Interview with Richard Stallman, Founder of Free Software Foundation - <AUTHOR> http://www.alearningaday.com/2012/03/richard-stallman-was-at-national.html

<comment><USER2> Now we need another clever thing. A GPL-ish set of Rules for for-profit business.

Think about it, if for example Google had a 'We're Legally bound to never be evil' eithical rule.

Does such a thing already exist perhaps? Or is there some wierdness that prevent it from happening?

<comment><USER3> defining "evil" would be a good start, though we seem to have failed to do it for the last ten thousand years :)

More seriously: there are plenty of "ethical certification" thingies, and lots of finance entities who only work with "ethical" products.

This things just don't seem to have trickled down from (arguably) major evils businesses (child exploitation, war profits, environmental disruption etc) to lesser ones (predatory pricing, patent trolling, exclusive dealing etc).

Possibly a matter of time, but a long one IMVHO.

<comment><USER4> > defining "evil" would be a good start

I think the best way to tackle this would be defining specific tenets the way that the FSF does with freedoms 0-4. They don't just say "You have to be free!" ... there is the legally-binding license itself, containing some light legalese, as well as the 4 freedoms specifying the idea to the common man, despite clearly.

So, a license that comprises "We won't be evil. We promise!" wouldn't be good enough, but the some clear rules could be set. The non-evil most people would care about would probably be related to privacy.

I agree that specifying all of the business practices which many people believe are evil would be a non-trivial task dependent on the nature of the company.

</comment></comment></comment><comment><USER5> He says there are malicious features on mobile phones which enable the state to listen to you at any time.

Is there any reality in this statement?

<comment><USER6> Even if there is, the vast majority of phone calls passes through government controlled telephone exchanges, so it wouldn't matter.

<comment><USER5> But he implies that you can be listened even when you are not talking on the phone.

<comment><USER7> Yes - and he is right. The phone is in permanent connection with the network anyway - it's some code away from opening the audio to listen to your room conversation.

<comment><USER8> My name begins with the letter A, so I get quite a few accidental calls when someone leaves their phone unlocked in their pocket.

Mostly you just hear an incomprehensible garbled rustling noise.

Spying on someone by remotely turning on the phone in their pocket isn't usually going to work.

<comment><USER9> Sometimes it's not. But if you're determined enough to spy on somebody via the audio on their phone, you will likely be persistent and eventually overhear something the person would prefer you didn't. If I were concerned about being spied on I wouldn't dismiss it so easily.

</comment></comment></comment></comment></comment></comment><comment><USER10> GNU Aerospace our GPL rules for a for-profit business.

[http://forum.avsim.net/topic/367152-a-new-crowdfunding- based...](http://forum.avsim.net/topic/367152-a-new-crowdfunding-based- business-model/)

<comment><USER11> That idea is pretty awesome, but why limit employee compensation in such an unflexible way?

<comment><USER10> The idea is to empower worldwide collaborative software development.

People get too hung up on what other employees are being paid, which is used as the benchmark for the valuation of their contribution to the project.

This tension blows projects apart, and explains why there are no prior GPL based business models (either the code is contributed gratis by individual contributors, or a non GPL based corporation releases code in support of their primary revenue stream in the sale of services, consulting, ustome development, sale of hardware).

By focusing on reasonable expenses, this levels the global playing field, and disables the compensation friction.

In the end, it is the consumer which must feel satisfied, that they are getting value for money spent. And it should therefore be left to the consumer to decide which persons to award higher compensation in a bonus.

<comment><USER11> I don't think this will work. This is not how it works in any of the open source based companies I know, and I know a few.</comment></comment></comment></comment>


Faith, Hope, and Singularity: Entering the Matrix with New York's Futurist Set - <AUTHOR> http://betabeat.com/2012/07/singularity-institute-less-wrong-peter-thiel-eliezer-yudkowsky-ray-kurzweil-harry-potter-methods-of-rationality/

<comment><USER2> Interesting article. I found it very sad that the 1st person mentioned was identified most notably as "a former Google intern". One hopes that s/he has done something in life of more value than making coffee for other proclaimed ubermenchen.</comment>


Show HN: TradeMore – Generate a return on your Bitcoin - <AUTHOR> https://trademoremargin.com <comment><USER2> Nope. You gotta build a reputation if you're doing anything with Bitcoin these days. We've had years of amateur hour and it almost always ends badly. There's no way you can guarantee a return of 5-10%. There's also no way anyone responsible is going to let someone else control their btc unless they're naive.

The only safe place for your Bitcoin is in your own wallet.

<comment><AUTHOR> You're right that among the safest places for your bitcoin is your own wallet. An even safer option is cold storage, using Coinbase, Elliptic etc. But the success of BTCJam and others suggests that individuals are willing to trade- off return for risk. Our model is very different from BTCJam, in that your bitcoin does not get sent to a borrower's private wallet. Bitcoin users by their nature are early adopters and interested in new ventures and new companies. We have users lending through us who have been burned badly before, but still want to try out our new service. We work hard to be as professional as possible and use industry best practices, including margin calls; stop-loss trades and a significant capital buffer. But if you're really worried about 'amateur hour' then that is fair enough - we'll try our best to convince you otherwise, but it's your money.

</comment></comment><comment><USER3> Are there actually folks out there willing to pay a 10%+ a year interest rate to take a loan denominated in BTC? Bitcoin's price is all over the place, and often moves up very quickly, so even if the loan were at 0% it would be a bad idea. But at 10%, you have to ask, are there any ways to invest your loan such that you could beat that rate? Consistently? The default rate is going to be sky high.

The only rational explanations here are 1) these people are actually intending to short Bitcoin and don't realize there are cheaper ways or 2) these people don't exist, and this is a Ponzi scheme.

The latter seems more likely, especially since this site claims to be covering losses on defaults (an even crazier idea than taking a BTC loan in the first place).

<comment><USER4> Out of curiosity, what are the cheaper ways to short Bitcoin? The only ways that I'm familiar with involve borrowing bitcoins in some way, for example, Bitfinex offers what they call "swaps" to facilitate margin trading.

It's pretty clear that the reason for borrowing bitcoins is to allow shorting, in which case most of the time margin calls can cover the default risk.

To answer your earlier question, "... are there ways to invest your loan such that you could beat that rate? Consistently? The default rate is going to be sky high". I think the answer is that at scale, probably not; most people will lose money while doing heavy margin trading. But most of the time you won't lose the entire thing, you'll cash out your position at a loss and pay off the accrued interest. The only time you lose the entire amount is if you approach margin limits, in which case you'll be automatically liquidated by the exchange and the fees will be removed. The even more rare case is that the exchange is not able to liquidate your position because of an exceptionally large move in the BTC price, in which case the default coverage by the site becomes applicable.

This isn't to say that TradeMore is a legitimate site that won't steal your money, I'm just addressing the feasibility of the technique. The fact that they are a UK based company, with officers published on the site, is some comfort, though.

</comment></comment><comment><AUTHOR> Hi HackerNews,

I'm the co-founder of TradeMore and we are excited to share with you our bitcoin lending platform.

We allow individuals to lend out their bitcoin and generate a fixed return. For those interested in trading and market making, we allow funds to be borrowed and used to trade on Coinfloor and others.

I'd be very interested to hear any questions or ideas you might have.

Thanks!

<comment><USER5> Correct me if I'm wrong, but are the following all true

\- You're running this business as a UK limited company named after the founders, who are based in the UK

\- Your scheme involves third parties, probably outside your control, performing arbitrage trades on third party platforms in an unstable asset with variable liquidity characteristics in order to turn BTC into more BTC

\- You're marketing a service as a "loan" offering a "return" within a specific range and offering assurances about vetting third parties using the service and covering losses, but don't include even a boilerplate terms of service or risk warning

\- Nobody on the team has a background in compliance or due diligence

\- You're not Bitcoin billionaires

Assuming the above are true, I hope you have a _very_ good lawyer. Since at a glance you actually appear to be real, traceable people I'll assume you're acting in good faith and not running a Ponzi scheme which would be my first assumption based on the website's claims otherwise, but the chances of you heading in the same direction as Ponzi-scheme operators in the likely event of something outside your control going wrong are very high indeed. In all sincerity, I'd encourage you to trade _less_ unless you have the backing of someone with a deep understanding of relevant UK law and even deeper pockets.

<comment><AUTHOR> Hi notahacker, thanks for the well balanced comment. We're incorporated with our surnames but operate under the name TradeMore. Alas, we're not Bitcoin billionaires.

You're right on a number of counts, but I disagree slightly with a couple of your points. For example, our borrowers are not "outside of our control", because they only borrow on very specific accounts where we have implemented stop-loss logic and where the withdrawal address belongs to us. This functions in a similar way to when you trade through a broker.

We have not included terms of service on our website, and this is something we should do. However, we do make sure to share the full T&Cs with lenders and borrowers prior to transacting. Right now these are in the form PDF documents which outline clearly each parties responsibilities. Send me an email if you want to take a look.

