Inside the Secret Dating App for Famous People - <AUTHOR> http://nymag.com/thecut/2015/08/are-you-ready-for-illuminati-tinder.html

<comment><USER2> I find this a bit sad on so many levels. But mostly I find is sad because "Instagram followers" seems like a singlularly non-helpful metric for finding dates. My guess is that it would self select for shallowness.

A friend of mine from USC back in the day was a photographer and sought out and often dated people he had photographed that he thought were "hot" and that never really worked out. I asked him if it occurred to him that basing your selection criteria on "hotness" would lead to anything meaningful. Answer, "no." His defense was that if he did find the love of his life in the pool of really attractive people, that would be awesome.

<comment><USER3> Sometimes I wonder if shallow people are actually happier than 'deep' people, and if so, is it worth it?

<comment><USER2> It is a reasonable question, which if I understand your comment correctly is "Is having a deeply connected relationship with your current date over rated?"

The less charitable interpretation would be that shallow people are happier because they don't have the capacity understand what they are missing in a 'deep' relationship. I don't think that particular question variant would have much merit, if you are actually happy I think that is sufficient whether or not you met some external definition of depth.</comment></comment></comment>


Ask HN: Where is the February Job Thread? - <AUTHOR>

I need to find job thread besides the Y Combinator job postings. Front end developer here looking for an exciting opportunity <comment><USER2> [http://www.google.com/search?sourceid=chrome&ie=UTF-8...](http://www.google.com/search?sourceid=chrome&ie=UTF-8&q=%22whos+hiring%22+february+site:ycombinator.com)

</comment><comment><USER3> <http://news.ycombinator.com/item?id=216136O></comment>


Mambler cheat sheet (twitter clone, tumblelog small command language) - <AUTHOR> http://bumi.wordpress.com/2007/04/14/mambler-cheat-sheet/ <comment><AUTHOR> Found this (In German) from the ' _Twitter Clones everywhere_ ' ~ <http://news.ycombinator.com/comments?id=26976>

It looks like Mambler ( <http://mambler.de> ) are trying to create a small functional language to interact with the service. Looks similiar to twitters lingo (command set) ~ [http://help.twitter.com/index.php?pg=kb.page&id;=10](http://help.twitter.com/index.php?pg=kb.page&id=10)</comment>


What's in Your iOS Image Cache? - <AUTHOR> http://blogs.sans.org/appsecstreetfighter/2011/01/14/whats-in-your-ios-image-cache-backgrounding-snapshot/?utm_source=rss&utm_medium=rss&utm_campaign=whats-in-your-ios-image-cache-backgrounding-snapshot

<comment><USER2> I should also post this to stackoverflow, but I'm wondering if anyone knows if and how inline images are cached in web pages on iOS. I'm interested in particular how a UIWebView would behave with code like:

        <img src="data:image/gif;base64,R0lGODlhEAAOALMAAOazToeHh0tLSyH5BAAAAAAALAAAAAAQAA4AAARe8L1Ekyky67QZ1hLnjM5UUde0ECwLJoExKcppV0aCcGCmTIHEIUEqjgaORCMxIC6e0CcguWw6aFjsVMkkIr7g77ZKPJjPZqIyd7sJAgVGoEGv2xsBxqNgYPjgAwXEQA7"
        alt="embedded image">

Is this known to be cached somewhere else on the device?

EDIT: I suppose I could use find on the simulator's directories and look for a file with the right MD5 hash.

<comment><USER3> I am reasonably confident that such an image is "cached" by being part of an HTML document that itself was cached. I mean, the URL for the thing is the content: one would seriously hope that there isn't a URL->data cache somewhere holding that image ;P.

<comment><USER4> 1\. The decoded Base64 data is smaller (three quarters of the size?) than the encoded data.

2\. Keeping only the encoded data would mean having to decode it every time the image gets redisplayed.

Ideally, one would remove the Base64 coded data from the document, and cache the binary data.

<comment> mike-cardwell And when the page is loaded again, how would the browser know that the base64 encoded data in the page matches the binary data that has been cached?

<comment><USER4> Good question. I would guess that it would just decode it again when it reloads the page. That shouldnt happen often, if people set the page's time- to-live correctly. If they don't, you have to reparse the page anyways, as any content could have changed.

When redisplaying a page without reloading, the browser should just use the parsed page.

</comment></comment></comment></comment></comment><comment><USER5> Anybody know the Frank Kim who wrote the article? I tried to contact him to say that his captcha always says "invalid" but he doesn't have any contact info on there that I could find...</comment>


My Airbnb guests threw a New Year party for 300 people - <AUTHOR> https://www.theguardian.com/lifeandstyle/2018/dec/28/experience-my-airbnb-guests-threw-a-party-for-300-people <comment><USER2> I've rented a room through Airbnb for about six months now and had no problems. However, it's a room in one side of our house, where we also live and come and go.

We make quite a bit of money off of it and don't really worry about guests doing things we don't want since we're physically there most of the time.

I wouldn't Airbnb an entire house without remote cameras to keep an eye on things though.

<comment><USER3> So, when you go on a vacation, do you expect cameras in your hotel room's bedroom/toilet for staff to "keep an eye on things"?

<comment><USER2> No but certainly outside the door in the hallway, where a hotel staff would have free access anyway.

</comment></comment></comment><comment><USER4> I'm honestly still shocked that Airbnb successfully normalized letting strangers sleep and have sex in your bed.

</comment><comment><USER5> _Boys were charged to enter_

Ah, a young entrepreneur hacking the nightclub business, renting furnished space by the day and ignoring all the other rules and regulations too.

<comment><USER6> Isn't that "disruption"?

<comment><USER5> You're right, it doesn't need any skills - just a willingness to break rules. Disrupting rather than hacking!

</comment></comment></comment><comment><USER7> The homeowner loses, Airbnb loses, and what about perpetrator? He gets off scot free?

</comment><comment><USER8> The story doesn't mention if the protagonist (I won't say "victim") declared and paid taxes on his side income. If not it was a bit cheeky to call the police!

</comment><comment><USER9> Yeah see, this is why I would never ever rent a room or property out via Aribnb and similar wildcards are why I would never drive strangers around.

>the glass panel on my staircase

Wait, what?

> two couples with infants had stayed and I spent three hours with a cleaning > crew

That seems excessive if not odd.

>Airbnb didn't get back to me. After three days I decided to call the local press and share the videos we'd found to try to get the company's attention

So he waited until what, Wednesday January 3rd when presumably employees were likely still off from the holiday and dealing with a backlog to go running to the press? Ugh, I hate that we've created a society that waits hours, or days at best, to go running to press/social media to try and cause a disturbance instead of realizing "oh hey, it's a holiday and they probably have staff off and a backlog" in this instance or when a 'celebrity' has a 'problem' and takes to twitter like with Kevin Smith and 'too fat to fly'.

<comment><USER10> >So he waited until what, Wednesday January 3rd...

Yeah, three days. He was ignored for 3 days after a mob destroyed his house, and was only listened to after he went to the press.

But, no, the tech giant is the victim here! How dare he even think about inconveniencing the multi-billion dollar corporation during its time-off! /s

<comment><USER9> >and was only listened to after he went to the press.

Or more realistically, when employees returned to the office.</comment></comment></comment>


Sunlight Labs' Android/iPhone Door Opener Details and Video - <AUTHOR> http://sunlightlabs.com/blog/2010/more-about-door/

<comment><USER2> Awesome! What was the url to that public-facing API again?</comment>


Everything Movies, Shows and Music - <AUTHOR> http://activify.org <comment><AUTHOR> Founder here.

I use to have a frustrating experience searching for and organizing movies, shows and music. I had tried using excel sheets to keep track of the movies and shows that I'd like to watch but ended up spending too much time looking for ratings and trailers. So, I decided to build a platform that can aggregate all this information and allow me to keep all this data well managed.

Please let me know if you have any suggestions.</comment>


Nielsen: Android passes iPhone as most desired smartphone in U.S.  - <AUTHOR> http://www.fiercemobilecontent.com/story/nielsen-android-passes-iphone-most-desired-smartphone-us/2011-04-26 <comment><USER3> Inaccurate headline and interpretation, if you ask me. One cannot simply equate "desired" and "targeted for next purchase." Simple reductio: The car I desire most is rarely the one I plan on purchasing, unfortunately.

There may be other factors at play (such as price and availability) that have little to do with Android being more attractive than iOS. Just to clarify, I'm not saying that iOS is in fact more desired, let alone more _desirable_. But the data as presented in the article doesn't support the conclusion as stated.

<comment><USER4> Depends on what you mean by desire. If you count a desire as being the thing you want after all variables (including price) are factored in, then you don't really desire it if you don't purchase it.

Yes, one has desires when considered in abstraction from certain variables - and often people report desire based upon these abstractions. But it goes back to the old adage - believe not in what they say, but what they do.

<comment><USER3>
      > believe not in what they say, but what they do.

      > you don't really desire it if you don't purchase it.

Good point, yes. But I still think the headline gives it a slightly misguided spin -- i.e., "now people don't just _buy_ more Android devices, they also desire them more."

</comment></comment></comment><comment><USER5> The question, then, is how many mobile Operating Systems the market will support.

Apple aren't going anywhere, but they seem likely to maintain the same niche they have on the desktop - premium phones.

Android will be in the Windows slot - mass market.

Blackberry are unlikely to go anywhere soon, but once businesses make their email available on Android or iPhone, then I'm not sure if there's a unique selling point for them.

And Windows Mobile? I'm not sure that there's a space for them at all. Certainly, if MS weren't pushing it I don't think it would have survived even this long.

<comment><USER6> I don't think the difference will be quite as dramatic though. Apple has been outgrowing PC sales with their premium products for many quarters now I believe. They even managed this during a deep recession in most of the world. That suggests to me there's a pretty big market for premium devices. Bigger than the current 90/10 Windows/Mac market share would suggest on the surface. Historically Apple did as much, if not more, damage to themselves than Microsoft did to get themselves into a marketshare hole. With a fresh start in SmartPhones I would expect to see them maintain a much larger niche this time around.

</comment></comment><comment><USER7> Given the growth reported recently, it's not that surprising that Android is now more popular than iOS, but what a ridiculous headline: Android is an OS not _a smartphone_, let alone the "most desired smartphone in the U.S."

What is the most popular Android smartphone? How many units has it sold in comparison to the iPhone? Is it a mid-range or a high-end phone? Now those are interesting questions.

<comment><USER8> Exactly my thoughts! How is Android compared to iPhone as a single smartphone?

