Blackbaud hack: More UK universities confirm breach - <AUTHOR> https://www.bbc.com/news/technology-53528329 <comment><USER2> I received an apology email from my Alma Mater. Here's an extract. The last para makes an explicit statement that Blackbaud paid the ransom.

 _On Thursday, 16 July, we were made aware of a security incident involving one of our third-party service providers, Blackbaud._

 _Blackbaud is one of the world 's largest providers of customer relationship management systems for the higher education and not-for-profit sectors._

 _It informed us that in May it had discovered and stopped a ransomware attack on its systems, although some data was compromised. A number of universities using its services have been affected, including the University of Leeds._

 _The company assures us that data compromised in the incident was comparatively low risk and did not contain any password, bank account or credit card information._

 _We are continuing to work closely with Blackbaud to determine exactly what personal data was compromised. We understand that other clients of Blackbaud have been affected in different ways, with varying types of data involved. In our case, it appears that names and email addresses for some members of our alumni and supporter community were affected. Information on the sums given as gifts or event payments through the alumni web portal, Leeds Alumni Online, may also have been affected, although not any bank account or credit card details. As we understand that you haven't used our website to make any financial transactions, this aspect will not affect you._

 _Blackbaud paid a ransom to the cybercriminal and received assurances that the stolen data was destroyed and not used or sold on to third parties. Blackbaud says that – based on the nature of the incident, its research, and investigation by third parties (including law enforcement) – it has no reason to believe any data went beyond the cybercriminal, was or will be misused, or will be disseminated or otherwise made available publicly._

<comment><USER3> > No reason to believe it went beyond the cyber criminal.

They have a really corporate sense of humour.

<comment><USER4> It's bizarre but these criminals need to establish trust generally.

If victims believed that a ransom wouldn't do anything they would not pay them as much.

I think there's a parallel with kidnapping in some countries, it's almost business like.

<comment><USER5> You can bet that if kidnappers could make an identical copy of the victim in order to profit from him further down the line, most of them would.

I fully expect this data to surface in a year or so.

<comment><USER3> Can you imagine having a Chief We-have-been-pwned Officer who is responsible for building relationships with criminals so that they would actually delete your data rather than resurface it years later when nobody remembers (not even you) you having lost it?

</comment></comment></comment></comment></comment><comment><USER6> The ACLU has been affected as well. From the email they sent out yesterday:

 _In all candor, we are frustrated with the lack of information we 've received from Blackbaud about this incident thus far. The ACLU is doing everything in our power to ascertain the full nature of the breach, and we are actively investigating the nature of the data that was involved, details of the incident, and Blackbaud's remediation plans.

We are also exploring all options to ensure this does not happen again, including revisiting our relationship with Blackbaud._

<comment><USER7> Throwaway account - I am in charge of IT from one of the universities affected and am angry at how blackbaud has been so slow at communicating this to us. Even when we asked them the exact fields/data that was stolen they just gave us vague answers.

Our contract with them ends soon and we will definitely not be renewing when it's up.

<comment><USER8> Such a breach could easily count as reason to annul the contract.

<comment><USER9> true. but it usually isn't worth the effort, as that would involve getting lawyers involved. easier to not renew.

plus most places will need some time to put an alternative in place. it's commendable if anybody manages to convince management and does this though. inertia and i imagine blackbaud did provide significant value/functionality?

</comment></comment></comment></comment><comment><USER10> This must be phonetically confusing to the very different piece of software also used a lot in the HE sector: Blackboard.

I have also received this from the University of York. The timescales in play here seem terrible from Blackbaud's discovery to initial report.

<comment><USER11> > The timescales in play here seem terrible from Blackbaud's discovery to > initial report.

That's going to keep happening until someone gets the book thrown at them for slow-walking a response. I know this is a pretty anti-regulatory crowd, but we can't expect this behavior to change if there are no consequences.

<comment><USER12> Consequences don't have to be regulatory.

How about an opt-in scoreboard or ratings system for responses, with some objective criteria?

Regulation would need to be based on objective criteria anyway, so why not develop them as an industry?

<comment><USER11> You think a ratings system would deter companies from misbehaving?

The credit rating agencies have some of the lowest consumer confidence scores in the entire country, and yet Equifax suffered no consequences from its massive breach a few years ago.

Also, your suggestion is opt-in. Why would any company volunteer themselves to be scrutinized in such a faux way?

<comment><USER12> I agree - credit ratings companies are garbage.

But it doesn't follow that all rating systems will be garbage for all time.

The rating system would not deter misbehavior. 'Misbehavior' in this case is just competence. The rating system would give clients some transparency into the competence of the service provider.

Any company that was confident in its processes would volunteer for scrutiny because it would be positive for their credibility, just like other independent certifications.

The question would then become - why would a customer choose an unrated company?

</comment></comment></comment></comment></comment><comment><USER13> For those unfamiliar, Blackbaud produce software that is (mainly) used for harassing^W updating alumni on university developments and asking them for money.

I think Raiser's Edge is used quite a bit in the sector, though I believe there are on-prem as well as cloud variants of the software?

<comment><USER14> How does asking for money make sense in case of for-profit, paid universities? You're saying that people pay them a significant amount of money for tuition, complete it, and now the university is asking for more money?

<comment><USER15> Yes, this a big part of how Colleges and Universities are funded.

Alumni tend to contribute either to leave a legacy behind or to help the College maintain it's reputation, which in turn helps the alum's reputation for having graduated from there.

<comment><USER16> >to help the College maintain it's reputation, which in turn helps the alum's reputation for having graduated from there.

Surely this can't work without some aultrism involved? I find it doubtful that any alumni can get 10k of benefit from the increased reputation that a 10k donation can provide.

<comment><USER5> It's the sort of transaction that typically lowers your taxable, effectively saving money to the donor.

<comment><USER17> That's not how reducing your taxable income works.

If you earn 50K, you net 37640. 51K and you get 38220.

If you earn 51K and donate 1K, you net exactly the same as if you just earned 50000. i.e. 580 less than if you had just kept it (If you had put it in your pension instead, you would have kept the whole 1000)

There may be some circumstances where it makes a difference, where certain thresholds could be crossed, but AFAIK, the way they all taper prevents that.

You can only get a tax break on 40K of pension contributions, so if you earn 91-101K and claim child benefit, without another pre-tax vehicle to soak up the rest, you'd have to pay the clawback charge. However, I doubt that would work. With 3 children you'd have to donate 10K to save about 2.5K.

If you earn something around 300K, it might do something because of the tapered pension allowance. Again, I doubt it. At 250K, if you donate 10K, you can put an extra 5K in your pension. Above that, I don't think there are any more thresholds.

<comment><USER5> You assume the funds are disbursed by individuals rather than vehicles, you don't specify which legislation you're considering, etc etc etc. I don't think you have enough facts here to start crunching numbers. In the UK for example there is Gift Aid for individuals: [https://financial- coaching.co.uk/blog/post/self-assessment-a...](https://financial- coaching.co.uk/blog/post/self-assessment-and-tax-relief-on-charitable- donations)

A number of schemes exist around various countries to promote incentives to donate, and they typically end up with people paying less tax overall than they would otherwise. (Note: I don't think it's a bad thing, no critique meant).

<comment><USER17> Yes, you pay less tax overall, but the reason for that is that the money is treated as having been given to the charity pre-tax. It does not make your net income go up.

In the illustration in your link, Sue gives 1k to charity, and as a result, and pays 350 less tax. This means that, as a result of this donation, her net income has fallen by 650.

I did not provide the specific names of all the rules, but I thought that would be obvious from the numbers, context, and some of the terms

I had not considered the difference between payroll giving (my first example,give 1k before tax, charity gets 1k, your taxable income is 1k less), and claiming back (you give 1k after tax, charity gets 1.25k, you reclaim some of the tax you paid), but payroll giving is more efficient for the donor, as they pay zero tax on the donation, rather than basic rate, as in the reclaim method.