Point taken about "heading in the direction" of a Ponzi scheme. I know what you mean. We could say, "oh, we've had a bad week, let's just repay our existing lenders with our new lenders funds". It's a slippery slope. To avoid this we separate client funds. So for each our of clients we know where their funds are at any given time, and do not just let funds flow from one to the other. Point also taken about trading less. Obviously we want to grow, but not to the detriment of our quality of service.

On the point of lawyers and legislation in general, we have consulted a number of lawyers in the UK and US. Generally, the feedback we have received is that Bitcoin is a very grey area, with most governments in a 'wait and see' mode. However, we want to act as if we were already a regulated financial institution and stay ahead of the curve (one day, if the FCA accepts bitcoin companies into the fold, we will be regulated).

<comment><USER6> So what's your plan if you don't gain enough money with your trading scheme?

<comment><AUTHOR> Hi imaginenore, are you talking about the situation in which we earn less on our assets than we owe in our liabilities? In this case we would use our capital buffer.

<comment><USER6> Yes, that's what I meant. How much is your buffer?

</comment></comment></comment></comment></comment></comment><comment><USER7> Say I lend 1 BTC to a borrower and that borrower defaults on his loan. Your FAQ says:

> In the event that external markets are not able to fulfill the order > necessary to close out such positions, TradeMore will act as the > counterparty to cover losses.

Does this mean that you will return the entire 1 BTC to me as the lender?

<comment><AUTHOR> Hi deweller. Yes, in the event that a borrower defaults we will use our own funds to repay you. Obviously, this requires you placing trust in TradeMore, but we will work hard to win this trust. One option is to start lending a small amount through us so that you can see what using our service is like. Full disclosure: we do not return lender funds in certain 'force majeure' events, such as a number of exchanges being undermined or entering bankruptcy. Hence, your funds are more secure in your own wallet or, even better, within cold storage. But if you are interested in earning a modest return on your holdings you might want to give us a try.

<comment><USER8> So you are, in essence, guaranteeing every loan on your service (excluding the usual acts of god and stuff)? Assuming that all goes well, where does the extra 5% come from? As I understand it, the return on a loan is usually a function of the risk attached to it, and you seem to be saying that your loans are risk free...

<comment><USER7> I would assume they are lending your BTC to traders for substantially more than the 5-10% rate that they are paying you. In exchange for taking the risk, they keep the profits.

<comment><USER5> Wouldn't a trader who was so Bitcoin-savvy they could make returns well in excess of 5-10% whilst maintaining the full value of their loan in BTC on recognised exchanges be smart enough to borrow BTC on less onerous terms from a pure p2p exchange?

<comment><USER5> @dweller I understood the leverage aspect as requiring the borrower to deposit a margin of fiat currency in order to be entitled to borrow 2.5x that value in BTC, repayable with a >10% APR in BTC, which appears to be confirmed by sdouglas.[1] If it were the other way round and TradeMore were giving borrowers access to additional funds on top of lenders', then presumably the owners of those funds would also expect a return...

@sdouglas As I understand it most other BTC borrowing is done at a fixed rather than floating interest rate, in which case I can't imagine why anyone would borrow from you except in those rare cases where liquidity dries up and they desperately need to borrow? Or why you'd want to lend _only_ during low liquidity situations (or to incompetent borrowers) and only to borrowers whose trading position is exposed by that lack of liquidity?

[1]As a footnote, if I were running a business with that model I'd be happiest if the BTC ecosystem crashed, in which case my BTC liabilities and all the defaulting BTC loans might be worth less than the nice juicy chunks of fiat. It would be like holding subprime mortgages if house prices massively and unexpectedly soared!

<comment><AUTHOR> Hi notahacker, the initial margin deposit is in bitcoin (apologies if we did not make this clear) since lender funds are also in bitcoin. Regarding fixed/floating: if you are borrowing on an exchange such as Bitfinex then for any one currency swap the interest rate is fixed, but these swaps are typically short term and so when you come to refinance a position you could find yourself facing significantly higher rates than you had previously. Since (at least in the short term) our earnings will be all be in bitcoin, a collapse in the price of bitcoin would be very bad news for us.

</comment></comment></comment></comment></comment></comment></comment><comment><USER9> So, how is your application to become a bank going? Where did you get the 5 million pound startup capital required?

[http://www.fca.org.uk/firms/about-authorisation/dual- regulat...](http://www.fca.org.uk/firms/about-authorisation/dual-regulated- firms/banking-applications/should-i-become-a-bank)

Also, have you picked out which non-extraditing island nation you'll be retiring to after you claim that "hackers" stole all your bitcoins and forced the shutdown of your business?

</comment><comment><USER10> Have you consulted with a lawyer specialising in English financial services regulations? It seems pretty clear that you're performing activities that require you to be authorised by the Financial Conduct Authority[1]. Have you spoken to them? The fact you're lending and borrowing BTC rather than GBP makes no difference to the requirements. Bitcoin isn't magic no-rules money. You're risking prison and large fines.

[1] [http://www.fca.org.uk/firms/about-authorisation/do-i-need- to...](http://www.fca.org.uk/firms/about-authorisation/do-i-need-to-be- authorised)

<comment><AUTHOR> Hi ascorbic. Thanks for pointing us in the direction of the FCA, it's good to get as many opinions on this as possible. Yes, we have consulted a lawyer specialising in English financial services regulation, as well as closely reading the FSMA Act 2000. I agree that bitcoin isn't a 'no-rules' money, but I disagree that there is no difference in the requirements. This is because bitcoin and other digital currencies are not specified investments under FSMA (the relevant section of FSMA is 22). In our opinion it would be good for digital currencies if they were a specified investment, but currently they are not, and therefore they are not subject to the same regulations as cash or other traditional financial instruments. If you think I'm wrong please push back. This is an important point to clarify not just for us but other businesses in this space.

</comment></comment><comment><USER7> As a lender, may I use the service anonymously? Or do you require KYC account verification?

</comment><comment><USER11> 5-10% returns is about the same as Lending Club (my five year average with LC is 7%) but with MUCH more volatility. On a risk-adjust basis, this seems to be a poor investment.

</comment><comment><USER12> FYI, the register form doesn't display for adblock plus users -- forms usually do, so this was quite confusing. It looked like you weren't accepting new users.

<comment><AUTHOR> Thanks very much for this. We were actually aware of this already (specifically, it's an issue with the Fanboy Annoyances feature on Adblock) but we thought that, on balance, so few people would have this specific feature enabled that we would go without an ugly box altering them to this fact. Obviously some people do have it enabled - sorry it it cause inconvenience. I hope your comment stays near the top for clarification.

<comment><USER12> Makes sense. I'd expect the bitcoin owning population to have many more ABP users than the general population though.

Re: adding a black box.

It looks like just not using "mc_embed_signup" and "mc-embedded-subscribe- form" as the form's id and class would solve the problem. Elements with those classes and ids are display:none'd by ABP.

(You can verify this yourself by enabling adblock plus, then inspecting the element)

<comment><AUTHOR> Great tip, thank you very much for this.

</comment></comment></comment></comment><comment><USER13> How is this not a Ponzi scheme? This seems to fit the definition exactly.

<comment><USER7> A Ponzi scheme is is where the operator pays returns to its investors out of the money brought in by new investors. That is not what is going on here.

TradeMore lends your money to borrowers who then pay the money back with interest. That is where the profit comes from.

If only 2 people use the system (1 lender and 1 borrower) the model still works. It does not depend on new investors to pay profits to previous investors.

<comment><USER14> >>> TradeMore lends your money to borrowers who then pay the money back with interest. That is where the profit comes from.

Isn't that the traditional definition of a bank? Curious how you're able to circumvent the UK regulations that would appear to require registration as a bank.

<comment><USER11> Not really. They don't do personal savings accounts. It seems to be just like Lending Club except using BTC.</comment></comment></comment></comment>


The Slow Erosion of Google Search - <AUTHOR> http://bokardo.com/archives/google-erosion/ <comment><USER2> I am not a fan of Facebook, I have never used Twitter, I am sure there are lots of others like me. There has been a lot of talk about semantic search over recent years, but just that TALK.

<comment><USER3> the thing is...even if Facebook or Twitter actually do it...there is nothing to stop Google from utilizing that same data themselves to power their own version of search.

<comment><USER4> Twitter's firehose is license-only. Facebook is a walled garden. There's a lot that Google can't necessarily reach for free.

<comment><USER5> If it really is valuable, I don't think Google would have a problem paying however much a license costs.

<comment><USER6> > If it really is valuable, I don't think Google would have a problem paying > however much a license costs.

I'd agree but keep in mind that their data may not be available. Facebook has signed an advertising agreement with Microsoft and twitter has their own search engine that they bought.

If they thought having google crawl their data would cost them revenue then you can be sure they wouldn't let google access it for any amout of money.