<comment><USER9> My first guess: because that's how every single person who gives a shit - ranging from pundits to corporations to fanboys of every conviction - <USER2> framed it ever since Android first came onto the scene.

</comment></comment></comment><comment><USER10> This thread is titled slightly better: <http://news.ycombinator.com/item?id=2487421> \- but really the news channels should be referring to this as: Android now the most desired operating system for smart phones.

</comment><comment><USER11> Every other week an article pops up saying that one is somehow better than other and mostly they claim opposing ideas. Obviously the two platforms are competing head to head so can we just move on away from this issue until a real gap between the two is formed?</comment>


Study finds bad bosses could turn you into a great boss - <AUTHOR> https://www.eurekalert.org/pub_releases/2018-12/uocf-sfb120318.php <comment><AUTHOR> Personally I have learned most of the stuff I want to do as a boss from experiencing them first hand from the great bosses I had. But missing these things while working with a mediocre boss, just emphasized how good these things felt for me. E.g. a 30 minute regularly scheduled weekly/bi-weekly 1:1 in a private environment is something I found great and really missed when non longer having it.</comment>


An alternative for Wikipedia founder, Jimmy Wales - <AUTHOR> Every year, we are subjected to the "personal appeal" for funding from Wikipedia founder Jimmy Wales to keep Wikipedia alive.
This year he once again reminds us that Wikipedia is not a commercial website, and that it is community run. He then asks us to make a donation so that every person in the planet has free access to the sum of all human knowledge.
I think there is a better way to do it, because:
i) Altruism is good, but true altruists are few. The majority would want some sort of tangible payback for their altruism. Read "super freakanomics" for more information on this. (Note: The content contributors themselves have a tangible sentence or paragraph to point to, along with some influence.)
I suggest a publicly displayable donor badge system. More specifically, a badge that people can put on their blogs/websites etc that links to their wikipedia donor page, that, for a donor named "Agent Smith", would say "Agent Smith donated $100 to Wikipedia. Thank you Agent Smith." These pages should be open to search engine indexing so that when someone Googles "Agent Smith" the world knows he supports wikipedia.
ii) The charity concept does not work for  some (in my case, my charity dollars for the year have already been committed, so in principle i will not do any more except for emergencies.)
Wikipedia is a great service. Sure, it is user contributed, but everyone understands that the servers and supporting infrastructure costs money. We are at the end of the day a capitalist society. There are some of us who live by the motto "please don't do me any favours. I'd rather pay for it, than do charity or leech off it for free.".
I suggest calling it a annual membership fee, for these people. Think of something to throw in for the sake of it ("email support?", "priority bandwidth?"), not that it matters.
You could stop badges/membership once the target collections are reached. <comment><USER2> Jimmy Wales is not appealing to altruism. As a practitioner of Ayn Rand's philosophy of Objectivism [1], he would hold that altruism--the doctrine that one has a duty to sacrifice oneself for the "good" of others--is evil [2].

He's asking you to give money because you value Wikipedia, you want to see it continue, and you genuinely want to show appreciation for it--that is, for selfish reasons. Those things are more important than wanting a "donor badge" or something else to show off.

[1] <http://en.wikipedia.org/wiki/Jimmy_Wales>

[2] <http://en.wikipedia.org/wiki/Objectivism_(Ayn_Rand)>

</comment><comment><USER3> You may get flagged for posting rather than blogging & linking, per the submission guidelines.

But I like your idea and think it adds value.</comment>


Atom 1.33 - <AUTHOR> https://blog.atom.io/2018/11/28/atom-1-33.html <comment><USER2> I use Atom daily for work, and I am overall satisfied with the editor and its ecosystem, in particular the mammoth improvements the core team has made toward addressing speed issues that plagued the editor in prior years. I haven't tried the new GitHub integration features in this package, but they seem cool.

That having been said - Atom devs, if you're reading this, _please_ put a priority on fixing the auto-update / 'Restart and Install' feature on macOS.[1] If it's not fixable, please remove the option and offer a workaround.

It's gotten to the point where I now simply download the Atom update in browser and manually replace the package binary in my Applications folder, knowing the auto-update will fail.

[1] [https://github.com/atom/atom/issues/2860](https://github.com/atom/atom/issues/2860)

<comment><USER3>
       $ brew cask reinstall atom

       ...

       atom was successfully installed!

</comment></comment><comment><USER4> I'll admit that I haven't used Atom in a very long time, but to be it just seems like a worse version of VS Code.

I don't think I've ever introduced an Atom user to VS Code and they stick with Atom. Every one of them switches.

<comment><USER5> vscode gives me the impression of a shitty microsoft product.

<comment><USER6> Have you actually used it? I'm by no means pro-microsoft but vscode is a joy to use.

</comment></comment></comment><comment><USER7> I really love Atom over any editor I've ever used in the past, but damn it can be slow, so I hope this update addresses some of that. I mostly use it for writing code because of the extremely intuitive editing features, advanced regex, and beautiful syntax highlighting. However it can't handle really large files like logs and such because it tries to prase everything and consumes tons of memory. For that nothing seems to beat Notepad++ on Windows (written in C!). One thing to remember is that Arom is an Electron app and as such is essentially a browser application, which sadly could never be as fast as a native app.

<comment><USER8> Notepad++ is written in C++.

[https://github.com/notepad-plus-plus/notepad-plus- plus](https://github.com/notepad-plus-plus/notepad-plus-plus)

</comment></comment><comment><USER9> Is Atom developed by microsoft now? It would be weird for them to invest in developing both editors in the long run, considering how much crossover the two have.

Is the contributor community strong enough that it would keep going strong regardless? I'm not sure how many contributors were from Github vs elsewhere

<comment><USER10> In his Reddit AMA, the new GitHub CEO said he wanted to keep working on both going forward. [https://www.reddit.com/r/AMA/comments/8pc8mf/comment/e0a235q](https://www.reddit.com/r/AMA/comments/8pc8mf/comment/e0a235q)

</comment></comment><comment><USER11> I haven't used Atom for more than a year. Is the performance better now? Faster than VS Code? Would it still crash if I accidentally opened a 100mb CSV file?

</comment><comment><USER12> Anyone know what light ui/theme they are using in the demo/screenshots here? Is it simply the packaged atom light theme? It looks beautiful.

<comment><USER13> At the risk of heresy, I agree. It looks really clean and appealing.

</comment></comment><comment><USER14> I wish they could get Ruby working in Atom out of the box. I still can't believe how weak the tooling is in the Ruby on Rails world. Even Jetbrains fails miserably. Why on earth can't we have decent code completion in Ruby?! If the human brain can tell what will be available why can't my computer.

<comment><USER15> I don't think even the human brain can consistently figure out what's going to be available in Ruby.

Oftentimes, the only way to know is to set a breakpoint, run the code, and inspect it at runtime. This is why the tooling sucks even more for Ruby than most dynamic languages, and the code completion and static analysis will almost certainly always be worse than the equivalent tooling in a statically typed language where more things are knowable.

If you feel so strongly about tooling, I recommend learning Kotlin, Go, or C#, all of which offer incredibly strong tooling with essentially perfect code completion, jump to definition, and real time code analysis.

<comment><USER14> I once did a web-project in Go just for the tooling. What I gained there was lost in the verbosity and the write everything from scratch mentality when it comes to webdev in Go.

</comment></comment></comment><comment><USER16> I would expect that with the new TreeSitter parser (and other improvements) Atom now feels faster than VS Code. Is that the case?

</comment><comment><USER17> Does Atom work with mounted directories yet? Especially sshfs? I'd love to go back to Atom, but unfortunately, last time I tried to use it, it had massive indexing problems when working through mounts.

</comment><comment> Avi-D-coder How does performance compare with VS code? How does Vim mode compare?

<comment><USER18> The vim plugins in atom completely blow VSCode's out of the water. It's split up into two packages ('vim-mode-plus' for most of vim, and 'ex-mode' for handling ex commands), but they work together very well.

In my experience (which certainly does not reflect everyone's), Atom wins in performance these days, too. Startup time is a bit slower, but once it's running it's quite snappy. It feels... less like a webapp than VSC does, if that makes sense.

</comment></comment><comment><USER19> I like the flexibility and customization of Atom but god damn they need to get off the RAM-hogging process that is Electron...

<comment><USER20> People complained about Emacs memory usage for decades. Then one day 8 MB wasn't a lot of memory.

Everyone knows Atom uses a lot of memory. At some point in the very near future, it will no longer be important.

My five-year-old Mac has 16 gigs of RAM. I won't buy another that has less than 32 gigs.

<comment><USER21> > Everyone knows Atom uses a lot of memory. At some point in the very near > future, it will no longer be important. My five-year-old Mac has 16 gigs of > RAM. I won't buy another that has less than 32 gigs.

As a counterpoint, my 3 year old laptop has 8GBs if memory, my server 12gb and none of them are maxed.

My next unit won't have more than 16gbs, because that would be an absolute waste.

Maybe use less Chrome and Chromium/Electron based shit, and you'll find out how _insanely much ram_ 8GBs actually is?

<comment><USER22> Is it a waste if it's getting used?

I know this argument tends to become a bit philosophical, but if (ab)using memory the way that browsers or Electron does means that programs can be written faster, be safer, and can run on more platforms, then is it really being wasted?

Sure, it's not _runtime efficient_ in many cases, but that's not the only thing that matters, and it's pretty far from the top priority for many.

I quite frankly make a ludicrous amount of money doing software development. Spending even $1000 on an upgrade to my machine that makes me 1% more productive would end up paying for itself in less than a year.

For me, RAM isn't something I worry about, I have 32GB in this system and i'm not anywhere near maxing it out at my current day job (and for what it's worth, my atom instance that i've had open for about 3 days now is taking up a combined 432mb of memory at this moment, Android Studio is sucking down a whopping 1.5 GB. In my experience the "ram usage" of Electron is blown wildly out of proportion, it's really not that bad to be honest). Atom makes me more productive, so I use Atom, and the memory usage could greatly increase and it wouldn't impact me at all.

Some people work differently, they either aren't as fortunate as I am and can't afford the fancy hardware (or can afford it but simply don't want to buy it, which is okay!), or just prefer working in an environment which starts up faster or uses less resources, or anything else. For them there are other editors, other IDEs, other software they can use.