There is no UK legislation, as far as I know, that reduces your tax bill by _more_ than your donation.

<comment><USER17> Briefly, my point is that tax efficient charitable donation schemes can only be said to benefit the donor if you start with the assumption that part of their lifestyle includes the charities getting a certain amount. E.g. if I want the charity to get 1.25k, I only have to spend 1k for that to happen.

The schemes amplify the effects of existing altruism, rather than offering incentives to persuade non-donors to donate.

</comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER18> Not at liberty to say which Unis, but this is much wider than initially reported. A lot of American universities were affected as well. They are still measuring the fallout, and how best to respond. We were only told last week.

</comment><comment><USER19> Wait they paid a ransom for the hackers to "delete" a _copy_ of the data? That's insane.

<comment><USER20> If the hackers don't delete the data and use it for something else, nobody will ever pay them again.

Most cryptolockers and other random criminals do exactly what they promise because if they don't, their business model will collapse. All of the stolen info isn't worth nearly as much as what universities are willing to pay out if you keep your promises.

It's wicked, but these criminals do have a business incentive to be nice. Their next target will probably pay again if they act smart.

<comment><USER21> I wonder if a university could protect themselves from this form of attack by amending their bylaws (or some other similarly legally-binding-and-hard-to- amend policy) to say, "We will not pay any ransoms for X, Y, or Z", and then publicise that decision widely, so any potential criminals know that there's no money to be made in targeting them.

<comment><USER20> It might, unless the attackers see it as a challenge. Many types of cybersecurity insurance won't pay out if you don't or will be more expensive than paying out, so it also might be an expensive bet to take.

The problem is that smart criminals don't directly attack a single corporation or university, they'll attack a SAAS/IAAS/PAAS provider many of their potential targets use and see what they can get out of the data. In this instance even one university paying out would probably be enough to offset the risk and cost of the criminal operation.

In many cases, paying out is also the economical choice to take, especially in ransomware attacks. Even if backups were made, tested and recent, paying a million here and there might still be worth it if not doing so would cost weeks or even months of work and employees and students lacking IT services. With modern education being run like a business, I'm not sure if it'd even make sense to bet on such a statement to be worth it. You may shoot yourself in the foot when you eventually do get hit and you need to either spend lots of time and money or break the promise you made on your website (betraying your employees and students in the process by showing that you cannot hold up the values you claim to have).

</comment></comment></comment></comment><comment><USER22> Our son is at Exeter University and they notified me a couple of days ago about this - they identified Blackbaud as the service that had the problem.

<comment><USER23> Yup, we received emails from them about it - we graduated nearly 20 years ago. I guess that's the price you pay when you say "yes, send me an alumni email every so often"

</comment></comment><comment><USER24> The individual party incentives in ransomware are all to pay it, which encourages future attacks, only the long-term, societal view discourages payment.

The victim (individual organization or SaaS provider) wants to just have it end.

The ransomer has the incentive to build the pattern of "pay the ransom and nobody gets hurt [in this incident]", because it builds the business model.

Cybersecurity insurance exacerbates the problem, because the insurer knows that payouts solve the incident for the insured at a relatively low cost, and that each incident perversely increases the need organizations have for the insurance.

Conversely, if no one pays ransoms, it immediately ceases being a viable criminal business model.

</comment><comment><USER25> I've read in some article that insurance companies are actually encouraging the hackers by forcing their insured victims to pay the ransom instead of try to recover on their own or fight back the hackers in any way.

<comment><USER26> That's the way it works with liability insurance — if you want the coverage, it's up to them, not you whether you settle or fight. But one would hope in the insurers are smart enough not to encourage bad behavior.

</comment></comment><comment><USER26> I'm sure the appropriate sanction for Blackbaud would bankrupt the company. While that is probably the best outcome long term, it doesn't help anyone now.

</comment><comment><USER27> How was trusting the word of a bunch of criminals, with no reason to follow through with deleting the data, the correct course of action? Isn't a failure to disclose what data was comprised, and how, a breach of GDPR?

<comment><AUTHOR> I forgot the exact GDPR laws but I think if they failed to disclose the security breach within 3 days of discovery they are subject to a fine of 4% of their revenue.

<comment><USER28> Up-to 4% of their global revenue or €20,000,000 whichever is higher. Those are the maximum fines they can levy (per incident), but in reality it's very unlikely to be that high.

And yes, you are correct, organisations have 72 hours to disclose the breach.

The various data protection offices (such as the ICO in the UK) usually try to work with organisations first. If Blackbaud aren't playing ball though, they may be in for a rough ride (assuming that they actually operate where the EU has jurisdiction that is).

<comment><USER29> Slightly nitpicky but the 72 hour piece is wrong here

A data controller has 72 hours to notify the ICO (or other supervisory authority). A data processor has no such obligation [unless specified as part of the data processing agreement DPA]

Most DPA will state asap s.t the controller can notify

But in this instance Blackbaud would almost certainly be a processor

(It's a neat [nasty] little loophole

<comment><USER8> Article 28 makes it a requirement that the processor and the controller arrange for this notification requirement to be arranged between them. A failure to do so by the processor would likely make them liable. The processor is only able to discharge itself from this liability _if_ they notify the controller promptly.

For more reading on this:

[https://ico.org.uk/for-organisations/guide-to-data- protectio...](https://ico.org.uk/for-organisations/guide-to-data- protection/guide-to-the-general-data-protection-regulation-gdpr/personal-data- breaches/)</comment></comment></comment></comment></comment>


How rats became an inescapable part of city living - <AUTHOR> https://www.nationalgeographic.com/magazine/2019/04/rats-are-an-inescapable-part-of-city-life/ <comment><USER2>
        > From Seattle to Buenos Aires, urban rat populations are rising—as much as 15
        > to 20 percent in the past decade, according to one expert. Charismatic
        > animals like elephants, polar bears, and lions are all in decline, yet
        > inside our cities, we find it hard even with extraordinary efforts to keep
        > rat populations in check.

One big reason for that is the removal of free-roaming cats and dogs from human habitats.

Free roaming cats and dogs have been a part of our society for as long as we've been forming cities, we only recently decided to remove them. Of course it's going to have the knock on effects we're now starting to see,

* vermin

* food waste

* wild animals venturing into cities

* etc.

<comment><USER3> They went into trash nowadays. Also cats preying on birds and decimating them. There's no ideal solution.

<comment><USER4> Because human cities didnt have gigantic midden piles before? There's no change there.

</comment></comment></comment><comment><USER5> I grew up in Istanbul -- the cat city -- where free roaming cats are everywhere and have never seen a mouse in my life. I thought "mice in city" was a Medieval thing. Until I moved to Bay Area... And then I moved to Boston... Turns out there are mice all over the cities in US.

EDIT: Also recently I learned I'm allergic to mice. This went undiagnosed for 22 years until I moved into Boston.

<comment><USER6> That's interesting, I've heard similar things about Rome (where I've never been either).

My big worry about maintaining a large population of roaming cats is the impact on the bird population. I'm interested in hearing directly from someone who grew up in Istanbul - do you recall hearing or seeing birds often growing up?

<comment><USER7> Didn't grow up there but visited. Istanbul is on the sea, so there are plenty of seagulls - aka "sea rats", since they feast on trash. The few open / green spaces I've seen had plenty of birds, mostly pigeon-like if i remember correctly.

Been to Rome a few times too and that's also pretty full of pigeons, afaik. The feline colonies in Rome are the stuff of legend, several Italian writers used them in stories. I bet they've been around since Roman times...

<comment><USER6> That makes a certain amount of sense. I'm not too surprised seagulls would be ok in the presence of cats. They're large, fairly powerful birds. Crows also seem more common in SF than they were in previous decades, and again, I'd expect crows to be more resilient facing a predator like cats. They're large, highly intelligent, pretty tough, and fight in groups.