</comment></comment></comment></comment></comment><comment><USER7> _So the question is: how many searches are real-time searches? 10%? 20% 30%?_

Try something closer to .001%. Twitter's monthly search volume is probably about equal to what Google gets in the space of a few minutes.

</comment><comment><USER8> I sort of think of Google as a channel changer for the TV. When I need to go from one place to another, I use the remote, but the bulk of my time is not spent changing channels - it's spent consuming the media that I'm interested in.

<comment><USER9> Agreed. The article implies that we all spent our time "hanging out" on Google before Facebook and Twitter came along. That's never been the case though. For better or worse Google has been and is just an extremely useful utility.

<comment><USER10> My dependence on Google kind of scares me a bit. I don't just use it for search, it's my calculator, converter (currency, temperature, etc.) and many more things.

And even if I chose to do those things manually (such as temperature conversion) - I could only think of going to google first to get the formula. I'm just glad Google is there to make my life easier.

<comment><USER11> It's my search engine, calculator, converter, stock-quote-checker, e-mail client, word processor, spreadsheet, chat client lately, local business directory, atlas, and employer. Hrmm. That makes it far more dominant than Microsoft ever was...

</comment></comment></comment></comment><comment><USER7> The author's main premise seems to be that since people are already on Twitter and Facebook, they'll just use that to search instead of Google. Aside from the fact that the results would be terrible, most people have Google search in their browser, which is all of 30 pixels away from the Facebook and Twitter search fields. Plus, I know that I'll be more likely to get the results that I need.

People are way too wrapped up in finding the next Google-killer.

</comment><comment><USER12> I am a former Facebook skeptic, but after playing around with it a little I understand it's appeal in connecting and updating with friends and family. Don't know how they will monetize it, but when they find the right model, it's going to be epic. I no longer doubt it can be bigger than google -- in fact it almost certainly will be.

</comment><comment><USER13> Hey folks, thanks for the feedback. The reason why I titled the piece "slow erosion" is that this will take years...I know how valuable Google is for fact-based searches. But slowly, social search and in-context advertising will gain, not because Google will get worse, but because people will be starting from a different place. They'll start on Twitter or Facebook.

The key insight is that people trust others for certain types of information such as recommendations. A single recommendation from a friend is much more powerful than a list of restaurants Google will give you. "Hey, I know you and I know you will like this restaurant". You could argue that Google will eventually know a lot about us (they do already), but the fact is that social interaction trumps reference material in a lot of cases.

So this will probably take years, and many of the arguments against are that right now Google is better. No denying that...but have you seen the ads on Facebook lately? They're pretty stinky, but twice as good as they were even months ago.

</comment><comment><USER14> Try finding this on twitter:

\- who was Joan of Arc

\- the first movie of Elijah Wood

\- the capital of Somalia

\- atomic number of Molybdenum

Twitter search is good for personal interaction.

Google search is good for everything else.

<comment><USER12> I would go to wikipedia for all of those.

<comment><USER11> Luckily, the first or second result of a Google search for each of those links to Wikipedia. I find it's faster to do a Google search and click on the Wikipedia link than it is to go to Wikipedia and hit Search.

<comment><USER15> Search for:

wiki Joan of Arc

wiki Elijah Wood

wiki Somalia

wiki Molybdenum</comment></comment></comment></comment>


ZeroDB (YC S16) Provides Security for Enterprise Big Data in the Cloud - <AUTHOR> http://themacro.com/articles/2016/08/zerodb/ <comment><USER2> Microsoft offers "Always Encrypted" for Query Processing over encrypted data in SQL Server and SQL Azure : [https://msdn.microsoft.com/en- us/library/mt163865.aspx](https://msdn.microsoft.com/en- us/library/mt163865.aspx) (Disclaimer : Microsoft Employee)

<comment><USER3> Does Microsoft use deterministic encryption for searchable encryption? I'm sure OPE, Pallier etc. schemes are in use for columns that require those properties

<comment><USER4> Yes. It's configurable.

</comment></comment></comment><comment><USER5> Whitepaper from Arxiv describing their scheme for others who like seeing underlying details of security tech:

[https://arxiv.org/pdf/1602.07168v3.pdf](https://arxiv.org/pdf/1602.07168v3.pdf)

@ ZeroDB developers

I know the goal is to have the cloud provider untrusted in this model for storage/processing. However, have you considered them actively malicious in how they handle the protocol steps with the on-site client? As in, at each step (eg a query), they might try to attack the protocol or especially the implementation (a la OpenSSL infamy). Just make sure you have defenses for that sort of thing.

<comment><USER6> Malicious server, apart from possibility of removing data, would look pretty unusual for the client (like returning incorrect data etc). So it's a good idea to look for these patterns. An attack would probably look like trying to use the client as an oracle, and that's pretty detectable.

But as MacLane pointed out in another comment this is only the case for the standalone database described in the ArXiv paper. The Hadoop scheme works quite differently

</comment></comment><comment><USER7> > Currently, ZeroDB works with Hadoop and will soon will expand to other parts > of the big data ecosystem, like Spark and Impala, as well as legacy > databases, like Oracle, DB2, and MySQL.

I guess mysql is a legacy database, now. Someone should let all the committers know that they should transition to support roles and stop new feature development. Hadoop is the future of sql.

<comment><USER6> Yeah, I guess a little early to retire MySQL and Oracle :-) Thanks for pointing out, legacy is more about DB2

</comment></comment><comment><USER8> The biggest technical hurdle for this type of database right now is index lookup. Since the nodes on the indexes are encrypted the client/server requires a round trip for every binary tree index level that needs to be traversed. This makes what is usually one of the fastest database operations into a slow one.

<comment><USER9> This is indeed true for our standalone, open source database ([https://github.com/zerodb/zerodb](https://github.com/zerodb/zerodb)).

However, it is not the case for our Hadoop scheme (nor our future support for structured database). In these cases, there is no round-tripping required. In fact, it's significantly more performant than existing Transparent Data Encryption in Hadoop, from both a latency and key rotation perspective.

We'll likely release a paper describing this new scheme later in the year as well as publish at some conferences.

<comment><USER10> Having worked on a similar product and heard a very similar description of the 'proprietary' method, I'm guessing either security, speed or both are actually compromised.

<comment><USER6> There are many proprietary methods which are based on deterministic encryption + obfuscating word distribution, that's what most companies do.

We avoid doing that because of questionable security of such method. Also we tend to publish what we do (stay tuned for Hadoop paper :-)

</comment></comment></comment></comment><comment><USER9> Hey HN, cofounder of ZeroDB here. Michael (/u/michwill) and I are excited to be a part of YC and happy to answer any questions about the company!

<comment><USER11> Love the idea behind ZeroDB - kudos to you guys, and cheers from a fellow Tar Heel!

What's your expansion strategy for Oracle/DB2/MySQL?

<comment><USER6> We have ideas how to make relational databases secure while running everything server-side, thanks to recent research publications [notably CipherBase from Microsoft Research [http://www.cidrdb.org/cidr2013/Papers/CIDR13_Paper33.pdf](http://www.cidrdb.org/cidr2013/Papers/CIDR13_Paper33.pdf)] and advances in CPU hardware. Early days, but we'll probably test it first in the open source ZeroDB database [[https://opensource.zerodb.com](https://opensource.zerodb.com)] and then apply the same method to existing relational databases.

</comment></comment></comment><comment><USER3> CryptDb offers DB querying without having to load certain parts of the db to your local machine, which is the model of operation by zeroDb in its current incarnation.

Which is more secure? Does zeroDb use non deterministic encryption?

<comment><USER6> ZeroDB doesn't use deterministic encryption (neither Hadoop product, nor open source database)

</comment></comment><comment><USER12> For those who may know, how does ZeroDB stack up against an incumbent like MarkLogic in the 'Security for Enterprise Big Data in the Cloud'?

</comment><comment><USER13> That's a very strong security claim. What's behind it?

</comment><comment><USER14> As the founding engineer at VoltDB, I can tell you that no matter how cool your name is, it can be annoying to be always alphabetized last.

<comment><USER15> That's one of the reasons behind the name change from Cadabra to Amazon.com.

p.s. if you change it to 0db perhaps you might be listed before any "a" company? Not sure if numbers precede letters in those lists.

<comment><USER6> 0db - that's I was thinking of. Way to fight 0days

<comment><USER16> 0db _definitely_ sounds like an audio brand. I don't recommend it.

</comment></comment></comment></comment><comment><USER17> Off-topic: whenever I see (YC __) in a title I always assume it 's a job posting and automatically ignore it. Might be detrimental to label a blog post appear that way.

<comment><USER5> Better to read it as advertising YC's investments on YC's forum.

<comment><USER17> You can advertise it without using the exact same format as job listing.