None of them are objectively "bad" or wrong, they just prioritise different things.</comment></comment></comment></comment>


iTunes Connect Not Processing Uploaded iOS Apps - <AUTHOR> https://twitter.com/hashtag/itunesconnect?f=tweets&vertical=default&lang=en <comment><AUTHOR> Our builds have been stuck for over 24 hours. Can't submit to the app store, can't beta test internally via TestFlight. Anyone know what's going on?</comment>


Upload your 3D model and share it instantly directly rendered in browser. - <AUTHOR> http://p3d.in/

<comment><USER2> Cartoon rendering is so lovely: [http://p3d.in/8hYor](http://p3d.in/8hYor)

</comment><comment><USER2> The editor is amazing. All of this is web based, including the editor?

<comment><AUTHOR> Yes! We're using this extensively on Smitecamp.com</comment></comment>


4 Years of OLPC - Much More Than A Computer - Awesome Video - <AUTHOR> http://www.youtube.com/watch?v=KNpA2U47M6U

<comment><USER2> I can't imagine a more fulfilling place to work then the OLPC foundation. Its a shame they aren't hiring.</comment>


Recursion? We don't need no stinking recursion - <AUTHOR> http://raganwald.com/2018/05/20/we-dont-need-no-stinking-recursion.html <comment><USER2> Multirec is an example of a refold. They are surprisingly common in real problems you encounter. The Haskell equivalent is hylo. [https://www.stackage.org/haddock/lts-11.10/recursion- schemes...](https://www.stackage.org/haddock/lts-11.10/recursion- schemes-5.0.2/Data-Functor-Foldable.html#v:hylo)

</comment><comment><USER3> Something which is perhaps overlooked in JS is that there is a recursion depth built into many engines. Using pure iteration circumvents this making the engine hang instead of error if your algorithm would loop infinitely.</comment>


Rails XML Parsing Vulnerability affecting JRuby users - <AUTHOR> https://groups.google.com/forum/?fromgroups=#!topic/rubyonrails-security/KZwsQbYsOiI

<comment><USER2> Three vulnerabilities announced at the same time...

* [CVE-2013-1855] XSS vulnerability in sanitize_css in Action Pack [1]

* [CVE-2013-1856] XML Parsing Vulnerability affecting JRuby users [2]

* [CVE-2013-1857] XSS Vulnerability in the `sanitize` helper of Ruby on Rails [3]

Two of these affect all Rails versions, not just JRuby, so are more serious.

[1] [https://groups.google.com/forum/?fromgroups=#!topic/rubyonra...](https://groups.google.com/forum/?fromgroups=#!topic/rubyonrails- security/4_QHo4BqnN8)

[2] [https://groups.google.com/forum/?fromgroups=#!topic/rubyonra...](https://groups.google.com/forum/?fromgroups=#!topic/rubyonrails- security/KZwsQbYsOiI)

[3] [https://groups.google.com/forum/?fromgroups=#!topic/rubyonra...](https://groups.google.com/forum/?fromgroups=#!topic/rubyonrails- security/zAAU7vGTPvI)

<comment><AUTHOR> I was gonna post 'em all, but my second one got auto-dead'd. Probably tripped the spam filter.

<comment><USER3> Is it possible to update the title of this post to remove the "affecting JRuby users" portion? The current title will give non-JRuby users a false sense of security.

<comment><AUTHOR> This vulnerability is only applicable to JRuby users who use the JDOM parser. JDOM is not usable on non-JRuby platforms.

<comment><USER3> CVE-2013-1855 & CVE-2013-1857 are applicable to _ALL_ Ruby users, not just JRuby.

<comment><AUTHOR> Oh, I read you now. Since the link goes to just the JRuby-related announcement, I'm going to leave it in place for now, but please go ahead and submit the other two (especially the sanitize() one) - the spam filter seems to be upset at me. :)

</comment></comment></comment></comment></comment></comment><comment><USER4> From the provided patch: the HTML sanitizer vulnerability appears to be a bug separate from the past YAML deserialization security problems (and somewhat less severe).

The sole change seems to be in the regex that was used to match the protocol separator (i.e. the colon). The change is from this:

          /:|(&#0*58)|(&#x70)|(%|%)3A/

to this:

          /:|(&#0*58)|(&#x70)|(&#x0*3a)|(%|%)3A/i

Presumably the previous regex allowed an attacker to insert a variation of "javascript:foo()" and get past a HTML sanitize call.

</comment><comment><USER5> So this seems similar to the mess Rails had recently, which is kind of surprising because one would think it would prompt people to take a suspicious glance at their own XML parsing bits sooner rather than later.

</comment><comment><USER6> Rails and security. Again. Sigh.

<comment><USER7> If you're going to work in software, you had better get used to it. The difference between software with a CVE rap sheet and software without is that _you know_ about the vulns in the software with the CVE rap sheet.

<comment> lhc- You know about some of them, anyway.

<comment><USER7> Fair point. The larger picture is that while the number of CVEs certainly matters, what matters most is that the maintainers of the software maintain a record of quick turn around on patches and a welcoming attitude toward security researchers.

IMO, Rails has done a better job of this recently, and that makes me really happy.</comment></comment></comment></comment>


Facebook announces SLA to fix all major bugs within 48 hours - <AUTHOR> http://thenextweb.com/facebook/2014/04/30/facebook-announces-two-year-stability-guarantee-core-apis-sla-fix-major-bugs-within-48-hours/?utm_source=t.co&awesm=tnw.to_g4qfk&utm_medium=referral&utm_campaign=Spreadus <comment><USER2> In related news, Facebook announces a new definition of the word 'major' :-)

Ok, that is a bit snarky. I think it is a great policy for organizations to commit to this level of response. The tension is that to execute against that policy requires a proportionate number of employees on 'bug fixing' rather than 'feature delivery'. Source bases grow, technical debt increases, and at some point you can't afford to hire any feature delivery engineers, all of them have to be on 'bug fixing.' Then the policy collapses. At the time I was there, Google tried to address this eventuality with 'fix it' days where everyone fixed bugs (big or small) all day. They would have prizes for the person who fixed the most bugs (you could really irritate someone by fixing a half dozen really easy bugs on the day before the fix-it :-))

When you're growing a company and you push/reward "Get things done" or "Move fast and break things." it often accumulates technical debt faster than you can purge it out of your system.

</comment><comment><USER3> Do they define "major bugs" though? And who holds them accountable and what happens if they don't achieve this SLA?</comment>


What do 16,000 people do at Google? - <AUTHOR> http://www.news.com/8301-10784_3-9800095-7.html <comment><USER2> Who wants to bet that the "copyright content filtering" tech is just done by Peter Norvig in his 20% free time.

Give me a break!

</comment><comment><USER3> The most important thing they do: not work for the competition.

<comment><USER4> If they can keep finding more and more people that pass their insane hiring process, they will do well to keep hiring them.

<comment><USER5> My experience was that Google's hiring process isn't insane at all -- if you're going to hire someone for a technical job, it's crazy to not have phone interview(s) followed up by a day of on-site interviews, both full of technical questions.

My experience was broken in other ways -- my recruiter changed her mind about which job I was applying for three times without consulting me -- but (being assured by Googlers that the problems I encountered were rather unusual) I can't find any fault in the process.

<comment><USER4> Perhaps insane as in "insanely selective." 1500+ SAT Score and a 4.0 high school and college GPA are very important. Then, I think there are 7 or 8 levels of veto you need to get through. At the end, everyone they hire is truly, certifiably smart any way you measure it.

<comment><USER6> ...in engineering. They don't apply the same standards in other groups.

<comment><USER4> Yes.. any idea what percentage of their new hires were engineers?

</comment></comment></comment></comment></comment></comment><comment><USER7> With the way they generate revenue, I imagine about 12,000 are now doing SOX compliance.</comment>


Robula+: an algorithm to generate robust XPath-based locators - <AUTHOR> https://github.com/cyluxx/robula-plus <comment><USER2> This looks like it might come in handy.

I started working with Web-scraping roughly around '95 (initially for a personalized newspaper metaphor for Web software agent reporting), and wrote HtmlChewer, an HTML parser in Java designed for that purpose. A while later, I moved my rapid R&D work to Scheme, where I wrote the `htmlprag` permissive parser, now known as the `html-parsing` package in Racket and other Scheme dialects.

By the time I was using Scheme, my scraping usually ended up starting with XPath, to get a starting point subtree of the DOM, then used a mix of arbitrary code and sometimes a proprietary pattern-based destructuring DSL, to extract info from the subtree. And sometimes filtering/transformation algorithms across a big free-form-ish text subtree (e.g., for simplifying the articles of a site a custom crawler scraped, for building a labeled corpus for an ML research project).

Of course we've always had resilience problems for Web scraping, even as the Web changed dramatically.

In general, my scraping methods usually ends up hand-crafted (and this was starting before in-browser development tools with element pickers and DOM editors), and much of the guesswork/art of it was in coming up with queries and transforms that seemed like they might keep working the next time the site changed its HTML. In 2004 I did make a small tool to automate a "starting point" for hand-crafting such an XPath query: [https://www.neilvandyke.org/racket/webscraperhelper/](https://www.neilvandyke.org/racket/webscraperhelper/)

<comment><USER3> > In general, my scraping methods usually ends up hand-crafted

I've tried many of these xpath generators and even built few myself. There's still nothing that matches human built ones. Best selectors and most stable selectors are context aware. For example to get a comment text a human would build a css selector: `.article .comments-box .comment p::text` and there's no way without AI's involvement or some big-sample training for the generator to know this object relation structure.

This becomes especially noticeable when parsing complex webpages that can be highly dynamic and with their html. While the tree structure is often unstable the core object relationship almost always is, in other words comment text will always be under comment paragraph, under comment box, under article.

</comment></comment><comment><USER4> I recently discovered [ScrapeMate]([https://github.com/hermit- crab/ScrapeMate#readme](https://github.com/hermit-crab/ScrapeMate#readme)) and [selectorgadget]([https://github.com/cantino/selectorgadget](https://github.com/cantino/selectorgadget)) both available as chrome extensions that can come handy for quick scraping.

There are opportunities for better selectors that could possibly be found using machine learning (?)

</comment><comment><USER3> Would be nice if readme would show some actual example; now it just trails off:

        let element = robulaPlus.getElementByXPath('/html/body/div/span/a',
        document);
        robulaPlus.getRobustXPath(element, document);
        # what's the result?

<comment><AUTHOR> It depends on the content of the HTML document but I agree with you.

