A Hard Lesson from Motown: They Will Steal Your Pension - <AUTHOR> http://www.newsweek.com/hard-lesson-motown-they-will-steal-your-pension-210401 <comment><USER2> The fun question - where did the money go? We actually know part of the answer - _to the pensioners_.

The pension plans were funded based on a certain average rate of return. Whenever the yearly rate of return exceeded this amount, pensioners and workers received a "13th paycheck". Whenever the rate of return was below the average, they didn't.

[http://www.mlive.com/news/detroit/index.ssf/2013/10/10_thing...](http://www.mlive.com/news/detroit/index.ssf/2013/10/10_things_to_know_about_detroi.html)

Either the politicians involved were utterly innumerate, or else they were rewarding their cronies (i.e. pensioners) in the hopes of receiving votes. They made their bed, let them lie in it.

<comment><USER3> But you can't change that. That will actively destroy lives :

      "Of all the nonpension payments, she said, 54 percent went
      to active workers, 14 percent went to retirees and 32
      percent went to the city, which used its share to lower
      its annual contributions to the fund. The excess payments
      were often made near the end of the year, when recipients
      needed money for the holidays, or to heat their homes."

      "It would be a human catastrophe of the first order if
      pensions of vulnerable older workers can be cut whenever a
      local government goes to bankruptcy court," Stein said.
      "We will be consigning firemen and policemen, who did
      nothing wrong other than protecting the city and depending
      on the city's promise, into old-age poverty."

Firstly, the government agreed (in law) to cover this. It is not acceptable for the government to go back on that promise - whatever it takes. Sucks if you're a US taxpayer I guess.

If you're a US taxpayer, either you or your parents (indirectly) agreed to these conditions. It's dishonest going back on them. I'm not a socialist at all, but this is repayment of debt incurred : it's NOT optional.

Having read in history how unions react when their members essentially have the choice between death or getting what they want ... you don't want to go there. They will completely disable the entire country, and frankly, they'd be right to do so.

<comment><USER2> It was not acceptable for the Detroit Government to do what they already did. Now it's done and the money ran out. All that remains to do is divide what little money remains between the various debtholders.

(Normally bankruptcy also wipes out shareholders and turns debtholders into shareholders, but it's not clear what that would mean in this case.)

I've never been to Detroit, I've never voted there and I'm not sure I could find it on a map. I'm a complete stranger. It's unacceptable to force complete strangers like myself to pay insane debts that they didn't even have the opportunity to vote against, particularly when the debtholders _were already paid_.

No one will die in the US simply by having their pensions cut. They'll simply have to accept the same standard of living as most non-workers which is roughly the _average_ standard of living in Poland and Mexico and the 95'th percentile of India. Last I checked the Polish, Mexicans and Indians weren't dying off.

</comment></comment></comment><comment><USER4> _pensions are simply deferred wages, that is, money that workers could have taken as cash in their regular paychecks had they not opted to set it aside._

That is not always the case. Often times in the public sector, pensions have undefined amounts (e.g. set to increase based on an annualized basis), and undefined terms (lifetime of the employee).

So here is another question. Knowing that the city was under dire financial straits, what business did the city have making new hires and promising them impossible compensation, that would result in passing the buck to the next generation?

<comment><USER5> I don't know how your private sector works, but it is perfectly natural for private pension funds in other parts of the world to offer those kinds of plans. You can exchange cash now for an insurance against living longer than you can otherwise afford. Normally, there's then governmental oversight that tries to ensure, that you can be sure, that the pension fund can actually deliver on their promise.

<comment><USER2> We have this in the US as well. ERISA and similar laws are the specific regulation. After ERISA and the like were passed, companies generally transitioned from defined benefit to defined contribution pensions since defined benefit pensions were too expensive when honestly accounted for.

Government agencies (except for the USPS) are exempt from these regulations.

</comment></comment></comment><comment><USER6> This article is pretty much devoid of facts. Nothing's being taken away. Pensions were promised that couldn't be delivered. Reality is simply being enforced. Corruption was (and is) endemic in Detroit.