Here's the thing - to a large extent, the birds you mentioned are urban birds, by and large. Seagulls are very coastal, but as you said, they eat trash, so the population will be very large in coastal urban areas. Crows also tend to flourish in urban areas. Pidgeons are notoriously urban creature, and while I've seen cats prey on them, they don't seem as vulnerable as smaller song bird species.

I'm interested in whether these smaller songbird species are present in Rome or Istanbul or other places that are cat-heavy, though there are of course factors other than cats (some regions wouldn't have these species regardless of the presence of cats).

</comment></comment></comment></comment><comment><USER8> [https://outline.com/sPzj3G](https://outline.com/sPzj3G)

</comment><comment><USER9> "It is the tail," says Laurinda Williams, who breeds rats on Long Island and sells them as pets. "If it weren't for the tail, everyone would have rats."

Definitely true.

The other thing about rat size... man IDK. I was in Panang Malaysia and saw a dead rat in a drain that blew my mind it was so large. It was no doubt in my mind over 2lbs. It was nasiating to see, and I've seen rats in DC, NYC, Paris. The articles claim of 1lb 13oz might be correct but it sure seems they must be extremely light for their size.

<comment><USER10> Back when I was a student I kept a couple as pets, as they were much more interesting than gerbils, mice, and hamsters. (That's about the size of pets we had space for.)

I do recall a few people were weirded out by their tails, but I never really understood it.

I'd be happy to keep rats again, they're intelligent enough to do interesting things, and learn from their environment. They can also respond to simple verbal commands - recognizing their names - and they're not at all prone to biting children, which is a good thing!

<comment><USER11> Seconded; I had a pair of rats until recently, and they made awesome pets: affectionate, smart enough to play with, and with distinct personalities while being pretty low maintenance (and willing to eat most of our food scraps). If my partner hadn't developed a skin allergy to them (which made handling them suck for her) we would for sure have acquired more when ours died.

Edit: in retrospect, I'm pretty sure that quote is from the breeder we used! She's doing hamsters and rabbits now as well.

</comment></comment></comment><comment><USER12> > _So the extermination industry uses anticoagulants, or blood thinners, which > don't affect rats for hours and don't kill them for several days. The rats > die slowly from internal bleeding. Corrigan hates to inflict such a death, > but he fears outbreaks of disease. So he continues to lend his expertise to > clients._

This is incredibly short-sighted thinking: Even if we ignore the horrible death it inflicts, what happens to the anti-coagulants after the rat dies?

Here's one example at the top of the page: [https://www.mountainlion.org/actionalerts/043014CAab2657/043...](https://www.mountainlion.org/actionalerts/043014CAab2657/043014CAab2657.asp)

It's not like these poisons hit a precise target and magically evaporate: They remain in the environment, and then what goes around comes around.

</comment><comment><USER13> Guess we're lucky not to have rats here in Alberta.

<comment><USER14> I had no idea! Fascinating.

[https://nationalpost.com/news/canada/the-stirring-story- of-h...](https://nationalpost.com/news/canada/the-stirring-story-of-how- alberta-became-the-first-place-in-the-world-to-banish-the-rat)

</comment></comment><comment><USER15> It's a little odd that the second paragraph of the article cites how rats "may have transmitted plague" and then links to an article titled "Maybe Rats Aren't to Blame for the Black Death".

Why?

<comment><USER16> The "common knowledge" is that rats (or their fleas) transmitted the plague. New research suggests this might not be the case.

<comment><USER17> Here is a link to that research: [http://sci- hub.tw/https://doi.org/10.1073/pnas.1715640115](http://sci- hub.tw/https://doi.org/10.1073/pnas.1715640115)

</comment></comment></comment><comment><USER18> well, _something_ has to be there, right?

there's a lot of energy floating down there in the urban substrata, from sewage and trash going upward, so a food chain naturally emerges as opportunistic omnivores break the ground with predators following suite.

</comment><comment><USER19> I don't agree with the idea that rats size is exaggerated in NYC. I have seen some at a building under construction at night that left me perplexed. A rat on steroids I'd say, walking like a pitbull..

</comment><comment><USER13> I guess we're lucky in Alberta to not have rats

</comment><comment><USER20> Little known fact: rats, mice and pigs are our closest relatives, beyond primates. Which is why we test stuff on mice. And use pigs in developing medical devices.

<comment><USER21> This can't actually be true, because rats and pigs are not closely related to each other. Pigs are more closely related to whales than they are to rats, which means that if (say) we were more closely related to pigs than to rats, we would also be more closely related to whales than to rats.

In terms of taxonomy, primates are an order of mammals. It follows immediately that humans are equally closely related to all non-primate mammals. (That's not true either, as you can see by e.g. the designation of marsupials as an "infraclass", a level between class and order, but it's the first approximation to reality.)

<comment><USER22> You say "that's not true either", but really, it was never true in the first place. Traditional taxonomy is bad at determining how related species are. If you want that, you look for evidences of common ancestors, or do DNA analysis.

I tried digging through Wikipedia articles on taxonomy, but it seems to be a bit of a mess, with different articles in the hierarchy using different, incompatible sources. It looks like rodents and primates are both members of clade Euarchontoglires, with common ancestors 85-95 mya.

[https://en.wikipedia.org/wiki/Euarchontoglires](https://en.wikipedia.org/wiki/Euarchontoglires)

Clade Laurasiatheria is a sibling containing pigs, cats, whales, bats, and many others. Common ancestor with primates is listed as ~80-100 mya (yes, this number doesn't match the other one).

<comment><USER20> I clearly recall reading that DNA-based phylogenetic analysis indicated that primates and rodents have common ancestors that are more recent than common ancestors with other mammals. So in that sense, rodents are more closely related than, for example, dogs, cats, cattle, etc.

Pigs I may be wrong about. They're clearly more similar than dogs, cats and cattle. In embryonic development, for sure, and I remember that from dissecting a fetal pig. And there is the saying that embryology recapitulates phylogeny. But a quick search didn't come up with any DNA-based phylogenetics.

As you say, "traditional taxonomy is bad at determining how related species are". It's largely based on morphology, embryology and fossil evidence. But that can be irffy, given the thin fossil record, and the common occurrence of independent selection.

DNA-based classification is really the only way to get objective phylogenetic trees. And as we get them, we learn that lots of classical taxonomy is just wrong. And that's why reading about taxonomy online is so confusing. It's a mix of old and new, with lots of more-or-less uninformed speculation.

<comment><USER21> > Pigs I may be wrong about. They're clearly more similar than dogs, cats and > cattle. In embryonic development, for sure, and I remember that from > dissecting a fetal pig. And there is the saying that embryology > recapitulates phylogeny. But a quick search didn't come up with any DNA- > based phylogenetics.

The saying exists, but it is not based in anything other than wishful thinking. Ontogeny does not recapitulate phylogeny; that saying is the tongue map of evolutionary analysis.

[https://en.wikipedia.org/wiki/Recapitulation_theory](https://en.wikipedia.org/wiki/Recapitulation_theory)

> the shortcomings of the theory had been recognized by the early 20th > century, and it had been relegated to "biological mythology" by the mid-20th > century. This did not prevent its propagation into the 21st century in a > variety of biology textbooks.

If you believe the page on euarchontoglires, you can see that pigs cannot be more closely related to humans than dogs, cats, and cattle, because all four of those human-other pairings have exactly the same common ancestor, the common ancestor of the euarchontoglires (the tree branch containing humans) and the laurasiatheria (the branch containing pigs, cattle, cats, and dogs). Any closer "similarity" between pigs and humans in specific is not driven by their evolutionary relationship.

> DNA-based classification is really the only way to get objective > phylogenetic trees. And as we get them, we learn that lots of classical > taxonomy is just wrong.

DNA-based classification is not conceptually different from morphology-based classification. They are both directly premised on the model of "descent with modification". DNA-based classification is generally superior because there is more information in the DNA than in the morphology. (Or at least, we recognize more information in the DNA than we do in the morphology.) But morphology- based classification did nearly 100% of the work of establishing modern taxonomy, and overwhelmingly DNA-based analyses confirm the existing morphology-based conclusions.