<comment><USER5> Looked different to me. Those usually don't have comments and other links under the title. Just amount of time since post appeared. Sounds like two of you are doing spot judgments on threads that ignore important info. Your filters are title only instead of title + peripheral info. Prevents the problem you're having.</comment></comment></comment></comment>


Ask HN: Isnt using private blockchain for securities/voting proxies not ethical? - <AUTHOR> I'm a consultant but I can't seem to wrap my head around why they want me to look into a private blockchain and had me speak to some organization for cryptocurrencies for help. I hit a brick wall here. Isn't private blockchains supposed to be a NO for companies? Any help is appreciated. <comment><USER2> Private blockchain (one that is centrally controlled, usually internal to a company) or privacy blockchain (the flow of funds is obfuscated)?

Private blockchains lack decentralized consensus, so the have more in common with a typical database than they do w public blockchains.

Given that they are normally used inside a single company or between a few companies who already trust each other, i don't see any ethical problems.

</comment><comment><USER3> I think it depends on the use case. The secret ballot exists for entirely ethical reasons. The Monero blockchain is more specifically hiding provenance (or trails from initial provenance). In your case it would mostly remove reputation for analysis of stakeholders between votes. I'm not entirely sure why this would be relevant for ethical considerations.

</comment><comment><USER4> private blockchain doesn't have to hold by one company, it can be multiple companies, they can set different party for doing the PoW or other algorithms.</comment>


Show HN: Up to date list of political decisions around the world - <AUTHOR> https://github.com/govtra/govtracker-data/blob/master/README.md <comment><USER2> fantastic idea. significant chunk of uk gov bills/statements are published online, i may build a scraper for this project

<comment><USER3> Hi, I am the guy behind the project (I just created an account now, a friend posted it). Thanks for the interest! It would be very cool to have a scraper! If you decide to go with it, tell me if I can help in any way from my side :)

</comment></comment><comment><USER4> interesting project - might be interesting to see a kind of org chart of different parlaments (eu, uk, us). esp eu is confusing with its commissions and parlament and presidents of all.

<comment><USER3> That is a good idea, I will implement it, thanks!</comment></comment>


Show HN: Terracotta, a light-weight XYZ tile server in Python - <AUTHOR> https://github.com/DHI-GRAS/terracotta <comment><AUTHOR> Inspired by Mapbox' rio-tiler [1], we wanted to build a modern tile server on the Python geo-stack that is optimized for AWS λ deployments (and that makes it beyond the proof-of-concept stage).

The result is Terracotta, and I'm really happy with it, so I thought HN might appreciate it, too. Cold start times on AWS λ are as bad as expected, but once you got a sufficient number of instances running, it actually performs really well (mostly because loading a tile cover is so embarrassingly parallel).

Besides that, Zappa [2] does a great job at taking the pain out of the AWS λ deployments and dependency management, so if you don't know that project yet I'd highly recommend you check it out.

[1] [https://github.com/mapbox/rio-tiler](https://github.com/mapbox/rio-tiler)

[2] [https://github.com/Miserlou/Zappa](https://github.com/Miserlou/Zappa)

<comment><USER2> I suspect your non-standard way of referring to AWS Lambda (I get it, Greek letter, haha) only serves to reduce the SEO of any pages where you talk about your project. My recommendation would be to refer to their project by its real name to increase the hits you get on yours.

<comment><AUTHOR> Interesting point. I genuinely thought "AWS Lambda" was just the ASCII-fied version of the official spelling, but it seems I was wrong. Either way, your point about SEO is of course very valid (but the Greek letter joke went over my head).</comment></comment></comment>


Clickjacking iPhone Attack - <AUTHOR> http://ejohn.org/blog/clickjacking-iphone-attack/ <comment><USER2> Before anyone gets any ideas and as the article mentions: This is now fixed in the iPhone 2.2 software update.</comment>


"Not Invented Here" Versus Developer Sanity - <AUTHOR> http://prog21.dadgum.com/158.html <comment><USER2> At work recently we reinvented something that already existed - but I think we had a good reason to.

There's a node package called "request" [1] that's a very, very popular third- party library to simplify HTTP requests. If you look at the code, though, it's really, really nasty - the whole thing is filled with global state. After I spent 6 hours in one day debugging issues in the library and filing bugs (some of which included things such as "if you try to set a querystring parameter, request can no longer follow redirects"), we decided that enough was enough and we rewrote it from scratch [2].

I think that rewriting it took us about as much time as we spent debugging it, but we were left with a project that's a drop-in replacement (as long as you're not using any of the advanced features) and has a codebase that's 1/10th (!!!) as many lines of code while implementing near 80% of its features.

[1] <https://github.com/mikeal/request>

[2] <https://github.com/clever/quest>

<comment><USER3> I don't think NIH counts as NIH when you have a very clear and justifiable rationale. The best projects document their rationale and provide a direct, unbiased comparison to allow developers to make a better decision on which to use, as you have. The worst (and true NIH) projects pretend that the original project does not exist or document a biased comparison without acknowledging the points that are subjective.

There is one improvement I'd make. Your story here (spent hours debugging and filing bugs; spending the same amount of time rewriting got you further) is the most convincing reason to me. I'd document this in your comparison!

<comment><USER4> Exactly; NIH syndrome refers to the fact that it wasn't invented in house /being/ (or tainting) the rational.

Edit: replace failed attempt at italics...

<comment><USER5> I doubt that many people say with a straight face "I rebuilt it because I didn't write the original", even if that's the _real_ reason: there is always an excuse.

</comment></comment></comment></comment><comment><USER6> I don't disagree with the OP* but its important to recognize that what might seem to keep you sane, in many situations it will drive whoever inherits your code absolutely nuts. The guidelines the article lays out aren't bad, but they are all about "you". Make sure you don't forget the next person.

*I'm well known among my colleagues for writing way too much from scratch

<comment><USER7> It really depends on how good you are at writing readable, unsurprising, code, and how willing you are to document it.

</comment></comment><comment><USER8> Most of the implementing in software is not conducted as engineering, it's conducted more like research. "Reinventing the wheel" actually means a (potentially better) retake on the same problem. It means the fact of questioning the existing things which is never bad, it only gives the chance of changing them with new better ones or just to validate their existing value.

</comment><comment><USER9> I think he's right, but this is really a problem a developer would have. Most users just want the very best exprience, which in most cases means the most upgraded software. If you can build the tool for yourself though do it.

</comment><comment><USER10> Fair point. I like the article about OOP too :

<http://prog21.dadgum.com/156.html></comment>


New Grad and Intern tech offers for 2017 - <AUTHOR> https://docs.google.com/spreadsheets/d/1Km9bsx0SWPDiOPMYvremSDujyS5sF0ZQvbxr5S52wSA/htmlview?sle=true <comment><USER2> What's the source of this?</comment>


Adding a security key to Gmail - <AUTHOR> https://techsolidarity.org/resources/security_key_gmail.htm <comment><USER2> I would advise against Google Authenticator as a backup as it really defeats the point of a hardware token.

Google Authenticator stores the TOTP secret in plaintext on your device where the potential exists for it to be stolen. An adversary that exploits your phone can generate TOTP tokens as they like and ignore the fact you have a hardware token. If you are going to use Google Authenticator it is your weakest link and a security token buys you no added security, only ease of use.

The typical goal of a security token is to be able to assert: "No one can log into my account without this physical device or an offline backup token from my safe"

To acheive this consider a device with built-in TOTP support in addition to U2F. All current Yubikeys fit the bill here as as well as some Nitrokey models. Desktop or Android users can use the either USB or NFC devices but it is worth noting that iOS lacks support for either which means you would need a desktop or Android device to fetch TOTP tokens for an iPhone.

You can use the open source "Yubico Authenticator" apps to store your TOTP secrets in your key alongside your U2F secret. Now both methods use the same hardware and your phone/computer only get handed OTP codes from the key if present, but can't generate them itself.

Added bonus is now you can now use security token backed login even on the majority of sites/browsers today that lack U2F support.

Extra bonus is these keys can be used for ssh without any server changes. Security token all the things :)

<comment><USER3> The attacker who gets access to the filesystem of your phone can almost certainly defeat any "encryption" a TOTP authenticator would use to protect secrets, so the premise of phone-based authenticators is that your phone isn't going to get compromised.

This is reasonable when you consider that if your computer --- the least secure device you own --- is compromised, your attacker is virtually certain to get your email account with it, because you'll have (at some near point) a logged-in session.

Meanwhile: the #1 concern that laypeople have about security tokens is that they'll be locked out of their account when they lose the token. Authenticator (or Duo) is a perfectly sane answer to that concern.

Finally, it's worth adding that at least the last time I helped someone set this up, you can't remove your phone number as a factor from your Google account until you have TOTP set up. Your phone number is an extremely insecure login factor.

We use, and recommend, Google Authenticator as a backup login factor.

We do not recommend Yubikey 4 keys for normal users. Nerds on HN might get a kick out of them; I say, go ahead and enjoy yourself. We're trying to solve problems for people who aren't computer experts.

<comment><USER2> Yubico Authenticator is a fork of Google Authenticator and is a drop-in replacement.

I have never had any problem helping someone that has used google authenticator set this up. Scan barcode and tap.

Also users have a much easier time when they get a new phone. Just tap to new phone and get codes. There is no data to transfer.

