comment><USER3> > Could cars could be smarter? I wonder how hard it would be for them to > detect the presence of a child still inside?

The passenger seat belt alarm on a car I had rcenetly would trigger considtently with a gallon bottle of milk; to detect a child in a child seat you'd need it to ignore the seat but trigger with child plus seat, which may be a little more involved but shouldn't be impractical.

Alarm UX may be tricky: you ideally want to alarm when the driver exits the car with a child in the back, but to avoid alarm fatigue you probably don't want to do it when entering.

<comment><USER4> It is interesting because you want basically the opposite of a seat belt alarm. If the back seat belt is buckled and the seat contains a certain range of weight (would probably get annoying if it would beep for an adult), it should beep.

<comment><USER3> > If the back seat belt is buckled and the seat contains a certain range of > weight (would probably get annoying if it would beep for an adult), it > should beep.

Well, the alarm timing is different (you don't want it to alarm when driving, but you do want it to alarm when you are done driving), and you don't want to rely on a seatbelt (because a car seat attached with LATCH won't use the seatbelt, though car seats may also be attached with seatbelts—even with LATCH available you need this at higher weights.)

<comment><USER4> Ah, I don't have kids and have never put in a car seat, I thought they all used seatbelts. Damn my assumptions! Probably one of those problems that might be best served with a simple human solution, like the "bag in the back".

</comment></comment></comment></comment></comment><comment><USER5> The "bag in the back" slogan makes sense, but I wonder if it wouldn't also make sense to encourage childcare facilities to treat an unexpected missed dropoff as a potential dangerous situation until the parent is reached to confirm their intentions.</comment>