> traditional taxonomy is bad at determining how related species are

This is true in the sense of assigning a cardinal number to the relationship. ("Diverged 80mya.") It is false if your goal is only to assign an ordinal number. ("Humans are closely related to baboons, distantly related to rabbits, and remotely related to elephants.") The same objection applies to DNA-based taxonomy; we get cardinal numbers by assuming a particular constant-rate molecular clock, but the raw conclusions of DNA analysis are entirely ordinal.

> as we get them, we learn that lots of classical taxonomy is just wrong.

(quoting again to respond along another topic)

Notwithstanding the overall massive success of traditional taxonomy, there are some obvious weak points. They tend to derive from philosophical beliefs of the biologists rather than from failures of the morphology-comparing model. Two major biases that I'm aware of are the historical belief that taxa at the same level should include roughly the same number of extant species -- this was featured in a "teach the controversy" sidebar in a college biology textbook of my mother's -- and the stronger view that genera should contain more than a single species. Since the groupings prompted by these beliefs were not even _intended_ to "cleave reality at the joints", it's not so surprising that they suffered under more objective analysis.

<comment><USER20> OK, I've largely conceded re pigs.

But do you agree that there's a good case that rodents are more closely related to primates than most other mammals are? Or do you believe that the evidence is too weak?

I could do some serious literature research, I suppose. But I didn't really set out to write a review.

<comment><USER21> I have nothing against the claim that rodents are closer to primates than other mammals are. I don't think that goes a long way toward explaining the use of mice in labs; it would be an equally strong argument for using gerbils, rabbits, capybaras...

I think mice are used because they're small and easy to keep, and because by now there's a lot of lab-mouse-specific infrastructure -- existing literature about them, special strains of mice bred for use in the lab, and so on. [https://en.wikipedia.org/wiki/Laboratory_mouse#History_as_a_...](https://en.wikipedia.org/wiki/Laboratory_mouse#History_as_a_biological_model) suggests (in my eyes) that the use of mice is basically a coincidence.

The fact that they're at least as closely related to humans as other similarly cheap, non-dangerous animals is a plus, but I don't think it was the reason mice were used historically and I think it's only a minor contributor to the continuing use of mice today.

When you're really hoping to transfer a finding over to humans, you use monkey models, though I understand those are getting rarer under a combination of cost and animal-rights-activism issues.

<comment><USER20> From an historical perspective, I totally agree. Decades ago, when scientists settled on the mouse model, I don't believe that there was much (if any) solid evidence about evolutionary relatedness. As you say, mice were used because they were the least-expensive mammalian option.

Even so, it's arguable that predictive success for the mouse model helped drive its widespread adoption. Even so, just about all small mammals (e.g., rodents, shrews and moles) are more closely related to primates than large mammals. So maybe it was inevitable.

> ... getting rarer ...

Funny story. I was a grad student in the late 70s. And there was an animal- rights riot on campus. The primate lab was besieged. And some of us, whose thesis research depended on our building's mouse colony, were totally freaked.</comment></comment></comment></comment></comment></comment></comment></comment>


AT&T's Android sales are catching up to iPhone - <AUTHOR> http://money.cnn.com/2011/10/20/technology/att_earnings/index.htm

<comment><USER2> Actually supporting and promoting Android on the network seems to go a long way. AT&T has been very slow to adopt Android before or promote it because they wanted to make Apple happy, but now that Apple has gone to other carriers, they seem to want to balance it out as much as possible.</comment>


How Tracking Down My Stolen Computer Triggered a Drug Bust - <AUTHOR> http://blog.makezine.com/2012/08/31/how-tracking-down-my-stolen-computer-triggered-a-drug-bust/

<comment><USER2> It is nice to hear a story involving the police in which they're helpful and effective rather than spraying protesters/journalists/bystanders with pepper- spray.

<comment><USER3> If that's what you think of police you've been reading reddit too much.

There's also a bit of the man bites dog thing going on. Nice police: Normal, not news. Bad police: Very unusual, so news.

<comment><AUTHOR> I think the fact that the police officer was so involved with updating the writer is what stood out to me. It is rare that we see/hear a detailed explanation of what police work entails and unless we ourselves are the one they are speaking with it might never happen.

</comment></comment></comment><comment><USER4> I'd rather lose the laptop but have full disk encryption and keep my data secure.

<comment> mike-cardwell I have the best of both worlds. Turn my laptop on and it will automatically boot into Windows without even so much as a password prompt. From there I have Prey installed so I can track it.

I never use this Windows installation though and it contains no valuable/personal data. It's effectively a honey-pot operation system. I have a Linux installation on there too (my "real" os) which takes up the vast majority of the drive and uses full disk encryption. I insert a USB stick at startup which contains the boot partition+loader and boot from that.

I wrote it up here: [https://grepular.com/Protecting_a_Laptop_from_Simple_and_Sop...](https://grepular.com/Protecting_a_Laptop_from_Simple_and_Sophisticated_Attacks)

<comment><USER5> So you shut down your computer (as opposed to suspending it) every time you transport your computer from home to office and vice versa etc?

<comment><USER6> What's so unusual about that? I almost never suspend my laptop.

<comment><USER7> I almost never shut it down. Probably only once a month.

Waking from sleep is faster and I don't have to re-open my applications and documents. Shutting it down would save a small amount of power but that's rarely an issue (I'd shut it down if I was flying somewhere).

Are there some benefits to shutting it down I'm overlooking?

<comment><USER8> If you suspend, you are vulnerable to reading decryption key from RAM (firewire, ram freezing). If you are doing full disk encryption, then only shutdown or hibernate are secure.

<comment> mike-cardwell My encryption key doesn't live in RAM because I use TRESOR. It's hidden in the debug registers of my CPU. There is still going to be other sensitive information in RAM though which I wouldn't want to be accessed.

</comment></comment></comment></comment></comment></comment></comment><comment><USER9> I had a similar experience that took place over the course of a single day in which I tracked down that thieves in real-time and confronted them in a parking lot. Instead of calling the cops, and since they had taken money and not an actual laptop, I had them give me collateral and gave them 2 weeks to give me money back in exchange, which they did after.

I actually did write up and submit a police report, but it was about 3 months before I heard anything from the police.

Lessons learned: (1) sometimes it's better to roll up your sleeves and do it yourself and (2) some (most?) people legitimately want to come clean.

<comment><USER10> If they had taken money instead of electronics, how did you track them?

<comment><USER9> I trailed one of them.

</comment></comment></comment><comment><USER11> Too bad that some guy is going to spend years and years in prison over drug charges when he should really only be charged with theft but I guess the lesson is don't go stealing traceable devices when you're running a dope operation.

<comment><USER12> In what way could that possibly be 'too bad'??

"Too bad that some guy is going to spend years and years in prison for provable murder when he should really only be charged with stealing candy"

Idiot gets caught and gets what he deserves. All is well.

<comment><USER11> Possession of marijuana and murder, two completely analogous things. I certainly hope all the people he victimized with his marijuana possession get compensated.

</comment></comment></comment><comment><USER13> Great read.

I am going to make all my mobile devices hit a webpage on a few of my servers silently on bootup (if there is a web connection) so I would at least have that ip. Also embedding a hidden image into the browser about:blank (startup) page.

<comment><USER14> I wonder if you could install something on the BIOS as well in case they try and wipe the Operating System (which they really should do if they want to be safe).

<comment><USER15> Just use FDE; if the thief doesn't know the password everything is effectively wiped already.

</comment></comment></comment><comment><USER16> As someone said in the article comments, if you liked that story, go watch:

<http://www.youtube.com/watch?v=U4oB28ksiIo>

          Defcon 18 - Pwned By the owner
          What happens when you steal a hackers computer zoz

</comment><comment><USER17> Mostly agree with his conclusions, but for one. I didn't think Batman was all that great.