I tried running the algorithm in Chrome. It output much shorter XPath than one copied from Chrome Developer tool.

      e.g. "//*[@id="rso"]/div[4]/div/div[1]/a/h3" => "//*[contains(text(),'(text of the element)')]"

<comment><USER3> Your example seems pretty awful though. You'd rarely want to select element based on it's text

<comment><AUTHOR> I think the author claims the XPath is more "robust" because it doesn't depend on indexes of the elements so you can add elements without breaking the XPath. (But it is arguable which one is better ...)

</comment></comment></comment></comment><comment><USER5> Is there a name for the concept of automatically generating (potentially with machine learning?) selectors?

I feel like I've seen similar projects come across HN, but I'm at a loss for what to search for.

<comment><USER6> It's not that easy to reuse those because projects often differ in what they need (do you really want unique selectors for one single element?). But there are a couple of CSS selector generators, maybe you are referring to something like [https://github.com/fczbkk/css-selector- generator](https://github.com/fczbkk/css-selector-generator) or [https://github.com/antonmedv/finder](https://github.com/antonmedv/finder)?

<comment><USER7> I made a greasemonkey script for this purpose. Create XPath, CSS or pattern matching. Unfortunately it stopped working when Firefox got its new API. But here is a video of it: [https://youtu.be/PUrBJ6wOXvE?t=50](https://youtu.be/PUrBJ6wOXvE?t=50)

<comment><USER6> A very structured and guided approach/interface you built there. I can see why it does not work anymore with the new extension API, it's a complete interface. Nice work!

</comment></comment></comment></comment><comment><USER2> Non-paywall article PDF: [https://www.researchgate.net/publication/299336358_Robula_An...](https://www.researchgate.net/publication/299336358_Robula_An_algorithm_for_generating_robust_XPath_locators_for_web_testing)

</comment><comment><AUTHOR> The algorithm described in the paper is outlined as follows (just for my curiosity):

"The algorithm starts with a generic XPath locator that returns all nodes ('//*') and then it iteratively refines the locator until only the element of interest is selected. In such iterative refinement, ROBULA+ applies seven refinement transformations, according to a set of heuristic XPath specialization steps."

The algorithm seems to be a specialized heuristics for XPath generation.

</comment><comment><USER7> I have been using pattern matching for web-scraping. I think it is more robust than XPath. At least more reliable to detect invalid input.

Let's look at some of the Robula test cases:

Input:

Task: get the true element,

XPath:

           //*[@class='true']

Pattern matching:

{.}

Input:

Get

XPath:

           //*[@class='true' and @title='foo']

Pattern matching:

{.}

As you see, you do not need a new syntax for attributes. Input and pattern are the same!

Input:

Get the third element.

XPath:

           //*[3]

Pattern matching:

{.}

Input:

Get the h1 in the div

XPath:

           //div/*

Pattern matching:

{.}

This last example is actually getting to the point of pattern matching. Because every part of the patterns must match. If the div is missing, it will report, "div not found". If the h1 is missing in the div, it will report "h1 not found". But the XPath will just report "found these elements" or "found nothing".</comment>


A Quick Guide for Developing Effective Bioinformatics Programming Skills - <AUTHOR> http://www.ncbi.nlm.nih.gov/pmc/articles/PMC2791169/ <comment><USER2> I recently landed in bioinformatics coming from a semi-related semantic web project (coincidently at Stanford, in BMIR). It's one of the few academic research environments I've seen that actually use cutting-edge production systems (prototypes aren't enough). It's a ton of fun and has direct applicability to startups, especially areas that are working on huge datasets and enormous graphs.

I work on BioPortal, here's a sampling of the technology we're using:

Ruby

Rails & jQuery (UI, REST client)

Java (Spring, Hibernate, Protege, Lexgrid REST service)

mySQL

VMWare

Python for some metrics calculations

For our next iteration, we're going to be looking at using document stores for our ontologies, deploying a triple-store, and possibly some MapReduce for processing some of our ontologies (which can currently take 2-3 weeks to get through our entire workflow).

I'm happy to answer questions if people have them, or if you're interested in getting into the field and want some advice just let me know.

<comment><USER3> Why aren't you using appengine?

What exactly is the point of triple stores? they're always much slower than a proper schema.

Do you use genetic programming in bioinformatics? if not, why not?

Is it possible to make profits in bioinformatics (ie. not be government funded) ? Specifically, are there free datasets that you can "infer" new information from using machine learning/genetic programming and sell this information for big bucks?

</comment></comment><comment><USER4> Interestingly, you could pretend the 'Bioinformatics' was not in the title and it would still be an interesting article. Though perhaps somewhat redundant for most folks here.

<comment><USER5> good point, it's really an introduction to 'how to get disciplined and organized in your code hacking'</comment></comment>


A Man Who Flies Around the World for Free - <AUTHOR> http://www.rollingstone.com/culture/features/ben-schlappig-airlines-fly-free-20150720 <comment><USER3> I spend more time than I should in the churning/FF communities (all of which are centered around FlyerTalk). It's fun. Ben's blog is one of the few I follow, most aren't that great. Frequent Miler is a solid resource, as is Wandering Aramean, but nothing beats being active on FlyerTalk itself.

In the last five years I've managed to earn and spend about 1.5 million miles and points, with maybe 50k airline miles from actual flying and ~400k points from actual Hilton stays. Between churning, manufactured spend and promotions I'm able to do 1-2 international trips a year in first class, staying at good hotels. I mostly travel to Asia and get great value out of free flights on Singapore, Cathay Pacific and Japan Airlines.

It's an awesome hobby if you: a) have time to kill b) are single and c) have an insanely flexible schedule.

I used US and BA miles earlier this year to fly to Malaysia and Thailand for free (well, plus taxes) in first class, spending five weeks between Hong Kong, Penang, Koh Lanta, Beijing and Tokyo.

Drinking $300 champagne at 35,000 feet on a flight you didn't pay for is a rather fun feeling...

<comment><USER4> Good to see another FT'er on HN. I've earned/burned about the same volume of points as you and can attest that this hobby is awesome, with some caveats.

For the beginners out there:

1\. Be sure to read as much about earning miles as redeeming them. Both sides are equally important and redeeming is actually getting much more difficult.

2\. Don't let the newbie blogs lure you into hitting credit cards too hard. Banks are starting to tighten the clamps on our hobby. Be sure to learn, start slow, and then start ramping up. Banks like to see a relationship, not just a high credit score.

3\. If you're dipping your toe in Manufactured Spending (MS), start small then ramp up over time. Nothing worse than getting shut down for hitting something too hard. That said, MS is a great way to meet minimum spending without using too much money.

4\. Don't let headline point valuations fool you into thinking you have to fly in Biz or First to get a good value on your points. Blogs use these kinds of numbers mostly to get you to sign up for CC's. Figure out your your strategy and go that way. A person looking for a lot of domestic flights is going to have a different strategy than someone looking to travel like saryant (and myself, incidentally).

tl;dr; This hobby is amazing if you can figure it out and do the leg work. I too enjoy good champagne 35k ft in the air ;)

If you have any questions, AMA! :)

<comment><USER5> Could you give someone who has ABSOLUTELY no idea (even after reading your comment) about any of this what it is you do to hack the system?

<comment><USER6> Trade your free time and (temporary) credit score rating for miles- flights, hotel stays.

<comment><USER7> Why was this voted down? Is this inaccurate?

Another layman question, what does this do to your credit score?

<comment><USER6> > Why was this voted down?

People that engage in churning are a bit self-conscious (source: recovering churner). Simple fact is you don't churn if you don't have to- it's not worth your time.

> Another layman question, what does this do to your credit score?

Opening new credit cards lowers your credit score- it adds weight to the single debt category(mortgage has a house backing it, a credit card doesn't), lowers the average age of credit lines (someone that has paid a home loan on time for the past 20 years is more 'reliable' than the naive 18-year old college student das company is preying upon), and, if you open too many at once, gives the impression you're desperate, insolvent.

</comment></comment></comment></comment></comment></comment><comment><USER8> Don't you have to worry about radiation at some point? I mean flying 300 days out of the year has to add up.

<comment><USER9> Not sure why you're being downvoted, it's a real issue.

[http://www.nytimes.com/2001/05/24/news/24iht- radiate_ed3__0....](http://www.nytimes.com/2001/05/24/news/24iht- radiate_ed3__0.html)

> A 1996 paper published in the American Journal of Epidemiology found a > higher incidence of myeloid leukemia, astrocytoma, prostate cancer and > malignant melanoma among 2,740 Air Canada pilots than in the general > population.

> One study of female flight attendants in Finland and Denmark found an > increased rate of breast cancer.

<comment><USER10> Also, via XKCD:

[http://xkcd.com/radiation/](http://xkcd.com/radiation/)

Three LA to NY flights are more than the approximate dose received at Fukushima Town Hall over two weeks following the accident. But you have to make 175 flights to get as much as you get with just one chest CT scan.

<comment><USER11> According to that graph a chest x-ray (20 µSv) has half the effect of a LA-NY flight (40 µSv)

<comment><USER12> Chest X-ray << Chest CT scan (350x)

Which makes sense, since a CT scan is basically enough X-rays that you can make a 3D picture.

</comment></comment></comment></comment></comment><comment><USER13> I seem to have missed something, in that I don't get one moment of the story; given:

 _in April 2011, he received a certified letter from United, cheerily informing him that because he had taken advantage of the system his frequent- flyer account was permanently suspended. He was banned from flying, he recalls the letter saying, unless he paid the company $4,755 — the amount it claimed as losses through Schlappig 's techniques. [...] Schlappig has repeatedly offered to send United a check but has gotten no response._

\-- so, how he continued the Hobby afterwards? Did he switch to a different airline? Can anybody help me understand?

<comment><USER3> He stopped flying UA and switched to primarily AA.

<comment><USER13> thanks for the clarification!

</comment></comment></comment><comment><USER14> Anyone else find this "hobby" somewhere between low-grade morally questionable and a completely banal use of above-average problem-solving skills? Upper middle class man-children with disposable income can, I'm sure you're surprised to find out, game overenthusiastic corporate behemoths?

<comment><USER3> I'm curious as to what the morality argument actually is, as this isn't the first comment to espouse that view.

What do you find morally questionable about churning? It's game in which banks and airlines write the rules and reserve the right to change them unilaterally.