[http://money.cnn.com/2013/08/28/news/economy/detroit- pension...](http://money.cnn.com/2013/08/28/news/economy/detroit- pensions/index.html)

<comment><USER7> Yes, "steal" is definitely the wrong word here. Being unable to pay a debt due to bankruptcy is not theft. If it were, there would be lots of people in prison for not being able to pay their credit card bills.

<comment><USER3> That's absolutely true, it's called fraud. Agreeing to terms you know you can't live up to.

I wonder if one could do that, sue the old politicians for the difference, given that they did not honestly account for the pensions. This has the advantage of falling under criminal law, so firstly, doing that as part of an organization is not going to protect the individual that did it. Secondly if they get convicted and don't (or can't) pay, they will go to prison.

</comment></comment></comment><comment><USER8> Karl Denninger has pointed out [1] that these pension benefits that were cut as a result of the bankruptcy were effectively negotiated "at gunpoint and by fraud," and there was no true adversarial process in the negotiations, since the people negotiating for the wages and benefits _could and did_ elect the people on the other side of the table. _That alone_ should render the pensions unenforceable.

However, the judge _had_ to rule that the pensions were not enforceable, Michigan's constitution notwithstanding, because bankruptcy is black-letter Federal law. [2] The pensions are debts like any other, and pensioners have to get in line with all the other creditors.

Anyone with a government pension had better pay attention, and, as the saying goes, "conduct yourselves accordingly."

[1] - [http://www.market-ticker.org/akcs-www?post=226468](http://www.market- ticker.org/akcs-www?post=226468)

[2] - U.S. Constitution, Article I, Section 8, clause 4 - [http://www.usconstitution.net/xconst_A1Sec8.html](http://www.usconstitution.net/xconst_A1Sec8.html)

</comment><comment><USER9> Classic case of the short-sightedness that is endemic in our economy. Management argues for larger pension benefits at the expense of salary increases. Who cares if they aren't realistic long-term? The bottom-line is that they look awesome at the end of the year and get fat bonuses. Of course they leave before the sh*t hits the fan, and the workers who traded those raises for later get shafted when these giant pools of money fail to materialize or were poorly managed.

</comment><comment><USER10> I think the fate of the pensions is the saddest part of the Detroit bankruptcy. Here are the five options that are possible:

[http://www.freep.com/article/20131203/NEWS01/312030138/](http://www.freep.com/article/20131203/NEWS01/312030138/)

The most telling comments were those of the bankruptcy judge who implored why wasn't this done ten years ago? Sure would have been much easier on the retirees if it had been.

</comment><comment><USER11> to anybody who knows terms like "3@55" and "spiking" and various other details of union contracts like unlimited accumulation of vacation and unused sick days, it isn't a surprise. While i don't know about Detroit, yet if they had anything similar as mentioned below without CA's economy to carry it [not that CA economy will be able to carry it in the long run as well :)], well...

[http://www.sacbee.com/2013/09/09/5718823/california- public-p...](http://www.sacbee.com/2013/09/09/5718823/california-public- pension-payouts.html)

" The average retirement payout for new retirees in California's biggest public pension system doubled between 1999 and 2012, according to CalPERS data, and initial monthly payments for one group nearly tripled in that period.

State and local cops and firefighters benefited the most.

In the 14 years covered by the data analyzed by The Sacramento Bee, average first-month pensions to state police and firefighters went from $1,770 to $4,978. California Highway Patrol officers' first-month retirement payments doubled from $3,633 to $7,418, and local government safety employees' pensions went from $3,296 to $6,867. "

</comment><comment><USER12> I was smart and invested in Social Security. Oh yeah... crap.

<comment><USER13> You can squeeze a few thousand retired civil servants, but you can't squeeze all of America. The only solution to an impending Social Security crisis is "monetary easing".

<comment><USER4> which, of course will screw the rich by draining the stock markets and making institutional lenders poorer.

</comment></comment></comment><comment><USER14> As a younger professional, I see more and more cases where the system is stacked against me and dysfunctional.