</comment><comment><USER18> Oh Make Magazine, please put your "close this slide show" button on the upper right instead of the upper left. I'm conditioned to look for X icons to close out of modal windows on the upper right not the upper left. Thaaaaaaanks.

<comment><USER18> I have no way of minimizing your "toolbar" at the bottom of your web site either. Weren't you created by O'Reilly.com?

</comment></comment><comment><USER19> great story! A friend of mine got her iPhone stolen, Find My iPhone didn't render anything for days so she gave up on it and got another one. This kind of technology should be standard on any new device

</comment><comment><USER20> It's surprising that apparently almost no laptop thief takes the time to wipe the laptops.

That's the first thing I would do if I were in a business like that.

<comment><USER21> They probably aren't really laptop experts & don't have the install disks either. But you'd figure the word would have gotten around by now that these things can phone home.

I have heard of muggers stealing cell phones and taking the time to demand the pass code as well, so they're getting smarter about it.

</comment></comment><comment><USER22> Great read and this brings me to ask what options there are for hard drive encryption on OSX?

<comment><USER23> OS X offers FileVault natively for full-partition encryption. There are also myriad 3rd party options.

EDIT: See larry's coment :o)

<comment><USER24> Pedantic note, it's actually full-partition encryption. The recovery partition and boot camp partitions, etc, are not encrypted.

<comment><USER22> So it would still be possible for the thief to boot to the recovery partition and wack the encrypted partition. Clean machine but at least none of my data.

Is there a Boot Loader or Bios password type option to beven prevent the user from holding down 'Option' and selecting a boot device..

NOTE: Yes I know it is EFI, but everyone knows what a BIOS password is, I think.

<comment><USER25> >Is there a Boot Loader or Bios password type option to beven prevent the user from holding down 'Option' and selecting a boot device..

If they know to hold down "Option," chances are they also know how to open up the case and swap out the HDD.

Backup, encrypt, insure. It's the only way.

<comment><USER26> When Firmware Password is activated, you can't use other HDs without entering the PW.

<comment><USER23> There are ways around the fw password, so it's an additional layer against the uninitiated but probably won't help you much and can cause problems for legitimate users.

<comment><USER27> Don't those require going to an Apple store, officially, which gives them a chance to check serial # vs. stolen list? (It used to be possible by pulling the RAM, but on modern MBA's, the ram is soldered to the main board.)

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER28> Brilliant story!

</comment><comment><USER29> Idiot. Who leaves valuables in a car in Detroit? Are you not aware that the windows are all that keeps someone from popping the trunk?</comment>


MoNETA: A Mind Made from Memristors - <AUTHOR> http://spectrum.ieee.org/robotics/artificial-intelligence/moneta-a-mind-made-from-memristors/0 <comment><USER3> I wonder if these memristor computers could be attached to our brain, increasing memory capacity, processing power, creating a HUD-like overlay without the need for external displays (just tap into the part of the brain that we use to visualize objects) - now that would be really impressive. Damn, I hope I get to use at least a memristor-based computer in my lifetime :-)...

<comment><USER4> Would you go under brain surgery to get implanted something that will be obsolete in 18 month?

<comment><USER3> Hmm, if it allowed me to store and _easily_ access say, ~2 Terabytes of data (books, videos, etc.) and the risk was minimal, then frankly, yes...

Plus, I'm sure they won't be obsolete that fast - once it develops to a certain point, the need to upgrade won't be as urgent - kind of like the difference between a Pentium 4, a Core 2 Quad and a Sandy Bridge Core i7 - <USER2> performance difference is huge, but the C2Q's useable lifespan is about a decade, whereas the P4 was only useable for less than 5 years. Sandy Bridge will be fast for at least a decade, as well...</comment></comment></comment>


Ask HN: Is HN Enforcing Conformity? - <AUTHOR> En therefore actually removes possibly to discover novelty defeating the purpose of the website? <comment><USER2> Thats not the purpose of the website

<comment><AUTHOR> What is it then</comment></comment>


MIT creates car co-pilot that only interferes if you're about to crash - <AUTHOR> http://www.extremetech.com/extreme/132812-mit-develops-intelligent-car-co-pilot-that-only-interferes-if-youre-about-to-crash <comment><USER2> Correction: it only interferes if it _thinks_ you're going to crash. This is an important distinction. The question is, are the number of false alarms (and there _will_ be false alarms) going to cause more crashes than the system prevents?</comment>


Predict the Output Challenge in C#, part 3 - <AUTHOR> http://www.volatileread.com/Wiki/Index?id=2092

<comment><USER2> These are quite good and definitely result in quite surprising output in some cases.

I would have liked the descriptions/answers to be a bit more detailed though. For example, why is the static constructor called only after the instance constructor (in part 2)? As far as I can see in the docs, this should not be the case?

<comment><AUTHOR> static constructor does get called first. The problem is in this line: static readonly Singleton _instance = new Singleton();

The static variable depends on the instance. So static gets called first and starts running, but before it could call the Console.WriteLine, instance of Singleton gets created due to the above line and hence the instance constructor.</comment></comment>


Verizon to Launch $50 Unlimited Prepaid Plan - <AUTHOR> http://www.cultofmac.com/113555/verizon-to-launch-50-unlimited-prepaid-plan-right-in-time-for-the-new-iphone-report/

<comment><AUTHOR> Right in time for the new iPhone.</comment>


The Hong Kong Way - <AUTHOR> https://www.nbcnews.com/news/world/hong-kong-protesters-form-28-mile-human-chain-demanding-democracy-n1045716 <comment><USER2> Isn't the biggest problem of HK people vs. PRC central govt is that the primary goal seems to be getting everyone in HK and the mainland to live by the same laws (regardless of transfer of sovereignty agreements between UK & PRC), and so allowing freedoms in HK would effectively mandate the same freedoms in the mainland as well?

</comment><comment><USER3> Free Hong Kong!

<comment><AUTHOR> I agree... I think we should be ready to evacuate Hong Kong if China sends in the military. China has built up a huge military presence nearby. Tiananmen has shown us the communist party is willing to slaughter thousands of kids to protect their power.

<comment><USER4> "thousands of kids" ohoho... Right ...

<comment><AUTHOR> Says the account created 58 days ago, possibly coinciding with China's PR push? I'm not sure how people who support a murderous dictatorship live with themselves.</comment></comment></comment></comment>


In Israeli desert, world's highest solar tower looks to future - <AUTHOR> http://www.timesofisrael.com/in-israeli-desert-worlds-highest-solar-tower-looks-to-future/ <comment><USER2> There is one country that might have the greatest ability to generate solar power, yet it's still not used, Algeria has one of the biggest deserts in the world and the power generated from there could be enough to get rid of a lot of oil generated power.

<comment><USER3> For a long time, space is not going to be the limiting factor and "small" deserts like Isreal's are sufficient. The limiting factors are more likely infrastructure, logistics, skilled workers, the local energy market, and so on. For these reasons, Algeria is not really in a better position to implement large-scale solar than many other countries.

</comment></comment><comment><USER4> >Energy from a solar tower is "two to three times more expensive to produce than classic electricity plants using carbon or fuel," said Eran Gartner

Does that include the cost of building the plant? What are the running cost of a solar tower, and what is the expected lifespan vs a coal one?

<comment><USER5> Cost is typically LCOE - levelized cost - which takes life time, maintenance, fuel, construction, etc into consideration

This is quite a complex topic and you can google and wiki LCOE for all the gory details.

</comment></comment><comment><USER6> > "Everything is connected by WiFi instead of by cables. The tower and its > boiler are also designed to reduce costs. Everything is done to pursue > profitability."

Is WiFi really cheaper than running cables?

<comment><USER3> I was wondering the same. If Wifi meant no cables needed at all, I could see it (because of lower maintenance costs). But the electricity needed for Wifi and the motors in the mirrors requires cables anyway.

<comment><USER7> Photovoltaics and batteries are a possibility, electric cables are still cheaper than ethernet ones and when you have to wire such a large surface area those costs probably add up.