As for people getting locked out, that is what the printable backup codes are for, or a secondary key, depending on your threat profile.

In a corporate setting this is a non-issue as an admin can bail you out.

<comment><USER3> That's a desktop TOTP application. Now not only do they have to have their computer with them to log into their Google account from their phone, but they have to have 2 security keys on the account to remove their phone number from it, and all their backups are physically separated from them, so unless they bring their backup codes with them when they travel, if they lose their key, they're boned.

And all this for what real additional security?

If you want to nerd out and get your security key to do pet tricks like handling your TOTP secrets, I do not have a problem with that. But please don't tell ordinary users they're wrong when they don't do that.

<comment><USER2> I have Yubico Authenticator installed on my phone and my desktops/laptops.

The android app is a direct fork of google authenticator and has nearly identical UX.

I tap/plug my key to either of them to get a token.

If you want to make the argument TOTP via hardware token is overkill for most users, that is totally fair. On that note though, there is no point in having hardware token via U2F.

Security is ahout the weakest links. All I am saying is anyone going through the trouble to set up U2F as this guide suggests, might as well spend the extra 10 seconds to store their TOTP secret on the key as well, vs exposing it on the phone.

I assume someone that has a hardware token is getting it for a reason: To have assurances an attacker can't log in as them without that token.

<comment><USER4> I disagree with regards to your risk analysis.

Your cost/benefit considerations prioritize relatively _miniscule_ security improvements without considering usability costs or diminishing returns. While we're at it, why don't we just use one-time pads? After all, those are impervious to any form of cryptanalysis.

The risk profile for most users does not require a hardware-based auth factor if it results in _real world_ usability sacrifices that end in either 1) accidental misuse or 2) gradual disuse.

You're optimizing for someone compromising the device, great. But the point is that if that risk if on the table, all of this work is essentially meaningless anyway.

<comment><AUTHOR> "if that risk if on the table, all of this work is essentially meaningless anyway"

I can't agree with this strongly enough. If someone's willing and able to hack your iPhone, then you need more help than a random art major writing a yubikey howto can give you.

<comment><USER5> Just an offshoot thought, but some random art major writing one of these guides giving a bird's eye overview of the entire process is something most businesses should be able to do themselves. But they don't.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER6> U2F has some interesting properties. It cannot be phished (browser sends origin to the token), binds the credentials to username (you can use one token multiple times), can be attested (e.g. server can trust tokens only from manufacturer X), uses asymmetric crypto (P-256) instead of shared secrets.

</comment><comment><USER7> Thanks for writing this!

One nitpick: the guide says "If you're curious why it's important to not have a phone number on your account, see the security key FAQ", but the linked security FAQ doesn't actually appear to say why it's important.

<comment><AUTHOR> Sorry about that, I'm updating that FAQ next.

The answer is that SMS is not a secure second factor (it's easy to hijack and eavesdrop on), and in some cases when you give a service a phone number, it becomes possible to take over the account with just control of the phone number.

<comment><USER8> Google now offers "Google prompt" which sends a push notification to your phone through the google app. How secure is this method?

<comment><AUTHOR> Much better than SMS, but not as good as a security key, because if you can fool someone into logging in to an impostor site, you can get their email account.

It would be a reasonable backup in place of (or in addition to) Google Authenticator.

</comment></comment></comment></comment><comment><USER9> The article says that any key will do. Is there any concern with buying a less expensive security key from a less established company, or even a third party seller on a site like Amazon? Could a malicious entity make an intentionally weak security key and sell it? How would such an attack be detectable?

<comment><USER2> I would stick to things like nitrokeys/yubikeys that have gone through rounds of side-channel attacks, research, and upgrades.

The only one I can generally suggest for most people right now, in spite of it being closed, is the yubikey 4. Mostly because it can be configured to require a physical touch for each operation. Something a remote attacker can't do.

I started putting some comparisons down here: [https://github.com/lrvick/security-token- docs/blob/master/De...](https://github.com/lrvick/security-token- docs/blob/master/Devices.md)

</comment></comment><comment><USER10> I'd like some advice about safely accessing gmail from your phone.

In particular an android phone that might not have the latest version of android on it.

Also for situations where not only do you access your gmail from your phone but also your google authenticator app is installed on it.

<comment><USER11> The recommended way are app passwords. You basically generate a password for each app that needs to access your mail account. You can easily revoke access for a single app in case something goes wrong. Also, nobody gets the chance to read your actual password.

<comment><USER12> Unfortunately, you can't access GMail over its "native" protocol using app- specific passwords: it'll only work for IMAP. And the GMail client is a _terrible_ IMAP client. My inbox and folders / labels would constantly desync. I'd moved to FastMail a while back and the problem persisted, so I'm reasonably sure it's the client.

I'm actually using Outlook as my e-mail client now. It's surprisingly snappy for my minimal needs. Maybe I should switch to iCloud for e-mail, and aim for the trifecta...

<comment><USER13> Did you try K-9 Mail?

</comment></comment></comment></comment><comment><USER5> The HyperFIDO Mini (U2F Security Key) is the cheapest and smallest key I've found so far for $10. (Amazon)

The Yubico are probably the best key chain candidate. No one wants to trust their key to a weak nylon thread.

You can also set up a Google account to use more than one U2F key.

As for Google 2FA, I think Google caused a lot of confusion by how they set up the Google Authenticator app. Always opt for the text generator codes instead of a barcode. You can then use the code to use on a second Google Authenticator app on another device. Google at one time stated that you could only set up 2FA on a single device, which makes most users leary as one could lose his or her phone.

<comment><USER14> There's noting stopping you from scanning the barcode multiple times

<comment><USER5> Didn't it change the web page on your computer browser after you successfully added it into Google Authenticator?

I suppose you could always take a photo of the QR code and then rescan that. Text seems simpler.

edit: Anyone else remember this behavior? Old version? Browser specific?

<comment><USER6> It changes when you input current code. You can scan it multiple times, print it, and then input the code from one of your devices.

<comment><USER15> Also, if you have a rooted device, you can get the original secret from the SQLite database of the authenticator app.

<comment><USER16> "can get the original secret" is a phrase which should worry a security- conscious person

<comment><USER17> rooting their phone is not something a security-conscious person would do, either.

Edit: maybe I should have explained my position. There are a few security issues with rooting a phone, e.g.:

\- rooting usually requires unlocking the bootloader. Once it's unlocked, anyone can flash or boot a custom recovery and modify your system partition. Enrolling your own keys in the recovery and re-locking the bootloader, while possible, is an undocumented and complex process that just about nobody uses, see [https://mjg59.dreamwidth.org/31765.html](https://mjg59.dreamwidth.org/31765.html) . You're also screwed if a system update replaces the recovery. Once the bootloader is unlocked, anyone with physical access to your phone can mess with your system in malicious ways.

\- it circumvents the system's permission model. A malicious app that tricks the user into granting it root rights (maybe for a legitimate reason) could access information it shouldn't have, install a keylogger, etc.

</comment></comment></comment></comment></comment></comment></comment><comment><USER18> The article mentions Yubikey at $18. As an alternative, the Nitrokey U2F is only €9 (€11 including delivery)

[https://shop.nitrokey.com/shop/product/nitrokey-u2f-5](https://shop.nitrokey.com/shop/product/nitrokey-u2f-5)

<comment><USER19> Plus, unlike with Yubikey, Nitrokey has open-sourced both hardware and firmware [1].

[1] [https://github.com/nitrokey](https://github.com/nitrokey)

<comment><USER18> True for their storage and encryption products. Unfortunately not for their U2F product. "Nitrokey U2F is a relabeled 3rd party product and hence not open source."[1]

[1] [https://shop.nitrokey.com/shop/product/nitrokey-u2f-5](https://shop.nitrokey.com/shop/product/nitrokey-u2f-5)

</comment></comment></comment><comment><USER20> The article states:

>If you're curious why it's important to not have a phone number on your account, see the security key FAQ.

but this is not explained in the FAQ. I've never heard about this before, why is this important?

<comment><USER21> I guess because it's relatively easy to redirect/capture an sms/phone call. Trick the phone company into moving your number to a new sim for example

<comment><AUTHOR> Yes. Also governments can see SMS in transit (a concern in many places), and SMS-es can show up on a lock screen. I'm updating the FAQ next; sorry for this dangling reference!

</comment></comment></comment><comment><USER22> If you want to use your Google Account on your iPhone's Mail, Calendar, or Contact apps. Security Key doesn't work with apps that come on your iPhone, but you can use Google apps instead.[0] I'm using Google Contact on my iPhone. It seems security key is not for me. :(

[0]: [https://support.google.com/accounts/answer/6103523](https://support.google.com/accounts/answer/6103523)

<comment><USER23> Have you tried using app specific passwords?

</comment></comment><comment><USER24> Is there any point in doing this if you do not use Chrome?

<comment><USER6> Only Chrome supports U2F. Firefox has experimental support of you enable special flags in about:config but I never got it to work.