<comment><USER15> I think the issue here is more one of externalities. We all know that fuel prices are not at the true cost which prices in all the pollution, geopolitical turmoil, military interventions, global warming, government subsidies etc, and that fuel is one of the largest costs airlines have. So when this guy and his followers hop on planes and fly millions of miles, often for no reason other than to game some tiny loophole in airlines' marketing for their own amusement, it's no different than if they had taken a bunch of oil tankers and lit them on fire and danced by the flickering light - in the end, they've killed some time, and a lot of valuable resources have been consumed to do so. Couldn't they have found productive jobs and just played Xbox on their time off or something? Did _this_ really have to be their hobby/profession?

<comment><USER3> How much is actually being burned though? How much fuel does it take to transport 200lbs on a transpacific flight?

<comment><USER16> Wikipedia suggests ~100 mpg/passenger [1]. As Schlappig has flown more than 400,000 miles, he's burned up about 4,000 gallons of fuel. That's a lot of fuel. It's enough to heat a northeastern United States home for about eight winters [2].

But it's not that much fuel. A 30-mpg automobile will consume a similar quantity of fuel (gasoline, not jet fuel) in 120,000 miles of driving.

[1] [https://en.wikipedia.org/wiki/Energy_efficiency_in_transport...](https://en.wikipedia.org/wiki/Energy_efficiency_in_transportation#Aircraft) [2] [http://www.eia.gov/forecasts/steo/tables/pdf/wf- table.pdf](http://www.eia.gov/forecasts/steo/tables/pdf/wf-table.pdf)

</comment></comment></comment></comment></comment><comment><USER17> Ben's only one of a growing number of high-profile frequent flyer bloggers: [http://pointsbuzz.com/](http://pointsbuzz.com/). As most of the strategies they promote for amassing ff points revolves around gaming sing up bonuses for credit card fees, the bloggers make money from affiliate fees for credit cards they promote. The airlines don't mind because they sell their miles to cc companies and gain customer loyalty. The credit card companies don't mind because they buy the miles for cheaper and use them as an incentive that is cheaper than the lifetime value of the customer.

<comment><USER18> There is also a subreddit for this: [https://www.reddit.com/r/churning](https://www.reddit.com/r/churning)

<comment><USER3> /r/churning isn't a great resource, to be frank. Flyertalk is far and away superior.

</comment></comment></comment><comment><USER19> I don't get the appeal of flying first class just for the "fun" of it. You can sit in a comfy seat, drink overpriced alcohol served by an attractive lady at your local Mens club with much less hassle. Flying first class is cool if you actually have to travel but just for the hell of it.

<comment><USER20> Flying business class is _less_ unpleasant than flying regular class. But it's not pleasant.

I get that some people might like this. I was speaking to my other half about it last night. People go on about how great first class is. I wondered if people had a choice between teleportation and first class which would they choose? I'd go for teleporting. I think most would.

So how great can first class be if I'd willingly exchange it for just the time back?

<comment><USER21> Whereas for cash tickets, going up a class of service is exponential. A round- trip to Asia is going to be about $1K in economy, $6K in business and 20K in first. Points tickets are logarithmic, if economy is 1X, business is usually 1.5-6X and first is usually 2X. So you can pay 2X as many miles for a product that costs 20X as much.

Business is a better seat, edible food and free booze. First [on a decent airline] is a different world. Caviar and Krug/Pol Roger/Perrier-Jouet. Lufthansa has an entire separate terminal building with private immigration, security, private assistants, a restaurant, a massive bar and Mercedes or Porsche limousine service to the side of the plane. Flown it many times, and I keep looking forward.

First is no waste of time for me; champagne, caviar, gourmet dining and wifi (or the plausible excuse for not having wifi), it's a wonderful way to spend a few days.

<comment><USER20> The product does not deliver 20x the "value". It's aimed at people who have more money than they can spend. If you have a job paying less than 200k the cost of first-class is a huge deal. For them the cost is like you buying a beer.

</comment></comment></comment></comment><comment><USER22> These type of communities tend to remind me of the "extreme couponing" crowd and the like.

Sure you can get some free stuff, but at what price? What if you took that time and invested it in bettering your skill sets, etc.?

<comment><USER23> Like couponing its a hobby for people with limited skill-set.

<comment><USER3> As someone who's both heavy into this hobby and a software engineer at a major tech company, I'm going to disagree. I get to fly around the world having fun while spending very little.

<comment><USER23> >spending very little

you are spending a lot of valuable time

<comment><USER3> It's fun. Unless we're going to reduce everything we spend time on down to utilitarian justifications, that's all the reason I need.

</comment></comment></comment></comment></comment><comment><USER24> > United offered coupons to passengers worth $200 or $400.

I'd be pretty surprised to see that now. On my last long United flight, which was 6-7 hours overseas, my in-flight entertainment system was broken, and they gave me a $25 voucher. I was not impressed.

<comment><USER25> The amount of comp you get for small shit (e.g. broken light, no recline, no IFE/wifi) is largely dependent on your status. A no-status member might maybe get 500 miles on United, where as a Global Service might get up to 10K+ (depending on severity)

<comment><USER26> Do you have to request the comp? I've never been offered compensation for the often broken entertainment system, wifi, or power (as UA Gold).

<comment><USER25> They will often send you emails where you have to complete a form/survey to get the offer. I usually request the comp. You can call in or email - <USER2> you're 1K / GS, there are dedicated email addresses with 24 hr response

</comment></comment></comment></comment><comment><USER27> Is any of this (realistically) applicable if you are european? We're still reluctant to use credit cards at all here.

<comment><USER28> You can start using credit cards.

<comment><USER27> Not to pay rent, and I spend very little on anything else.

<comment><USER29> You don't buy food? Furniture? Car? Bicycle? Computer?

<comment><USER27> Food of course (~200$/mo), and travel (but usually my employer pays for it, if they send me somewhere worth it I will take a few days off before coming back).

If I could 'hack' an extra return flight to SF, NY or Tokyo once a year it'd be great however.

I update my phone and laptop every five years or so. Bike is free.

</comment></comment></comment></comment></comment><comment><USER30> I wonder what will be the long-term affects of all that high-altitude radiation exposure. I guess we'll have to check back in with him in 20 years.

<comment><USER31> Or check with any random crew member today who's been on the job for a couple of decades.

</comment></comment><comment><USER32> Tough chance of any youth from my country trying to compete with him. Our government has imposed tough regulations on credit card ownership in order to curb personal debt.

Those who apply for a credit card must be 18 years or older and provide proof of stable income >= $2000/month before banks will even consider the application. Also, all credit cards are registered at our national credit registration office with their max withdrawal counted towards personal debt risk, so applying for or owning more than just a few CCs at any single time is very unlikely unless one has a very well paid job or other sources of income.

<comment><USER3> Fortunately (for me) the US has no such rules, other than the age restriction. I joined this game four years ago when I was 21. Now that my credit file is built up, I can open five cards within a week or so and almost always get approved.

Within three years of starting I had available credit of 150% of my income.

</comment></comment><comment><USER33> I use miles to get flights a couple of times a year. A 'free' long-haul flight economy class costs me $700-800 in taxes, which can not be paid in points. How can these out-of-pocket charges be avoided?

<comment><USER4> Which program and what route are you flying? $7-800 is on the high side for economy taxes, which makes me think you are flying into LHR on BA or something similar.

If you really are flying into LHR from the US, one alternative is to fly into a different city in Europe and connect over.

<comment><USER33> Good guess. Into LHR on Air Canada. Taxes brutal.

<comment><USER4> LHR taxes are definitely brutal. Assuming award space and that the routing isn't too out of the way, you could look into flying on a partner. A quick google tells me that you could look into flying on Swiss, Turkish, or United to cross the atlantic. Flying on these partners using Aeroplan miles shouldn't incur fuel surcharges

<comment><USER33> Thanks, I will look into this. Could save a good chunk of change!

</comment></comment></comment></comment></comment><comment><USER34> Kudos for him doing what he wants, but why?

<comment><USER35> > why?

Because he wants to and it works

But the interesting question to me is

> why don't we?

<comment><USER36> Probably because it is insanely unreasonable for many to go through all the hassle for a few flights. I don't spend too much on flying but even twice the price wouldn't bring me to churn credit cards, save all the credentials, watch out for rewards, etc. This is all stuff I'd love to pay someone if I had to do it.

</comment></comment></comment><comment><USER37> Doesn't this slam your credit rating by taking out so many credit cards? Or does he (and other people who do this) not care?

<comment><USER3> In your early days, yes, you can take a hit from churning, but after a year or so your credit should stabilize (assuming you never miss a payment). I've been churning for a few years and my FICO is around 780.

<comment><USER37> And do you just never close the cards either?

<comment><USER3> Some cards I close. If there's an annual fee, I weigh the benefits each year. If the benefits don't justify the fee, I try to get the fee waived. Failing that, I cancel.

OTOH cards with no fee get tossed in a drawer. I have 5 no-fee Citi Hilton cards just sitting in my file cabinet.

</comment></comment></comment></comment><comment><USER38> Seems like he's causing a lot of pollution

<comment><USER3> Actually, no. Airlines only release seats for award redemption if they don't believe they can sell them. Therefore, he's only taking up seats that would otherwise go empty on flights that are going to fly anyways.

<comment><USER39> Sorry that can't be true. Even my lowly MileagePlus Explorer card allows me to book an award seat on any flight with availability.

<comment><USER3> At the standard (rather than saver) award price. United knows almost nobody is actually redeeming that, it's just a marketing ploy.

</comment></comment></comment></comment><comment><USER40> I wish us Europeans could do that :(

</comment><comment><USER41> This is pretty damn cool

</comment><comment><USER42> It also helps to have a passport that lets you do that.

<comment><USER3> I don't follow. The hobby is really only possible for Americans and American passports are easy to travel.

<comment><USER43> I have an Australian friend who does this, so it's definitely possible outside of America. I know it works because he's flown to visit me in a few places (Asia, US). However, the insanely tight international travel schedules sound to me more like a boring and unpleasant experience than enjoyment. Glad you enjoy it though!

</comment></comment></comment><comment><USER44> This is a bad customer. I'm surprised the airlines just don't ban him.

<comment><USER17> It's actually a big circle jerk that benefits the airlines. Most of the strategies that Ben and his cohorts promote is "gaming" credit card signup bonuses. Basically, sign up for X credit card and get X number of of frequent flyer miles. The airlines sell the miles to the cc companies for much cheaper than a consumer could buy and in return get some revenue and customer loyalty. In the case of co-branded credit cards, there's probably some revenue share going on. The credit card companies then incentivize a new customer by giving X frequent flyer miles after X spend threshold. The CC companies make money by charging retailers a merchant fee for transactions. The bonus miles they give to new customers is often itself cheaper than what they'll earn in transaction fee from retailers, but almost certainly after you take into account the lifetime value of the customer. The customer feels as if they got miles for free or super cheap as they often make purchases they would have made anyway on another card. And of course, bloggers like Ben get paid on affiliate fees for promoting specific credit cards.