Wifi also allows technicians to connect to which ever devices that they are monitoring more easily and if they will have wifi for easy onsite access they might just as well pull everything over wifi.

It's quite common these days to pretty much run industrial monitoring over wifi it reduces quite a bit of costs as the technicians can just come with a smartphone or a tablet and connect to the web interface or use some dedicated diagnostic app it's much cheaper than sending them out with laptops and connecting directly or having them to use even more expensive dedicated diagnostic equipment.

</comment></comment></comment><comment><AUTHOR> Israel has also been a long-time user of solar water heaters. According to this article, about 1 million households for a population of 8 million use them.

[http://www.bloomberg.com/news/articles/2008-03-26/at-the- zen...](http://www.bloomberg.com/news/articles/2008-03-26/at-the-zenith-of- solar-energybusinessweek-business-news-stock-market-and-financial-advice)

<comment><USER7> AFAIK the building code requires all residential buildings to be built with solar power heaters, they are usually augmented by either an electrical heating element within the heater itself or by a secondary gas/fuel oil heater.

These heaters have been used since the 50's it's nothing more than a few pipes running through a sheet metal frame with a glass cover to force a greenhouse effect they are highly effective and extremely cheap to produce those panels cost near nothing and were implemented very early on when Israel had very little access to overseas fuel sources.

Israel didn't had access to regional oil until the the Iranian coup in 1953, it lost its access to Iranian oil in 1979 with the Iranian revolution, however the same year Israel and Egypt signed the camp david accords and Egypt started supplying Israel with Oil starting January of 1980.

Ironically the Iranian revolution quite likely had quite a positive effect on Israel as it quite likely pushed them to finalize the negotiations with Egypt and to sign an agreement as fast as possible in order regain some access to a regional oil source.

</comment></comment><comment><USER8> Classic typical misleading statistics in this article.

Energy is 1% of Israel's gross capacity plus this is solar so it only provides daytime loads which makes the economics worse.

Google's major investment in solar thermal has already gone bust. This is a small financial disaster. The economics of solar thermal are crap. Mirrors break or stop tracking well a lot in high winds of a dessert.

Any problems with a steam turbine atop a high tower are costly to fix.

<comment><USER9> The big advantage of this type of solar over photovoltaics is that they continue producing electricity after the sun sets, so can act as base load stations. Typically, the bigger the tower, the longer it can generate, hence the need for big projects and investments.

<comment><USER10> Do you think it would be reasonable for a hobbyist to build their own molten salt storage system nick?</comment></comment></comment>


Florida Standard Time: An Economical Nightmare – Medium Members - <AUTHOR> https://medium.com/@mcloide/florida-standard-time-an-economical-nightmare-ff627ea898b6 <comment><USER2> Florida UNIX Systems Administrator here. I will have a love/hate relationship with this law if it passes. Will cause all kinds of headaches for administration of our servers, which are spread throughout the world. None of the systems I admin are in Florida, but rules will nonetheless have to be updated on OSes and apps.

But hey, at least I won't have to change the clock on my stove :-/ Best to implement nationwide instead of piecemeal like this. Perhaps though the rest of the States will follow Florida's lead. That's where I'm hopeful.

I wonder if having the entire world on exactly the same time is a better option? No zones, no daylight savings. 12pm is 12pm in London, Singapore, and South Africa, year-round. It would be odd going to bed at 2pm but we'd get used to it.

I'd also suggest decimal time but that's been tried and failed. Probably universal time would, as well.

<comment><USER3> Wouldn't it just be a locale with TZ == GMT-4?

<comment><USER2> Right but it's all the system patching and configuration that must be done.

And I still carry an old Palm Pilot (Treo 700p). No idea how that's going to be kept current as it's not on any network. Maybe time to finally kick it, but more likely will just manually update the time twice a year :-)

Perhaps I can just put it on one of the Indiana municipal zones...</comment></comment></comment>


Ask HN: How to Become an Expert in Something? - non-entity A lot of incredibly intelligent people I look up to are experts in their respective field / domain. They have deep knowledge in a handful of related subjects, while still being relatively knowledgeable about other things, even more than I am at the things I do everyday. I understand that part of it is experience,but many of these people are quite young and I'm not exposed to the sort of problems that would allow me to gain deep knowledge of something and honestly dknt know where to find them half the time. It seems like many of these sort of problems require someone who is already expert. At the moment, I wouldn't even consider myself a good generalist. I have a good superficial knowledge of a large breadth of things and how they work, which is usually enough to satisfy my short term intellectual curiosity, but in practice could theres only a few where I'd be comfortable working with and none I'd be comfortable calling myself an expert in. <comment><AUTHOR> Sonny you haven't found yet The Force That Binds the Mind and Body</comment>


Wakemate commercial - <AUTHOR> http://www.youtube.com/watch?v=NhAEC2BLh5E <comment><USER2> Constructive critique:

Great video production quality/animations/etc. Fantastic (who did this?)

Voice talent...needs higher energy. Female perhaps?

Takeaways....

This product is intended to improve people's lives. In this ad, wakemate appears to keep people very marshmallow-looking.

I want to have an enough energy to hit the gym twice a day, not jiggle on a walk with a 30+ BMI.

Check out the FRS ads.

[http://bumpshack.com/wp-content/uploads/2009/05/nora- tobin-s...](http://bumpshack.com/wp-content/uploads/2009/05/nora-tobin-sexy- abs-photos.jpg)</comment>


Ask HN: How to deal with job search burnout? - <AUTHOR> I've had a very unsuccessful job search since graduation. Before it, way before I ever was concerned about getting something before graduation, I used to be excited about CS. I would read books, do tech, and many other things. When the job search came, I became depressed, and now finally burned out.
I've had several final interviews with unknown, non-tech companies, but never managed to snag an offer. I worked at a contract job (NodeJS) for 2 months. I keep reading online advice: work on projects and study interviewing problems. The thing is... no one has ever asked me any challenging tech questions in interviews, and no one has asked about my past projects.
My recent interviews:
1) Last week I got a referral from HN for a defense company. I'm waiting to see if they'll proceed to a 2nd interview.
2) Last month, I didn't make it past the 2nd interviewer for a QA role, because the interview thought I wasn't convincing enough to transition to QA from someone with developer experience.
3) Last month, I couldn't make it past a phone screen for a tech startup, because either the recruiter said I stated a too high salary (he didn't let me proceed until I said something): $80k - $90k in NYC, where Glassdoor states the average is $110k; or he got confused and thought I was fired from my 2-month contract (I wasn't; it ended on great terms).
So, I'm terribly burned out. What should I be doing in order to improve my life? CS has been my entire life -- from computer camps (Montclair University, Stevens Insitute, etc.) of playing Starcraft on LAN, to reverse engineering of programs, to weekly installs of Linux distros on high school weekends. I really don't know anything else, and would like rekindle the light. I obviously can't take a vacation. Maybe there's an interesting book or recommended exercise routine. <comment><USER2> Projects are useful because you can stick them on your CV, and because if they're interesting enough people will reach out to you, especially if you write a blog post about what you did. For best results pick a new up and coming tech or one your target companies are using, the ideas are low hanging and there's less competition. No-one will read the code or use your software, but as long as it sounds impressive and you can talk about the things you did and challenges you overcame, that will be enough.

Though that's really only going to be at tech companies, non-tech companies are usually looking to see that you can hit the ground running with their tech stack.

Also, contact people at hiring companies directly, find their email or message them on Twitter or get a trial of LinkedIn's premium plan that lets you message anyone. Look at angel.co. Talk to coworkers from where you contracted, if there are developers there and they liked your work they can help you, though I guess if it's contract work they may not have any more devs.

Also, I've found startups to be stingy unless they really need you, check out what people list on Angel.co, and consider the middle or bottom of those ranges given you're right out of school. A stingy job is better than no job in your position.

Sucks that your network isn't coming through, it would be really useful to find someone who can vouch for you, especially if you worked on projects together.