U2F will be superseded by Web Authentication [0] that includes U2F and will be supported by all major browsers. Edge includes draft spec API that uses TPM to store keys.

[0]: [https://w3c.github.io/webauthn/](https://w3c.github.io/webauthn/)

<comment><USER25> You can use U2F in firefox with extension. Last time I tried it worked. However I use chrome most of the time so I am not sure if it still does.

[https://addons.mozilla.org/en- Us/firefox/addon/u2f-support-a...](https://addons.mozilla.org/en- Us/firefox/addon/u2f-support-add-on/)

<comment><AUTHOR> You should not use Firefox if you want the protection of a U2F key.

</comment></comment></comment></comment><comment><USER25> Bought a U2F Yubikey more than a year ago. It is pretty sturdy. Better buy two and use one as a backup. U2F is really convenient to use. Compare that to all the OTP apps out there.

<comment><USER15> My Yubikey recently died, so I'd +1 on this approach to have another as backup. They offered to replace it under warranty, though.

<comment><USER2> I am very curious what you did to kill it. I have been unable to with anything short of a hammer or soldering iron.

</comment></comment></comment><comment><USER26> How does the communication between the USB key and Google in a browser work? Will it work on all operating systems and browsers?

<comment><USER27> As for the operating systems: in order to use it on your phone, you'll need to be careful to use a YubiKey with NFC support and have a phone that supports NFC. You won't have any trouble using it on Windows/Ubuntu/macOS.

As for the browsers: Chrome/Chromium works fine. Firefox has an addon that adds security key support[0]. Unfortunately, this addon has a bug which causes high CPU load[1]. Firefox is also working on adding the native support for this, and I think that their ETA is somewhere in the second half of this year to get this thing to work natively. Unfortunately, even with the U2F addon on Firefox, you still won't be able to use it for Gmail, since Google hardcoded its browser to be the only one with U2F support, so you're going to have to change your user agent in order to use it, or default back to your second method of 2FA (Google Authenticator or something of the sorts). I have no knowledge about the U2F status on Safari and Edge.

As far as I was able to discover, the only service that didn't hardcode Chrome as being the only browser at the moment with U2F support is GitHub, and using YubiKeys with Firefox + U2F addon on GitHub works without any issues (other than the occasional high CPU load that I've already mentioned).

I wrote a short article on my blog about Yubikey usefulness for my usual setup about a year ago[2]. Things changed slightly to the better since then, but not by a lot.

[0] [https://addons.mozilla.org/en- US/firefox/addon/u2f-support-a...](https://addons.mozilla.org/en- US/firefox/addon/u2f-support-add-on/)

[1] [https://github.com/prefiks/u2f4moz/issues/51](https://github.com/prefiks/u2f4moz/issues/51)

[2] [https://blog.r3bl.me/en/yubikey-review/](https://blog.r3bl.me/en/yubikey- review/)

<comment><USER6> U2F itself as a browser API is a dead-end and will be replaced with newer FIDO 2 WebAuthentication API, but fear not - it's supposed to be compatible with U2F tokens in use [0].

WebAuthentication will be supported in all major modern browsers [1], it just takes some time to implement.

[0]: [https://bugzilla.mozilla.org/show_bug.cgi?id=1065729#c254](https://bugzilla.mozilla.org/show_bug.cgi?id=1065729#c254)

[1]: [https://www.chromestatus.com/feature/5669923372138496](https://www.chromestatus.com/feature/5669923372138496)

</comment></comment></comment><comment><USER28> The best part of the article:

"If you're on a newer mac, you may have to use a USB adapter, like an animal"

</comment><comment><USER29> "We'll remove the phone number later"

Too late, Google now has it and can correlate my profile with other sources. There's literally no other reason why Google doesn't let you enable 2FA without a phone number.

I wish I didn't have to choose between security and privacy.

<comment><AUTHOR> There is a more benign reason Google requires a phone number—they're worried you'll lock yourself out of your account.

I'll take the Pepsi challenge with anyone on Google bashing, but I think this one is not fair.

It does hold for Facebook, though :-)</comment></comment>


Automate the Boring Stuff with Python - <AUTHOR> http://automatetheboringstuff.com/ <comment><USER2> This is awesome...I've actually been writing a Python 3.x guide like this for my own class...the more I teach programming, the more I find it necessary to tell students that programming is about learning how to make computer do shit work so that you can do the "real" work (at least, the thinking/designing phase). And so when figuring out what to do with programming, focus your programs on doing things you've already done before...just like when you learn Mandarin Chinese, you do it to be able to express things you've already expressed before in English, but to a wider/different audience.

edit: I had pitched this topic for a conference, though I'm mostly expecting it to be rejected for, well, being too mundane :) [http://srccon.org/sessions/proposals/#proposal-106215](http://srccon.org/sessions/proposals/#proposal-106215)

> _Programming creates so many technical and creative inventions that it 's > natural for aspiring programmers to dream of big projects in the cloud. But > this ambition ignores the actual goal of programming, which is almost > completely about making machines do mundane work. And it is > counterproductive to learning how to program, which requires consistent > practice as in every other form of literacy and art. So this session will be > about mundane programming. Programming not to be the next Zuckerberg, or to > get a better job 3 months from now, but to make today or just the next ten > minutes more enjoyable. Instead of focusing specifically on how to code, > we'll expand upon the reasons of why we code (though seeing is often > believing when it comes to code, so feel free to bring both ideas and > Gists). And we'll trim the personal prerequisites of programming, which > don't include being an entrepreneur, having a profitable idea, building a > website, contributing to open source, or changing the world or your career. > Programming can be learned, and done, with a willingness to learn and a wide > variety of small problems to practice upon._

<comment><USER3> If your talk gets accepted please post the video and/or transcript.

</comment></comment><comment><USER4> It's a great title. "Automate the Boring Stuff" seems to be the direct replacement (more or less) of "programming" for me. Maybe people without programming experience don't usually realize that programming is mostly about "automating the boring stuff". This title appeals for this simple "use case" which could win against the "scariness" of programming.

Or maybe it's not that scary for people to learn programming if you don't mention the word "programming"? It doesn't seem to be the intention here, the first part's title is "The Basics of Python Programming". But it seems to be a good strategy to appeal with the title first than in the TOC face the reader with the truth: what you are going to read about _is_ programming.

I know, I speculate too much. But I really like this title. I can imagine a businessman in a bookstore at the "computer" section looking for Excel or Word books looking into this book, while filtering out all "programming" books in his vision.

<comment><USER5> I agree the title is great, but unfortunately I fear that same business man will read the table of contents and go so what is the boring stuff that I can automate. I hope that the text brings to life some of the problems that the programming constructs can automate.

<comment><USER6> Author here. I'm hoping the back cover material will work, and the opening story in the first chapter is catchy enough:

"You've just done in two hours what it takes the three of us two days to do." My college roommate was working at a retail electronics store in the early 2000s. Occasionally, the store would receive a spreadsheet of thousands of product prices from its competitor. A team of three employees would print the spreadsheet onto a thick stack of paper and split it among themselves. For each product price, they would look up their store's price and note all the products that their competitors sold for less. It usually took a couple of days.

"You know, I could write a program to do that if you have the original file for the printouts," my roommate told them, when he saw them sitting on the floor with papers scattered and stacked around them.

After a couple of hours, he had a short program that read a competitor's price from a file, found the product in the store's database, and noted whether the competitor was cheaper. He was still new to programming, and he spent most of his time looking up documentation in a programming book. The actual program took only a few seconds to run. My roommate and his co-workers took an extra- long lunch that day.

<comment><USER7> Hi Al, I looked for a way to send feedback on the site, but couldn't find anything. So, posting it here. On the menu of chapters (displayed when you click on the floating menu button on every page), the sorting is broken; lexical order instead of numerical order is being used.

Thanks for writing this book and making it available under the Creative Commons License.

</comment></comment></comment></comment><comment><USER8> I was thinking about similar concepts and problems then I decided to create a framework [1] that could possibly solve those problems.

I created a lightweight system, that serves web pages, added proper authentication, storage (mongodb), memory storage/cache (redis) , simple ORM (mongoengine), automatic backend, background processing/scheduling (celery), email integration, single command deployment (automation)

I have also demonstrated how to do scrapping/scheduling/email sending in this tutorial:

[https://medium.com/project-enferno/create-your-first- minion-...](https://medium.com/project-enferno/create-your-first-minion-with- project-enferno-f7884aa95443?source=latest)

and this one explains how to automate the deployment of everything you create with the framework with a single command:

[https://medium.com/project-enferno/tip-deploy-enferno- framew...](https://medium.com/project-enferno/tip-deploy-enferno-framework-on- ubuntu-with-a-single-command-cc1a596ec3f7)

Hope someone will find this helpful.

[1]:My framework is called Enferno: [http://enferno.io](http://enferno.io) and runs on top of flask.

<comment><USER9> This is awesome! Thank you.