<comment><USER45> I'm surprised these guys haven't gone to the next level and started up their own credit card company. That might allow them to buy frequent flyer miles at the dirt-cheap levels and offer ridiculous signup bonuses for their card. For example, if 100K miles costs them $X, have an annual membership fee of $1.25X and you get 100K miles a year bonus. Or for $12.5X, get 1M miles a year bonus. The use of this as an actual credit card is purely optional. Or is this only financially viable due to the transaction fees the credit card companies get?

<comment><USER46> > Or is this only financially viable due to the transaction fees the credit > card companies get?

Yes. These reward cards work out to about 1-2% cashback equivalents after the sign up bonuses. From the credit card perspective, the financials are basically identical to their normal "cashback cards".

If you are like me and just want a couple free plane tickets a year, you just pick up 4 new credit cards [~160-200,000 points/miles] and cancel them. If you put 100% of your spending on credit cards and just cycle through the sign up bonuses every 3 months, its really easy and 160k miles is 2 round trip tickets a year anywhere domestically, with some leftover.</comment></comment></comment></comment>


Ask HN: Accept better position or better company? - <AUTHOR> I'm trying to decide between 2 offers. One is a better position - I would be running a small team doing some cool tech, but I'm not so sure about the company.
The other is a worse position - I would be the equivalent of ON the team, not running it, but the company is "better" (better investors, people seem smarter, are closer to market).
Assume I'm making competitive compensation in both places (so the first place is less cash, more equity). Which job do you take and why? <comment><USER2> If you are going to be running a team, I would recommend the people who will be reporting to you should be factored into the decision. Do you get to hire them or are you coming to manage an existing team?

Also, just in general, since you mentioned "less cash, more equity". More equity shouldn't be considered a balance to earning less cash in evaluating a job offer. Equity has an expected value based on probability of success. For startup employee equity I've heard people use an EV of ~$0.00 as safe rule of thumb. I'm not a fan of that approach but at the very least "more equity" at the worse of two companies is often worth less or worthless. Up to you how much this matters, if at all.

Hard to answer this with info provided, but I wouldn't take either at this point unless you have to. Kick the can on the offers or get more info from each company that will help you decide.

<comment><AUTHOR> I get to hire the team.

Good point re: equity, I was trying to say compensation is competitive for both situations.

</comment></comment><comment><USER3> The pay for working for a "real" company... salary, normalized expectations around work/life balance, 401k, benefits, name recognition on your resume for future projects... it's almost always significantly better at "real companies" vs smaller agencies or start-ups.

That said... we wouldn't have Microsoft, Apple, Dell, etc. if everyone followed that advice.

Which boss do you like more?

<comment><AUTHOR> > name recognition on your resume for future projects

This is a great point. No one might care if I have a big shot title at a company no one has ever heard of.

> Which boss do you like more?

The guy at the 'better' company seems kinder and has more experience. The smaller company guy is younger and less experienced and tougher. Probably would be "easier" to work for the former, but I don't know if I would develop as much professionally.

</comment></comment><comment><USER4> Depends on what skill sets you want to improve on. If you want to start managing people then no better way to acquire that skill than to actually do it. If you don't want to acquire managerial skills then you should stick with better people.

In general when I'm making these decisions it always comes down to which group of people I like better regardless of the technology stack.

</comment><comment><USER5> Take the manager role. It's the hardest to get between the 2. There are many great companies and a zillion individual contributor positions out there. Stay in that company for 1-2 years and apply at a better company as a manager. Stupid recruiters will look at your current title. So either move horizontally or vertically...

<comment><USER6> Don't really have anything to add, just wanted to say this is a very good point.

</comment></comment><comment><USER7> I would always choose the company with smarter people, it will be better in the long run I think (learn from them, push your limits, grow your network with smart people and their network, etc.)

</comment><comment><USER8> I think I would go with the better company. Im not sure I would want to be in charge of a team when you might not see eye to eye with your bosses.

</comment><comment><USER9> Do you intend on founding your own business or leading other businesses?

<comment><AUTHOR> My dream job is CTO / founder at a tech company. I've attempted a few ideas but nothing's taken off so I'm trying to do the next best thing in someone else's company.

<comment><USER9> If you want to be a founder, it only makes sense to surround yourself with other brilliant people you can build with. Managing any team is beneficial for the resume, and that doesn't matter much if you're dedicated to building your own company. I'd recommend whichever option you believe empowers you to innovate; while giving you the flexibility to understand the context/foundation to successfully running your own business.

</comment></comment></comment><comment><USER10> I would be big fish in small pound rather small fish in big pound.

<comment><AUTHOR> Thanks for your response! Could you explain why?</comment></comment>


CoffeeScript 1.1.2 released - <AUTHOR> http://twitter.com/#!/jashkenas/status/99318698275377153 <comment><AUTHOR> I realize that posting to HN about every little bugfix release is annoying, but this is the first CoffeeScript release in nearly 3 months. To put that into perspective, that's about 15% of the language's lifetime up to this point.

During these last three months, Jeremy gave a talk with Brendan Eich at JSConf; David Heinemeier Hansson plugged the language in his keynote at RailsConf; and my book on it (<http://pragprog.com/book/tbcoffee/coffeescript>) went into print. The small number of changes between 1.1.1 and 1.1.2 is a testament to how quickly the language has achieved stability, even as it's gaining traction with mainstream programmers.</comment>


Ask HN: Office Space - Important? - <AUTHOR>

I have an architect friend who has rented a nice office space for his own business, and he's said that the spare desk in there I can rent from him.
Its a very nice office, its the art room in a school that is being converted into business offices, so 1 wall is nearly all glass to let in light. He is only asking for £150 a month (mates rates) and that seems like a bargain to me. Its within a short bike ride from my house (30min) or a walk and a bus ride. I will use it mainly for getting my own business ventures off the ground as a way to help me procrastinate less and get in a business mindset when there.
Did anyone else find that getting office space and a desk increased their productivity? Its more of a personal preference really, but anyone able to share any advice or past experiences? <comment><USER2> If you are easily distracted, working in an accountability area (as in no YouTube) helps get you focused - at least for me. If you work as a team, I don't think you can replace being there very easily - whether that means your apartment or getting an office.

<comment><AUTHOR> I work full time for another company (got to have income from somewhere) and whilst I work my other interests I figured the office would be a good idea.

I have so many projects in my head and my time seems to get occupied so easily with stupid things (youtube, hackernews :) ) that some office space seemed like the easiest way to stop that.

As I mentioned its more of a personal choice I would imagine, trying to see if I have considered all the factors or anyone has any cheaper alternatives.</comment></comment>


Why We Lie - <AUTHOR> http://danariely.com/2012/05/26/why-we-lie-from-wsj/

<comment><USER2> We lie for so many reasons. Some may lie to protect the interest of another person or to escape from arguments.

</comment><comment><USER3> I know he's the original author, but probably best to share the full WSJ article instead.</comment>


The world's first website went online 25 years ago today - <AUTHOR> http://www.telegraph.co.uk/technology/2016/08/06/the-worlds-first-website-went-online-25-years-ago-today/ <comment><USER3> That time will always have a place in my heart. An age where we were largely limited to a couple fonts, where Times New Roman was de facto, where hyperlinks were almost always blue with underlines, where quirky animated gifs were ubiquitous, where design and user experience was very raw and still undiscovered... it was indeed a simpler time!

</comment><comment><USER4> Exciting times. I remember trying the Mosaic browser for the first time and thinking that it was at least as good as Gopher, and maybe better.

It was inconceivable to me at the time that it would become what it is now. Hell, the "blink" command seemed pretty cutting-edge when it was added to HTML (as a joke, it turns out). I never imagined it would become basically indispensable for conducting most business or that it would become the replacement for tv.

<comment><USER5> _I never imagined it would become basically indispensable for conducting most business or that it would become the replacement for tv._

I initially thought you were referring to the blink command.

</comment></comment><comment><USER6> "By the end of 1994, the Web had 10,000 servers - of which 2000 were commercial - and 10 million users."

That was the time I first gained internet access. So that puts me well within the first 1% of internet users. The web felt huge even then. But it was much slower, I still remember my 14.4 kbit/s modem.

<comment><USER7> same here, through my aunt's computer at her law offices. i was able to find neat websites from professors talking about all kinds of things and looking at the source html is how I learned it in the first place. good times

<comment><USER6> That's how we all learned. That, and I remember downloading Netscape 2.0 and finding an html tutorial in the help menu.

I should start claiming 20+ years of web development experience.

I also adopted their mail client, I've been using its successors pretty much uninterruptedly until today.

</comment></comment></comment><comment><USER8> I first encountered the WWW in the fall of 93. At first I was extremely confused, although Mosaic provided pulldowns for things like usenet and gopher, so I just assumed it was a GUI tool for that stuff.

By the end of that year of school I was recording & visiting every URL I encountered, regardless of what it was. They were that novel. By the time the next school year started it was getting increasingly difficult to do that, I gave up some point in that Fall 94 semester.

Sadly I was pretty adamant that the whole web thing was never going to take off and would be short lived. I suppose I got that one wrong.

<comment><USER9> I was fund-raising for a metered content play (DRM, I guess we'd call it now) in the fall of 94. You wouldn't have to pay tens of thousands of dollars for data subscriptions on CD-ROMS, you could buy an article for $10 or $100 at a time. And, who knows? In the future - when this Internet thing takes off - <USER2> distribution is "free" \- maybe people will pay a nickel to listen to a song they copied from their friend!

All I got back was: "What's the Internet?"

This was about a year after I left Motorola, for failing to be able to sell them on how content distribution between portable super-computers with built in wireless data modems was going to change the world. _sigh_. Oh, well. I guess they paid the price for their lack of vision! :-)

</comment></comment><comment><USER10> Odd to think the first website I ever built for someone else will be 20 years old next year - and virtually unchanged. They've sold a lot of paint with 90's HTML!