Consider using someone like Triple Byte or Hired or interviewing.io who will conduct a technical interview then recommend you to companies they work on based on how it went.

Don't give up and get discouraged, it can take a while.

</comment><comment><USER3> Stick with it and don't despair. The job search space is totally non-sense these days. Don't let the rejections bring you down—most recruiters don't know what they're doing.

What are your expectations? From my experience and that of friends around me, it can take a year if not two to find a job using the usual "apply with CV" approach. You should consider asking friends in your network for a "plug" in the company where they work.

Also, check this out in San Diego, really cool project: [https://learningequality.org/about/jobs/?gh_jid=524256](https://learningequality.org/about/jobs/?gh_jid=524256)

<comment><AUTHOR> I did make a post on LinkedIn. Only one person replied saying "hire him!" and I only know him because I previously reached out to him (his company is mainly security IT stuff). He did a presentation in my ACM club. All my "friends" (people with whom I worked on projects across multiple classes) and university network basically are not communicating with me. It's really disheartening, since I did help classmates with some things and was always positive.

I've also asked my neighbors (software dealing with Oracle), electrician, and friends of family. No one can provide anything concrete, besides stating "it's easy to find a job."

Honestly, it's more disheartening to learn you have no network when you thought you did.

</comment></comment><comment><USER4> Shocked to hear nobody asked about past projects, that's usually the core of the interview. What are they asking instead? If behavioral questions, are you practicing those?

And if they are not asking about algorithms, you're likely not interviewing at startups or major software companies. I know startups tend to go for experienced engineers, but you still have established s/w companies.

Short answer is to contribute to a popular open source project, that should raise eyebrows. I find meetups are also motivating. Finally, I have a developer career course (link in profile). Will help focus your efforts.

<comment><AUTHOR> I'll be honest. I can only remember one company actually asking me about my projects. They invited me on-site for a $15/hr position. Then randomly, out- of-the-blue prompted me to bring up my code, somehow, on their laptop. I obviously didn't have it, besides some poorly looking code hosted on Github.

"What are they asking instead?"

SAT score. Why did I choose my university, instead of going to a higher ranked one? Expected salary. Favorite programming language. Most commonly, how well I know the skills listed in the job description, what I'm interested in learning, and whether I'm more interested working with front end or back end. Tell me about yourself. I did once get actual STAR questions from Quicken Loans

An example of an interview (more like a phone screen) I had with Booz Allen Hamilton:

1) "Why did you leave your last job after 2 months?" (it was obviously a 2 month contract)

2) "Are you more interested in front or back end, or more full stack?"

3) "Will you be able to pass the background check?"

4) "Have you ever worked for the government?"

5) "How well do you know the referrer?"

6) "How did you find about this job?"

With an on-site at a software shop for a .NET role. Note: that they gave me a take-home project to do, then never discussed it:

1) "How well do you know this <skill>?"

2) "What do you read to learn about new stuff?"

3) "How do you know when to stop researching and instead actually do the coding?"

4) "Do you play video games?"

5) "Tell me about yourself."

With an on-site at a travel company -- that you probably haven't heard of -- for a VB.NET role:

It was simply a "tell me about yourself" to the CEO, and a couple of implementing some functions on paper, and writing some SQL. I aced the writing portion.

I've applied to startups, most of the time. They generally ask tech knowledge/trivia.</comment></comment>


Bloated - <AUTHOR> http://fabiensanglard.net/bloated/index.php <comment><USER2> You missed the part where the news website seems to have loaded but needs to further interrupt your reading by jumping up and down several times.

I'm not entirely sure but at least the habit of screen-shooting the viewport and uploading the whole thing seem to have gone out of fashion.

No amount of research seems to convince these people that a good percentage of users will close the page in disgust before it is loaded or that click though rates depend largely on how fast pages load.

Your website should have a link at the end of the article so that we can read more. Knowing that the page will load before we've forgotten what we were doing makes all the difference.</comment>


Ask HN: Do you think it is a good idea to invest in an Apple Computer? - <AUTHOR> I'm only interested in taking a look at the Swift programming language. And there is some articles saying that it will become Open Source later in this year. So I don't know if it is a good investment, Apple computers are expensive for my pocket. <comment><USER2> As a long time user, I find that the super amazing quality aspect of Apple products and software is slipping. iTunes gets worse and worse. Apple music looks anemic. The OSX interface was disappointing and the Apple watch totally underwhelmed me. I am a minority here but if I were to invest in Apple, it would because of it's driverless car development and the fact that Apple products would sync with it. That unto itself could possible "drive" them into becoming the first trillion-dollar company.

<comment><USER3> Kind of off topic, but iTunes is just the worst. Every time I use it I just become so angry.

<comment><USER4> Takes forever to open! :/ And no updates in UX for a long time now.

<comment><USER2> ...And the "Where's Waldo" interface updates challenges me every time to find my freaking music.

</comment></comment></comment></comment><comment><USER4> If you're making the decision just for the sake of Swift Programming. Don't. Not a great idea to spend a lot to shift to Mac for that reason alone. That being said, there are lots of other reasons why Mac works great.

I was a PC User for as long as I can remember. I used windows since Windows 95 and all the way up till Windows 7. I got a chance to buy a MacBook Bro when I joined college. And then it suddenly flashed how I wasted all my childhood with windows. Linux at least would've been better. The reason I say this similar to that of other people who made the transition.

The whole OSX ecosystem is very user friendly. The learning curve is shallow and once you get used to a Mac, you'll really start questioning how you did things on your PC before.

I'm both a designer and a developer. And my Mac gives me the best of both worlds. I can both develop freely with no worries on my mac with no terminal or bash problems(unlike the command prompt). Also, all the designer tools run very smooth on a Mac. There's a reason why all professional artists use Mac.

The popular saying goes "Once you go Mac, You never go back". You really don't.

The decision might seem hard with so much to cost on a product. One thing I can assure is that it's worth it. You can take the leap.:)

P.S. There are some shortcomings with the latest OSX releases, but I think Apple will fix all of them eventually making for a better user experience.

</comment><comment><USER5> If you do any development get a mac, I wish I'd switched sooner. I always had issues with Rails using a PC. Then I tried the same tutorials on a friend's macbook and they just worked saving tons of time. Virtual machines on windows had issues, just work on OSX, windows terminal meh. I can't imagine going back.

I use a 13" macbook air it has plenty of power/screen size for development so you don't have to go top of the line. (You can add an external monitor for less than $200, asus monitor $150, $10 thunderbolt to hdmi cable on Amazon). You can get a 13"MBair refurbished or on sale at best buy for $849 right now.

</comment><comment><USER6> I got my first MacBook Pro seven years ago, and I can't imagine going back to Linux or Windows again. The vast majority of people that I know (at work or otherwise) use Macs, and it's been this way for years.

</comment><comment><USER3> I grew up mostly with Windows with some Linux sprinkled in during college. I could never understand why people would pay so much for Apple computers. That being said I bought a Mac Book Pro for work about a year and a half ago and I love it. It is super fast and easy to use. I hate using my wife's Windows PC. I would recommend paying the money if you are looking for a nice laptop (or desktop I guess) to code on. But if you are just buying it to code in Swift I don't think it is worth it. I would just wait until it is open source.

</comment><comment><USER7> The Hacker News community alone adds a few percentage points to Apple's sales. If you ask here, the answer will be "yes" :).

</comment><comment><USER8> yes yes and yes. I just bought my macbook pro (first time mac user) and loving it.</comment>


Certificate Transparency: Public, verifiable, append-only logs - <AUTHOR> http://queue.acm.org/detail.cfm?id=2668154

<comment><USER2> I respect and admire agl, his and very important work on EC; but i must respectively disagree with his analysis of bitcoin and other blockchain based technologies.

This paper was written in 2011, and a lot has changed since then. Today, we have an infrastructure similar to what Certificate Transparency is said to produce -- without collusion or support from the CAs. Bitcoin and other blockchain based technologies have an economic incentive to continue to propagate. I fail to see why anyone other than the CA's would have an incentive for the Certificate Transparency blockchain to propagate.