</comment></comment><comment><USER10> I'm very interested in this book. However, the author leaves no way for me to be updated when it's released. I have to bookmark the page and check later if I remember. For a book on automating, that's asking a lot of me. ;)

<comment><USER11> You can order at No Starch Press: [http://www.nostarch.com/automatestuff](http://www.nostarch.com/automatestuff)

</comment></comment><comment><USER12> I bought the PDF version of this a few weeks ago and it is pretty straightforward. Doesn't really teach you anything about classes/object- oriented programming. It really has a strong focus on getting sh*t done and is well-suited for it. Overall I would recommend this if you already have some programming experience.

By the way, if you have the book and are experiencing problems with `pip3 install python-docx` on OS X Yosemite, the solution is to install the Xcode command line tools first:

xcode-select --install

Then `pip3 install python-docx`

<comment><USER6> Yeah, I've always been of the mindset that until your programs get over 1000 lines of code, you probably don't need OOP.

Thanks for the pip3 tip, I'll post it on the website as I get content up.

</comment></comment><comment><USER6> Hi, author here. The HTML version of the full book content will be up in a few days. (I'm formatting it right now.)

Meanwhile, you can use PYBUTLER for a 30% discount on the book/ebook, and I'm offering a 70% discount on my other books: [http://inventwithpython.com/blog/2015/04/21/celebrating- the-...](http://inventwithpython.com/blog/2015/04/21/celebrating-the-release- of-automate-the-boring-stuff-with-python-with-discount-codes/)

Basically, it's a book for complete beginners who don't necessarily want to be software devs but do want to automate parts of their office job. Part 1 is a bare bones Python tutorial (I skip OOP entirely) and Part 2 covers practical stuff: moving/renaming/copying files, updating Excel spreadsheets, parsing PDFs and Word docs, web scrapping, GUI automation.

</comment><comment><USER13> This is very cool! I think this'd be a great incentive for people to learn programming and a great way to get into it - I know I've gotten a few folks to look into it purely by showing them how much easier life can be when you automate things. And people are more motivated to learn when something is solving real problems for them.

</comment><comment><USER14> Looks interesting. It sounds like it will attack a lot of the first things I did actual (non-homework, non-toy) programing for, which are also things I've tried (unsuccessfully) to convince others to learn just a bit of programming to be able to do. I hope this book accomplishes that.

</comment><comment><USER15> Great title, great cover, nice job Al!

<comment><USER6> :)

</comment></comment><comment><USER16> This is kind of how I got my girlfriend interested in programming. She was killing herself at work doing stuff manually with QGIS that could be automated with python.

</comment><comment><USER17> Any recommendations for similar material but for Javascript?

</comment><comment><USER18> Any recommendations for similar material but for Ruby?

<comment><USER19> Every Day Scripting with Ruby by Brian Marick, published by Pragmatic Programmers.

</comment></comment><comment><USER20> I'm not sure if this is a weekly release of a topic or a total release on April 25th. Wish there was a way to get in touch with the author!

<comment><USER6> Hi, author here. My email is firstname.lastname@example.com and Twitter is @AlSweigart. Please do send me feedback/questions.

I'm currently working on the HTML version of the book to be posted online, which will be at [http://automatetheboringstuff.com](http://automatetheboringstuff.com)

</comment></comment><comment><USER21> This book title seems also a great proposition for a software company aimed at improving and automating enterprise office work...

<comment><USER6> Author here. I guess so, but there are plenty of software companies with products to "increase office productivity".

But at the same time, there are a lot of times where you need a very specific, one-off, 30 line script to do something for your particular job/company. This is where knowing a general (and easy to use) programming language like Python comes in handy.

Hence why I wanted to write a programming book for office workers who wanted to skip the computer sciencey and software engineering aspects. Who cares if a throwaway script is O(N^3) if N is going to be a few hundred? Most of the time these things don't matter, because it's still faster than doing this stuff by hand.

</comment></comment><comment><USER22> Looks great! Was pretty bummed when I saw the April 25th release.

<comment><USER11> E-books are available now at [http://www.nostarch.com/automatestuff](http://www.nostarch.com/automatestuff)

<comment><USER23> but we cant download it unless we buy the physical copy !!

<comment><USER11> I'm not sure where you're seeing that. I see an option to buy the e-book only for $23.95 and the page has red text that reads "Full PDF, ePub, and mobi ebooks now available!". Am I missing something you see on the page?

<comment><AUTHOR> You can get a 30% discount [http://inventwithpython.com/blog/2015/04/21/celebrating- the-...](http://inventwithpython.com/blog/2015/04/21/celebrating-the-release- of-automate-the-boring-stuff-with-python-with-discount-codes/)

<comment><USER6> Author here. The 30% discount code is PYBUTLER, which you use on the No Starch Press site: [http://nostarch.com/automatestuff](http://nostarch.com/automatestuff)

</comment></comment></comment></comment></comment></comment><comment><USER24> This is cool but why wouldn't you just do all this in bash?

<comment><AUTHOR> Because I've noticed that my general happiness in life is inversely proportional to the time I spend writing bash.

</comment></comment><comment><USER25> This is cool. Python 2.x or 3.x?

<comment><USER26> It's python 3

<comment><USER25> thanks, and also - :(

<comment><USER27> Why would any new material, educational material especially, ever use Python 2?...</comment></comment></comment></comment>


Ask HN: How to build user experience for mobile applications - <AUTHOR>

I am developer more specifically a back end coder but when it comes to developing front-end for user i am not very well in it. I have develop a android app in my spare time which let user
1- Location based search on Google map
2- subscribe for live tweets on a particular location ( also send     tweets analytic i.e. no of tweets, top tweeter )
3- Sign in/ Sign out/settings and other about us tabs
I have completed the functionality but looks very simple because of front end. Is there any guide or tips available about How to create user experience in your app which keeps user interest in it. when i use apps develop by GOOGLE, APPLE and big giants they looks completely different, every layout, button and everything used make perfect sense
ANY TIP HOW TO MAKE APP MORE USER FRIENDLY
Thanks <comment><USER2> If it's a matter of tip, then I'd say you should check Google Material Design [1] and Apple iOS Human Interface Guidelines [2].

User Experience is a complex thing and people spend years studying what it takes to create good design and experience. Well, unless you have natural talent that allows you to feel it.

Anyway, check those two links above. They will tell you main guidelines which would help you to create simple, but at least not ugly app.Besides that you might want to check websites like Dribbble.com or Behance.com for inspiration.

[1] [http://www.google.ru/design/spec/material- design/introductio...](http://www.google.ru/design/spec/material- design/introduction.html#) [2] [https://developer.apple.com/library/ios/documentation/UserEx...](https://developer.apple.com/library/ios/documentation/UserExperience/Conceptual/MobileHIG/)</comment>


Researchers create "clickjack rootkit" for Android that hijacks apps - <AUTHOR> http://arstechnica.com/security/2012/07/researchers-create-clickjack-rootkit-for-android-that-hijacks-apps/?comments=1#comments-bar

<comment><USER2> There seems to be an article like this every month or so that makes it appear that the Android OS is full of security holes and its trivial to trick/phish users. But is there any actual reported widespread case? For how big the Android user base is, why is there nothing at the scale of the Windows viruses of yesteryear.

<comment><USER3> _But is there any actual reported widespread case?_

cf <http://news.ycombinator.com/item?id=4197340>

It may turn out that we are getting there.

</comment></comment><comment><USER4> So essentially it modifies a shortcut (well, adds one, deletes another)?

It's funny, you don't even need permissions to do this on Windows.</comment>


Are Video Games Weakening the Workforce? - <AUTHOR> https://www.washingtonpost.com/news/wonk/wp/2016/09/23/why-amazing-video-games-could-be-causing-a-big-problem-for-america/ <comment><USER2> First of all I think this article is completely delusional. I've yet to meet that many people who don't want a good job with good pay. The actual catastrophe that's happened is the massive loss of manufacturing. Vaclav Smil has said "In every society, manufacturing builds the lower middle class. If you give up manufacturing, you end up with haves and have-nots and you get social polarization. The whole lower middle class sinks."

And that's exactly what's happening. For all his faults (including mass manipulation and being a possibly-tyrannical demagogue) Trump is right about one thing - free trade is not always great and the loss of manufacturing was not "value added" for everyone in the US. But of course discussing this means opening up the whole argument about how economics is broken and you can't do that, as it would threaten stability too much. But anyone who looks into it can see it if they wish. Look into Jonathan Goldsmith's appearance on Charlie Rose when GATT (precursor to the WTO) was announced. He predicted the whole thing and what was going to happen. And he tried to warn us.

Link to video - [https://m.youtube.com/watch?v=4PQrz8F0dBI](https://m.youtube.com/watch?v=4PQrz8F0dBI)

See 1 minuet or 3 minute mark

<comment><USER3> Some of us don't think humans are less deserving on account of which side of a border they were born. Agreeing that free trade did somewhat hurt the American worker, America's loss helped lift hundreds of millions of people elsewhere (especially China) out of poverty.