</comment><comment><USER11> I sometimes wonder if Berners Lee, when he invented the web, was doing his real job at CERN, or if he was doing it as a side-project (perhaps secretly in the time of CERN).</comment>


Anonymisation attack challenge – up to 5000 USD per attack - <AUTHOR> Working with sensitive personal data is difficult at best of times, and anonymising such data properly devilishly tricky.
At Aircloak we have built a software layer that dynamically anonymises the answers to SQL queries on the fly. We believe that the proof is in the pudding. Anyone can claim they are safely anonymising data, but very few understand what it actually entails. Deleting names or social security numbers is far from sufficient.
The challenge works pretty much like a normal bug bounty only that in this case you get paid for breaking the anonymisation rather than for finding security bugs. We pay up to 5000USD per successful attack.
To make it easier for you, and harder for us, you also get full access to the raw unanonymized datasets that we are claiming to protect as well as the ability to run as many queries as you want through our system.
If you are interested you can find more information here https://challenge.aircloak.com.
By way introduction, my name is Sebastian and I am the CTO at Aircloak. I am more than happy to answer any questions you might have whether they be about our system, our stack, or anything else that you might find interesting. <comment><AUTHOR> Sorry, this ended up being a duplicate post (other here: [https://news.ycombinator.com/item?id=15482089](https://news.ycombinator.com/item?id=15482089)). Due to the procrastination setting on hackernews I thought I hadn't submitted the first one and ended up with a double post).

If a moderator can delete this one, please do.

Thanks</comment>


"Social network" of brains lets people transmit thoughts to each other's heads - <AUTHOR> https://www.technologyreview.com/s/612212/the-first-social-network-of-brains-lets-three-people-transmit-thoughts-to-each-others-heads/ <comment><USER2> > "A cloud-based brain-to-brain interface server could direct information > transmission between any set of devices on the brain-to-brain interface > network and make it globally operable through the Internet, thereby allowing > cloud-based interactions between brains on a global scale," Stocco and his > colleagues say.

I bet they struggled to keep a straight face saying that.

<comment><USER3> Disappointed they didn't fit blockchain in there somewhere

</comment></comment><comment><USER4> MIT student: reinvents wheel

MIT press office: "MIT researchers develop matter transporter"

<comment><USER5> Reading further: The motion of the mechanism has been described as an "harmonious coordination of trochoid trajectories".

</comment></comment><comment><USER6> This reminds me of a cool thought that I've read some place else: "imagine a technology so advanced that can transmit thoughts wirelessly between humans and even change the actual layout of the neruons in our brains". We already do that with our voices....

<comment><USER7> > We already do that with our voices....

But that requires one side speaking. If they refuse to speak, then we can't know their thoughts. And people can also tell lies with their voices. Now if we could somehow interface directly with the brain...

Voice is like an API the person provides to others. Like twitter's API for users access data. But twitter can shut down the API or manipulate their API to show us what they want us to see. But imagine if you had direct link to their database?

<comment><USER8> People will just learn to lie with their brains.

<comment><USER9> I would argue that this has already happened, and the evidence that eventually proves it will be truly horrifying.

Think about a person--someone you may already know well--that actually believes his own bullshit. Such a person armed with a brain-to-brain interface is an existential threat to objective reality.

<comment><USER10> Sociopath brain?

</comment></comment></comment></comment></comment><comment><USER11> Reminds me of this Futurama scene:

 _[Fry and Leela after Fry had an advertisement in his dream]_

 _Leela: Didn 't you have ads in the 21st century?"_

 _Fry: Well sure, but not in our dreams. Only on TV and radio, and in magazines, and movies, and at ball games... and on buses and milk cartons and t-shirts, and bananas and written on the sky. But not in dreams, no siree._

If this technology gets refined, this might even be a reality in what, 50 years?

<comment><USER12> Or from the final episode of _Firefly_ :

Jayne: _Well, I don 't like the idea of someone hearin' what I'm thinkin'._

Inara Serra: _No one likes the idea of hearing what you 're thinking._

<comment><USER13> Love it!

Seems it works for nearly all SM sites.

</comment></comment></comment><comment><USER14> This is so freaking cool, I literally can't believe this is happening and am so excited about being involved in technology at a time when such advanced capabilities are right around the corner. I wonder how tricky this is to actually build. I wonder if you could use some of the stuff off of OpenBCI and build one of these BrainNets using available resources. Anyone want to try with me? I can't believe they were able to accomplish this using only 32-channels, that seems pretty unbelievable.

Probably out of reach but it would be good for this kind of tech to not just get cobbled up in the regular patent storm and be able to keep some kind of implementation in the public domain as a result of putting this together. Oh, to be a CS student at the University of Washington right now... must be a fun time. I would trade an arm and a leg to be at the forefront of this domain, its the culmination of so many different fundamental breakthroughs that have been made over the last 20 years. What a time to be alive.

I can't wait to see where this + AR/VR will take us, but am also quite concerned about the cavalier attitude that megacorp tech companies take toward privacy issues and the implications of true telepathy on social interactions on a broader level

</comment><comment> yoz-y As much of the research in BCIs this one is more of a feat in engineering rather than science. What is the ultimate goal of the study? We know that flashing stimuli cause a response in a brain (this is called Steady State Visual Evoked Potential or SSVEP and is studied a lot). We know that a TMS device can cause receiving person to perceive flashes. This game could be fun and all, but it is a technology demo and ability to say "I did this first".

Another thing, SSVEP has two modes of action, one is based on vision and the other on attention. That is: if somebody is just looking at a flashing light, the signal is clearly visible in the occipital region of the scalp but this is _not_ brain signals, it is a signal from the optical nerve. It is (according to a paper) possible to consciously control the SSVEP response amplitude (for example with the two flashing targets in the peripheral vision and an eye- tracker that ensures that the subject is not actively looking at a target, merely concentrating on one). This response will be of lower amplitude but will come from the brain.

</comment><comment><USER15> Cloud based brain to server? so finally I can spend my whole day swooning over Justin Bieber while some coffee barista in the city cant stop thinking about diesel injection timing faults for the Peterbuilt I was working on.

</comment><comment><USER16> Still in its infancy it seems but frankly I'd hate for this to develop into a "thing". It's already hard to switch off in this crazy world, next up: Thought advertisements.

<comment><USER17> This is scarier than you think. So long as most people are okay with it, you may not have much of a choice in whether to participate or not. (Just as you mostly can't choose to pay for web content instead of watching ads.)

</comment></comment><comment><USER18> A very good article on this topic: [https://waitbutwhy.com/2017/04/neuralink.html](https://waitbutwhy.com/2017/04/neuralink.html)

</comment><comment><USER19> Even though this is obviously not as far down the road as the article makes it out to be, it's an amazing achievement that it works at all. I'm pretty surprised that something like this is possible. Considering that for my laymen mind, this sounds like you are "writing" on the brain, I'm gonna pass using this myself though. Seems possible to alter something in the human brain that you really didn't want to tinker with.

</comment><comment><USER8> At risk of sounding like a broken record, I want to point out that you don't need fancy hardware to experiment with this sort of thing. Simple GSR (galvanic skin response) sensors and a bit of self-hypnosis are enough to get some very interesting effects and communication.

(Also, you _have_ fancy hardware: your eyes and face, ears and voice, etc. It's easy to lose sight of the fact that still today the most sophisticated hardware in the room is the human nervous system. At least for a few more years, eh?)

<comment><USER8> I know it's gauche to reply to your own messages, but I wanted to be less coy about what I'm saying:

Make nine sensors that can detect twitches of your fingers, it doesn't matter what modality you use: motion, sound/vibration, electrical, but you want to be able to tunable sensitivity of each channel independently.

Connect the sensors to your eight fingers and one thumb.

Use hypnosis[1] to ask your unconscious mind to output binary digits on the fingers and a clock/ready signal on the thumb.

Presto. You have an 8-bit parallel port from your mind to your microcontroller.

With a camera and modern ML you would only need two bits, a yes/no and the clock/ready signal, to "train" your computer to read information from your facial expressions. And of course this can be extended to full biometric sensor suites. In fact, if you're wearing e.g. a Fitbit, you already have verything you need to set up a pseudo-telepathic UI. You just have to put some off-the-shelf software together and get your unconscious mind onboard.

Hardware is not the limiting factor.

[1] Self-hypnosis is easy to learn, or you can hire a hypnotist to induce a trance and give you post-hypnotic suggestion to be able to re-enter trance at will using a self-trigger (often a "mudra"[2] or brief counting ritual.)

[2] [https://en.wikipedia.org/wiki/Mudra](https://en.wikipedia.org/wiki/Mudra)

</comment></comment><comment><USER20> > These tools include electroencephalograms (EEGs) that record electrical > activity

As soon as I read "EEG", I rolled my eyes -- another clickbait title showcasing a usage of EEGs that, while interesting, is just a novelty. I don't think people are interested in communicating over a two-character alphabet. The "Yo" app, what happened to that again? I don't think the "Yo" app would have been successful, even if you could do it right from your head.

</comment><comment><USER21> More like a brain telegraph than brain social network. Also sender doesn't actually thinks just focuses attention on one of two blinking lights.

</comment><comment><USER22> 'Siri, I'm getting pulled over'

 __beep, beep __

' Yes, Dave, remain calm - the thought police will be with you shortly'

</comment><comment><USER23> How do they make sure their communicator isn't working through the wrong mechanism? It could be tricky to verify that they aren't just flipping the rotate bit when their head gets zapped, or something else noticeable but not interesting.

</comment><comment><USER24> We also do this via air pressure and the vocal tract with words.

</comment><comment><USER25> Am I the only one who doesn't want this? I am spammed enough as it is.

</comment><comment><USER26> The headline could just as well refer to the practice of talking...

</comment><comment><USER27> I don't know what to think of it. The article grossly misinterprets the experiment as some sort of magical thought interface, but in fact it's just a utilization of EEG devices and software. But then I read the comment of one of the engineers and I cringe at "cloud-based brain-to-brain server". This sensationalism in science and engineering has to stop.

<comment><USER28> While I understand that it's a bit sensationalized. At the end of the day, they're transmitting 1 bit of information at a very slow rate. While's that's only 1 bit more than 0, it's still an infinite percentage increase, and still leaves me super excited.

Despite my bs-filter having toned it down and given me just the facts that it's 3 people in a room with wires on their head playing tetris, with 2 looking at lightbulbs to send signals, it's still got me pumped.

I really believe BCIs be game changers in the way we communicate with electronics (if not other humans), and I for one would love to play a game of tetris over the internet with an unknown mind.

Edit: even in its current transmission rates, I think this tech could have far reaching implications in a better form factor. 1 slow bit is all I need to take a picture, lock/unlock my car, flip the light switch, turn the tap, open/close the door, Start the washing machine, turn the tv on, start the car, close the window, etc.