I proposed an alternative model which i called 'UTXOC'. I wrote a paper and published some python scripts to generate certificates based on a prior bitcoin transaction. A certificate validity can be determined by some bitcoin- like value left unspent. If the value is spent, the cert if invalid. If the private key is compromised, the attacker has an economic advantage in 'cashing out' the value; thus invalidating the certificate. I propose that also adds to the cost of key substitution attacks on TLS; an active MiTM would need to spend at least as much cryptocurrency in order to successfully fake a certificate, even with a trusted root in the client.

It could go either way -- with CA support for such things, or a self-signed 'cryptocurrency bond' style model where TLS operators hold cryptocurrency in order to maintain the validity of their certs.

This is published here: [https://github.com/MiWCryptoCurrency/UTXOC](https://github.com/MiWCryptoCurrency/UTXOC)

Very interested to hear opinions on this, its a work in progress. Yes, support for secp256k1 is limited in mainstream OS's -- it only works with openssl s_client and s_server currently. Given time I hope that the secp256k1 curve is added to browsers and operating systems, and this or similar blockchain based record architectures are adopted.

thanks all ;-)

<comment><USER3> Minor correction: this article was written by Ben Laurie, not agl. (Same company though.) But you also mentioned 2011 so I'm not exactly sure what you are referring to.

<comment><USER4> doh! embarassed. your right, Ben Laurie. i recall agl speaking about this recently, thats the association. Appologies to Ben and Adam :-)

</comment></comment></comment><comment><USER4> Ok, so the date on this paper is 2014, but wasn't this proposed at least 2 years ago? I recall it being proposed as a countermeasure to the Iranian Google cert incident.

<comment><AUTHOR> Well, the project itself isn't new. But this article is (relatively) new, and since it was quite well written I thought it was worth submitting.

I'm not really knowledgable enough to assess the project's vitality but I found that the Github repo[1] is active, and the mailing list[2] is somewhat active as well. There is also a new RFC draft from 2014-07-10[3].

My conclusion is that since this project is backed by Google, it's currently the most viable attempt to improve on the suboptimal PKI infrastructure we have for TLS.

Ideally Firefox, Safari, Internet Explorer and Opera would add support as well. Firefox as least has an open feature request[4]. But these things take time, you know :)

[1] [https://github.com/google/certificate- transparency/commits/m...](https://github.com/google/certificate- transparency/commits/master)

[2] [https://groups.google.com/forum/#!forum/certificate- transpar...](https://groups.google.com/forum/#!forum/certificate-transparency)

[3] [https://tools.ietf.org/html/draft-ietf-trans- rfc6962-bis-04](https://tools.ietf.org/html/draft-ietf-trans-rfc6962-bis-04)

[4] [https://bugzilla.mozilla.org/show_bug.cgi?id=944175](https://bugzilla.mozilla.org/show_bug.cgi?id=944175)</comment></comment>


Baffled by Microsoft Developer Support - <AUTHOR> http://www.irrlicht3d.org/pivot/entry.php?id=1452

<comment><USER2> I needed Microsoft some times now, i always had a reply. Although i prefer to check the forums first.

B2B is important for microsoft, so replying to emails also ;)</comment>


Show HN: Rqlite v4.0 – With node-to-node encryption - <AUTHOR> https://github.com/rqlite/rqlite/releases/tag/v4.0.0 <comment><USER2> Not to be confused with ActorDB, a distributed SQLite-based database for highly-sharded data. These two systems are similar in that they are both new SQL systems on top of SQLite, but they seem to differ greatly in use-case

[https://github.com/biokoda/actordb](https://github.com/biokoda/actordb)

<comment><USER3> Does actordb subsume the functionality of rqlite?

As in, can I tell actordb 'replicate this actor to all nodes' and then will it basically be the same as rqlite, but with page level replication?

</comment></comment><comment><USER4> Honest question: why would I want a distributed scale-out RDBMS based on SQLite when there are others based on more performant server-based solutions (see Citus for PostgreSQL, Galera for MySQL, etc)

My understanding/recollection of SQLite is that it has significant performance issues with high concurrency. Great for a database on a pocket device, not the best choice for a horizontal scale-out high-concurrency system. At what point do I need horizontal scalability, but not care about concurrency on any one node?

Again, honest question - I'm not doubting the project or its value, I just don't get it.

<comment><USER5> I think you're misunderstanding the goals of the project. It's not to create a horizontally scalable DB. Write perflrmance will not scale horizontally at all with this database.

The goal is to create something more like an etcd that can hold structured data.

<comment><AUTHOR> Exactly.

</comment></comment></comment><comment><USER6> Congrats on the release! A bit unrelated, but the README says Windows is an officially supported platform, and I've seen this be the case on many Go projects. I know very little about the Windows platform, can you comment on how painless supporting Windows is _really_ with Go? Do you have e.g. CI runs on Windows? With most of the compiled stuff I worked on Windows was mostly an afterthought and always yes-it-should-run-but. Can I trust Go to spit out binaries that work, or do I have to avoid certain stdlib features? What about e.g. fork?

<comment><USER7> _I know very little about the Windows platform_

As someone who started in the 90ies this makes me smile.

Year of the linux desktop or not: something has changed. (Quite aware that the bauerd might be using something else.)

<comment><USER8> He could be a Mac user for all we know.

<comment><USER7> Yes, I tried to mention that.

My point is the Windows monopoly is almost broken and I think everyone including Windows users benefit from that.

<comment><USER9> > the Windows monopoly is almost broken

Oh, how I wish that were true.

In some areas, yes, but there so many line-of-business applications that are only available for Windows that even if Microsoft stopped developing Windows, people would continue to use it for a very long time.

I am not at all a fan of Steven Ballmer, but he got it right - if you get the developers to flock to your platform, you win. Microsoft did that in the desktop space, Apple did it in the mobile space.

<comment><USER7> >> the Windows monopoly is almost broken

> Oh, how I wish that were true.

Windows lost mobile. They lost pads. More people than ever are using Macs. More people than ever are using Linux and various nixes. Linux, Macs and other nixes are considered cooler than Windows.

Windows lost servers, although Microsoft seems to have won a good chunk of developer mindshare with Azure - running mostly (AFAIK) Linux.

Yes, a lot of legacy systems still use Windows but it seems less and less _need_ Windows every year.

Except from Manic time and Microsoft Office I cannot think of any software that I personally would need Windows for at the moment.

Netbeans and Maven run better in Neon. Same goes for Node and a lot of other software I care about AFAIK.

Even CSGO seems to work better on Linux for weeks (until next bad update, I think last waa when sound was messed up probably back in March.)

</comment></comment></comment></comment></comment></comment><comment><USER10> Is there a way to create an index without blocking other connections trying to insert/update/select?

<comment><AUTHOR> rqlite has the same limitations as SQLite in this regard.

<comment><USER10> Thanks.

</comment></comment></comment><comment><USER11> Looks interesting. I assume this inherits the write lock limitations from SQLite?

<comment><AUTHOR> Yes it does.

</comment></comment><comment><USER12> Can this be used as a "drop-in" replacement for sqlite or do I have to modify my application for it?

<comment><USER13> For Python at least, there's a "normal" driver that is pretty much a drop-in. Am curious as to how it will work in practice myself, since I usually rely on an ORM these days.

<comment><AUTHOR> You can find various client libraries here: [https://github.com/rqlite](https://github.com/rqlite)</comment></comment></comment>


Deduplicating Decklists - <AUTHOR> http://justinjaffray.com/deduplicating-decklists/ <comment><USER2> I can't unsee the intro paragraph:

"This is not going to be my normal kind of post, it's not very focused, and going to be a bit rambley, as I talk about a problem I thought about one day."

The reader's attention is precious, particularly today, and I think it's rude to say something like this. I'm calling it out because it is something easy to fix.

<comment><AUTHOR> Then don't read it.</comment></comment>