It's hard to say they should have remained abjectly poor just so some Americans wouldn't experience a (fairly small) drop in living standard. A drop which could be alleviated by more socialist government policy anyway. From a global perspective, free trade is the best thing for improving the welfare of humans going.

<comment><USER2> It's creating social pressures that might unravel democracy though. It's happened before and it's happening again.

And you say "everyone is deserving of a good life" but Americans do not elect their representatives to lift hundreds of millions of Chinese out of poverty. They elect them to help improve their lives, and they are waking up the fact that they're not doing that, so they are choosing a radical alternative in a desperate attempt to move things in the other direction.

<comment><USER3> This is the problem with democracy: the people making the decisions often aren't those who are affected by them the most. It's how you define the _demos_. It's unjust for Americans to vote on policies that make the difference between life and death for large numbers of much poorer people, without giving them any say.

If democratic decision-making goes against vast improvements to the lives of billions of people, then democracy is simply wrong and should be abandoned.

<comment><USER2> Maybe you're right but I haven't heard of any sensible alternatives.

</comment></comment></comment></comment></comment><comment><USER4> this article amounts to a form of cultural warfare. it's singling out an "out- group" (young male gamer nerds in this case) to ridicule for one of their cultural preferences and conflating that cultural preference with a huge complex of other underlying structural problems that make it difficult for _some_ of them to get started in a long term career path right away.

honestly this kind of thing sickens me. washington post should be ashamed.

</comment><comment><USER5> This is some pretty terrible journalism. They start out with a personal story in the lede that I assume is not related to the study and whose subject was probably not informed that he'd be called "less educated" without any sort of qualification. The conclusion the writer wanted to make (that the US economy is in danger because of a declining workforce) is not reflected in the study nor common sense and the writer had to resort to finding a random economist unaffiliated with the study to parrot their conclusion. This does not belong on HN

</comment><comment><USER6> > has found little satisfaction in a series of part-time, low-wage jobs he's > held since graduating from high school.

Ha! Surprised? People are supposed to be "satisfied" with low-wage entry level jobs? Forget the video games, that's just funny right there.

Consumer entertainment, and especially games, are getting really really good. Somehow not surprising that games are more fun than crappy jobs. I guess it's too bad that games and gaming systems are a big fat piece of the economy now.

This article has multiple triggers for me. I was thinking bullshit several times at the statements full of assumption, but by the time I finished it, I think it convinced me there's some amount of actual cause for concern, maybe just not the inflated sky-is-falling amount it claims.

If happiness is going up, the first question is why is that a bad thing? It's a stated assumption in the article that we believe happiness will go down later, but this part doesn't have evidence, the evidence we have is that people working less and playing more are happier. What is the point of life if not happiness? There are some legitimate answers to that, but it's still a legitimate question, not to mention part of our belief system of inalienable rights in the US. Nobody was thinking shitty low paying entry level jobs when they were coming up with the phrase "life, liberty and the pursuit of happiness".

It also seems presumptuous to state as fact that this is a slippery slope that will hurt the economy. Historically, the economy has depended on high unemployment at times. Businesses and the rich complain when unemployment is too low. Moreover, the economy keeps crashing, often during times of high employment, for reasons surrounding the actions of a very few people.

On the bright side, if all the young men are succumbing to video games, maybe this is a good chance for women to take over the workforce.

</comment><comment><USER7> I've been saying for years that we need _mandatory_ career counseling for the young people. At least once a year.

Young people need to know what choices to make instead of the "follow your dreams" nonsense that works out for 1 out of 1000. Young people need to be aware of how many artists / historians / gender study / english students graduate each year and how bad they end up on average.

We need to show them that if you study X, your expected starting salary is A, and salary after 5 years is B. We need to show them trends and possible future skill demand.

They also need to understand what poverty looks like. Nobody thinks they will end up flipping burgers when they are in school / college. But many of them do, and the only reason is poor career choices.

<comment><USER8> Quite a good point, why would this be downvoted?

<comment><USER9> Because HN was wrong about their guidelines preventing the inevitable decline of the community and as more people have gained the ability to downvote they just do it over anything they disagree with. I haven't even been here that long and I've noticed a pretty big increase in the frequency of this type of thing happening in less than a year.

<comment><USER2> Ouch. I don't think that's quite true. His point was ok, but he took the validity of the initial claim in the article for granted ("young men are playing videogames instead of working hard") and most people here actually don't think that's true. It's a factual disagreement not an reflex like you paint it. The original article is nothing but socially-punitive speculation anyway.

</comment></comment></comment></comment><comment><USER10> Why aren't young men content to be a cog in the machine?

The American dream is dead. Blue collar workers can't get a home, a stable marriage or path of advancement in the workplace. Why wouldn't they turn off, tune in and drop out?

The economy is bifurcated. The price of most creature comforts, like video games, music, and other entertainment spirals down to nothing. While the requirements to become productive member of society (degrees, medical insurance, homes) spirals up. A person making fifteen thousand versus thirty thousand isn't going to make much of a difference when it comes to the big purchases.

Diminishing returns have never been higher for unskilled labor. Why wouldn't people direct that towards leisure?

</comment><comment><USER11> I feel like we are swapping cause and effect here.

</comment><comment><USER12> Well, at least when they play videogames they are not stealing cars or dealing drugs!

</comment><comment><USER13> Does the title "Are Video Games Weakening the Workforce?" not sound like click bait to you?

<comment><USER14> I'm usually in defense of titles, but I do think that a reasonable rule is, "No question-phrased titles unless the article concludes with a convincing answer one way or the other."</comment></comment>


How to mod a smartphone camera so it shoots a million frames per second - <AUTHOR> https://www.technologyreview.com/s/612410/how-to-mod-a-smartphone-camera-so-it-shoots-a-million-frames-per-second/ <comment><USER2> Will app developers be able to leverage this?</comment>


Cat DNA solves homicide - <AUTHOR> http://www.nbcnews.com/science/elementary-my-dear-fluffy-cat-dna-solves-another-homicide-6C10913900

<comment><AUTHOR> This is neat, but 3/152 is not uncommon enough for me to convict, I think, if it's entirely on this evidence.</comment>


Medical Resident Matches exposed in plain HTML - <AUTHOR> http://forums.studentdoctor.net/threads/want-to-know-where-you-matched.1060622/ Apparently whoever wrote the NRMP website are complete idiots - they've exposed everybody's match (supposed to be hidden until Friday 3/21) in the HTML source. <comment><AUTHOR> Whoever coded the NRMP website are apparently complete rookies - they've exposed sensitive information in the HMTL source of their site. Match results are supposed to be hidden until Friday 3/21.

Update: the NRMP website has apparently been taken down.</comment>


Translating SQL Queries using map, reduce, and filter in JavaScript - <AUTHOR> http://www.zsoltnagy.eu/translating-sql-queries-using-map-reduce-filter-in-javascript/ <comment><USER2> My Answer: To replace a SQL select with javascript map/reduce is senseless. The whole idea of a database is to provide high performance access to data using index lookups. This particular case can be performed by a full table scan and a merge/sort operation, and so the performance might be acceptable, that is not a general solution though.

As an aside: You could optimise this in sql by providing indices on some of the fields and the DB would then perform a full index scan rather than a table scan.

<comment><USER3> Additionally, SQL is a domain specific language that is standard and cross platform. Why write a query dozens of different times for dozens of different host languages when you could just write it once?

<comment><USER4> In C# where you have something similar with Linq it makes sense. The runtime translates Linq to expression trees and the Linq provider translates the expression tree at runtime to a native query. That native query can be anything - sql, mongoquery, or can be an in memory collection, etc.

You can use the same strongly typed Linq expression with anything.

<comment><USER3> I guess that's true! Embedded domain specific languages could be useful to swap out your data layer or provide a unified interface for different data layers.</comment></comment></comment></comment>


A Basketball Arena Battles for San Francisco's Heart - <AUTHOR> http://www.nytimes.com/2015/09/06/business/a-basketball-arena-battles-for-san-franciscos-heart.html?ref=basketball

<comment><USER2> Some people in San Francisco just cant stand progress at all,no matter the benefit. Too bad.</comment>


What are the new trends in recruitment? - <AUTHOR> https://www.quora.com/What-are-the-new-trends-in-recruitment/answer/Vinay-Johar-1?share=1 <comment><USER2> The top response's chart where: Quality of Hire [31%</comment><comment></comment><comment>--] Retention Rate [23%</comment><comment>---] Time to Hire [21%</comment><comment>--] Cost to Hire [7%----]

are listed as priorities in the 2018 Jobvite recruiter nation survey, would probably confirm many applicant suspicions regarding certain ailments in the white collar labor force.

If it is the caste that recruiters are willing to spend unlimited time and money chasing a limited pool of applicants, there is probably a point in their career when said applicants become "unemployable" through no fault of their own. To me it seems like AI recruitment is sort of a destabilizing force in society.</comment>