<comment><USER29> The 1 bit limit doesn't look like a technological barrier, but a we- don't-feel-comfortable-cutting-into-human-brains-for-research barrier. Of mice and monkeys, the story is more than a bit different: [https://www.nature.com/articles/srep11869](https://www.nature.com/articles/srep11869)

This is coming. So fast.

<comment> Blinks- This was a great read thanks, I found a good precursor study on brain-to-brain interface (BTBI) using intracortical microstimulation (ICMS), if you are not familiar with this research it's a good place to start: [https://www.nature.com/articles/srep01319](https://www.nature.com/articles/srep01319)

</comment></comment></comment></comment><comment><USER30> That's one over-hyped article if i ever saw one.

TLDR; It allows to send two signals that have two different functions in a tetris game - move left or rotate - accomplished by looking at different strobing lights that causes the brain to change slightly.

<comment><USER31> Yeah, I really like that part:

> A cloud-based brain-to-brain interface server could direct information > transmission...

They can barely transmit 1 bit per second with no prospect of increasing the data rate but start talking BS about the cloud.</comment></comment>


Vendors, Disclosure, and a bit of WebUSB Madness - <AUTHOR> http://pwnaccelerator.github.io/2018/webusb-yubico-disclosure.html <comment><USER2> Was there some work-around I'm missing or did they literally go "yeah this website can send anything to the YK device directly, waht could go wrong?". Because the folks at Google Security are definitely smart and many orders of magnitude more experienced than me, and that's a vuln even I can understand / see the problem with so something institutional must have gone way wrong if WebUSB shipped on the stable release without some kind of block-U2F-forgery filter.

As far as Yubico, I get that they are doing something pretty hard in the hardware / product-market-fit domains, and I respect that and I want them to succeed, but they appear to be seriously dropping the ball on the software part of their product [1], as well as "simplicity breeds security". They could do so much better on the actual UI/UX if they piece-by-piece copied the setup UX of a "smart" vacuum cleaner.

1\. I emailed & on-site support ticket submitted them days ago about some of their certs having expired on 2017-05-10, and have gotten not a peep in response & no fix in sight. Did nobody set a team calendar reminder and is nobody responsible for checking it on a monthly / quarterly / at the very least end-of-year cycle? That seems pretty elementary "underwear goes inside the pants" kind of security competence.

[https://i.imgur.com/bOCfXJ2.png](https://i.imgur.com/bOCfXJ2.png) [https://developers.yubico.com/yubikey-neo- manager/Releases/y...](https://developers.yubico.com/yubikey-neo- manager/Releases/yubikey-neo-manager-1.4.0-mac.pkg)

<comment><USER3>
      did they literally go "yeah this website can send
      anything to the YK device directly, waht could go wrong?".

WebUSB displays a prompt, albeit an uninformative one [1]. The idea is to trick the user into enabling WebUSB when they think they're enabling U2F.

[1] [https://developers.google.com/web/updates/images/2016-03-02-...](https://developers.google.com/web/updates/images/2016-03-02-access- usb-devices-on-the-web/usb-device-chooser.png)

<comment><USER4> Well that clearly doesn't look like a U2F prompt.

Of course U2F devices should be excluded from the list, and there should be some warning text about "do not allow important devices on random websites", but that doesn't seem like a huge deal.

<comment><USER3>
      Well that clearly doesn't look like a U2F prompt.

Thus downgrading U2F from "makes phishing impossible" to "relies on the user taking care to spot phishing attempts"

<comment><USER5> So just like any other phishing attempt then. What did we gain again?

<comment><USER6> Playing devil's advocate here (because I do agree this would be ridiculous but I think this is worth pointing out), but you can never completely rule out tricking the user. They could always download a file and run it to bypass the browser or something. So the question really _is_ how easy it is to trick the user here.

</comment></comment></comment></comment></comment></comment><comment><USER7> > We realized this is not limited to U2F / FIDO and developed a generic proxy > that allows to forward any USB device exposed to WebUSB to a remote system.

 _~sigh~_

It's really depressing to learn that reality was _much worst_ than any of my "this is going to end badly" predictions[1]. I originally thought[2] the problems would start on the hardware side with devices that were never designed for security. Forwarding everything with a proxy is _shockingly_ worse.

[1] [https://news.ycombinator.com/item?id=11466197](https://news.ycombinator.com/item?id=11466197)

[2] [https://news.ycombinator.com/item?id=11466415](https://news.ycombinator.com/item?id=11466415)

<comment><USER2> Aside from the "no HID" (does a YK even count as a HID if you turn off the default slot 1 functionality?), was the proxy designed to have a firewall / sandboxing of some sort? Google engineers have done some incredible things and while ambitious, it seems this kind of thing is well within their reach.

</comment></comment><comment><USER6> Ouch.

> Also there seems to be a kind of relationship between Google and Yubico that > I would love to know more about.

I've gotten this impression too, though looking back, it may be because Google suggests you Google for U2F, and every time I search for U2F I see Yubico. Anyone know more about this?

<comment><USER8> The real reason is Google buys YubiKeys enmasse from them for employee use (every employee has one), and works with them closely on in various ways.

In fact, they were closely involved when developing the USB Type-C variant.

<comment><USER9> Can you elaborate more on that? To my knowledge, it was the Intel, TI, Tyco, STM quadriga who was responsible for the nearly complete standard of USB Type-C, with software/consumer industry being given "eat or die" choice, with Apple's engineers apparently actually trying to stall the standard release.

<comment><USER8> If you meant to reply to my comment, Google is perhaps the largest deployer of Yubico products, and that is where their collaboration holds the most weight.

If there is a security issue with YubiKeys, it puts Google's corporate systems at risk.

<comment><USER9> I was asking about Usb type c. To my knowledge, Apple, MS, and Google were there just to give blessings on RFCs

</comment></comment></comment></comment></comment><comment><USER10> > _Also there seems to be a kind of relationship between Google and Yubico > that I would love to know more about._

Google and Yubico developed U2F, so....

Still, precisely because of this, I would say it's poor form for Google to award Yubico a bug bounty relating to U2F (would they award a bug bounty to an Android manufacturer for a kernel bug?).

It also seems like poor form for Yubico not to disclose their research when asking about the same topic to another researcher, and poor form for Google to be unwilling to award two bounties (this isn't the patent office, acknowledging and even incentivizing multiple discovery is fine).

</comment><comment><USER11> WebUSB was an obviously bad idea right from the start, just like Web Bluetooth was, both of which I believe were proposed by Google. It all comes from this nonsense idea from Google that "all devices should be directly connected to the internet" (and thus owned by botnets).

Mozilla team, if you're reading, please reject implementing or at least enabling such APIs with extremely high-risk to the user by default in your browser - "sandbox" or not.

<comment><USER12> How can you build applications on the web that use Bluetooth or USB devices without these APIs? Here there is a lot of hate for web based applications but I think this is because the web unlike native apps has a huge amount of transparency that means we can have solid debate about the approaches and solutions taken. In your closed source native app who knows what you chose for security, tracking and anything else about your app is not transparent. I always prefer web based applications over native. Native means I have far less trust in the application. Is it even using tls for network requests? So many things we can't see in a native app.

<comment><USER3>
      How can you build applications on the web that use
      Bluetooth or USB devices without these APIs?

Same way you use mice, keyboards, sound cards, printers, webcams and so on: a generic, secure interface supported by all device makers, OSes and browsers.

The whole benefit of web apps is they demand less trust because they're better sandboxed. Poking holes in the sandbox (like WebUSB) makes web apps worse, not better.

<comment><USER13> Yeah, and if the powers that be (browser vendors) don't implement the generic interface you need (e.g.: signature tablets, cash drawers, NFC readers, memory card readers, etc.) then you:

a) Don't do it and pivot your company to doing something else.

b) Implement your own solution with companion native apps that build this missing bridge. Out of public scrutiny and with many times less resources, but hey: the browser is secure! ;)

</comment></comment></comment></comment><comment><USER14> This is what bugs me a lot, when it comes to bugbounties including HackerOne. The absolute lack of accountability and transparency. One can only hope the companies act in good faith. In my opinion this should rather be handled by an independet organisaton like the CERT community or since it's a vital security interest at state level. Though latter might be prone to conflicting interests as well.

</comment><comment><USER15> I am starting to wonder how many breaches there have actually been of Google user data, they are so secretive and insular it wouldn't surprise me in the least if it has happened multiple times and was covered up.

In the future, as these mega corporations become even larger and more powerful, brave employees who are willing to violate NDAs are the only source of info we will have at all.

</comment><comment><USER16> If that account is true, this definitively has some "smell" to it...

</comment><comment><USER17> > _To make it clear: I'm not after fame, credits, or want to take some bounty > away from @girlswhocode!_

Why mention them then, if not to pressure them into refunding the donation?

<comment><USER18> I assume to call them out. If someone pulls a dick move once and gets away with it. They will do it again. If they get called out they will think twice next time.

<comment><USER17> The charity had nothing to do with this. They didn't choose to be the recipients of a 'stolen' bounty.

<comment><USER18> I'm not sure where I mentioned charity?

I wrote an assumption based on what i read in the article.</comment></comment></comment></comment>


Show HN: Graze – Modern Content Management - <AUTHOR> http://graze.site <comment><AUTHOR> I wanted a CMS that doesn't impose anything on me.

I wanted a CMS that will perform like statically generated sites but won't penalise me in any way.

Apparently, I wanted a lot.

And then I met GraphCMS.

I fiddled with Razzle a bit as well.

When I figured out the kinks and quirks, I made Graze.

It's a CMS-less CMS. Server-side Rendering for front-end components. It has hot-module reloading and all the bells and whistles you'd want from a zero- configuration setup (don't thank me for that, it's all Razzle here).

And it just works™.

Let me know what you think.</comment>


Compare European Amazon prices - <AUTHOR> http://www.curiua.com/ Amazon currently has five shops in Europe (UK/DE/IT/FR/SP) with different prices. Due to free trade in the EU, it sometime really pays to check all stores before buying Amazon goods. <comment><USER2> Interesting concept but,

1\. It seems to fail silently for searches it cannot find, making you doubt whether it works at all or something wrong with your web browser.

2\. If you are going to make it such a heavily scripting dependent site, then why not add price comparison on the rollovers or some other way to see prices immediately following a search?

3\. It does not seem to work with Internet Explorer 8 or old Firefox browsers (3.6.* generation).

</comment><comment><USER3> This is a GREAT idea. We need more tools like that in Europe.</comment>