I wonder everyday; why would anyone in their right mind become invested in this system?</comment>


Dashes vs. underscores - <AUTHOR> http://www.mattcutts.com/blog/dashes-vs-underscores/

<comment><USER2> Interestingly enough, the example from the post doesn't work anymore:

[http://www.google.com/search?hl=en&q=_maxint](http://www.google.com/search?hl=en&q=_maxint)

Gives "Showing results for MAXINT. Search instead for _MAXINT." Clicking on the second link still searches for MAXINT. You have to use +_MAXINT as the search query for the search to work (and it's not even case-sensitive).

Maybe Google treats underscores the same way as hyphens now that it's mainstream and the majority of people don't really care about the semantic distinction between the two? The post is 6 years old after all.

<comment><USER3> Google's precision has been going downhill. Even adding + isn't enough anymore. Try searching for the phrase "everything wrong" in quotes. Google will insist on including "everything's wrong" no matter how many + symbols you sprinkle around. If you exacerbate the problem with [["everything wrong" crossfade]] you get 36 thousand results to bing's accurate 64.

</comment></comment><comment><USER4> This article is interesting, but it's really old (2005). There has been discussion about it since then.

Here is an article from 2007 on Matt's blog: [http://www.mattcutts.com/blog/whitehat-seo-tips-for- bloggers...](http://www.mattcutts.com/blog/whitehat-seo-tips-for-bloggers/) It says, at that time, Google was looking into making underscores word separators.

Later, in 2009, Matt mentioned in a Google Webmaster Help video that he'd still recommend dashes if you can, but don't worry about it if underscores are working for you. They might still get around to making underscores separators: <http://www.youtube.com/watch?v=Q3SFVfDIS5k>

As of 6/20/2011, Google still recommended using Dashes in URLs here: [http://www.google.com/support/webmasters/bin/answer.py?answe...](http://www.google.com/support/webmasters/bin/answer.py?answer=76329)

</comment><comment><USER5> I wonder if this is still accurate. Google has changed a huge amount in the past 6 years. These days, I notice a lot of important punctuation (along with entire words, intentional spellings of words, etc) are ignored by Google in search strings.

<comment><USER6> Google will even ignore terms in quotation marks these days.

<comment><USER5> Google completely ignores single quotes, but strings enclosed in double quotes are searched for about as I'd expect.... minus the punctuation.

For instance, search for a phrase like

        'imag' leader

You get "Showing results for 'image' leader. Search instead for 'imag' leader."

Change them to double quotes, and it actually finds "imag". Google suggests "Did you mean: "image" leader", but does not automatically change the search as in the other instance.

However, search for something like "image.url", and it is the same as searching for "image url" (not imageurl). Google appears to replace the '.' with a space.

</comment></comment></comment><comment><USER6> The reason not to use underscores is because people don't understand them. I learned this the hard way back in the late nineties the first time I set up an email account for a business. I chose _yyy_ email@example.com instead of using a dash because of the connotations the underscore carried regarding computer programming conventions. Then I enjoyed the opportunity to explain over the phone exactly which key was required to correctly type our email address many many times. [Stylized conversation]

       It's an underscore not a dash
       Huh?
       It's the the same key as the dash, only hold shift.
       Huh?
       See the dash key?
       Yeh.
       Just hold shift when you press it.
       Huh?
       Do you have our fax number?

That's why you don't use underscores in a URL. Of course, today nobody uses dashes either if they can help it.

<comment><USER7> I remember seeing news broadcasters in the 90s that didn't know how to pronounce the '@' symbol. So while I find your story all too plausible, I have a hard time believing that people still don't know how to type an '_'.

<comment><USER6> How do most people underline text on the computer?

Outside of programming, how often do you use the underscore key?

<comment><USER7> I suggest that there are fewer people in this world that 1) know how to use a search engine, and 2) are incapable of examining their nice silkscreen printed keyboards, than you suspect. There is a world of difference between "uses it" and "capable of figuring out how to use it".

</comment></comment></comment></comment><comment><USER8> tl;dr:

dashes separate words, underscore is word character -- in common interpretation by, for example, Google Search.

When implementing any text search or matching, there's matter of what constitues word boundary. Obviously whitespace does, as do some punctuation; but exactly which punctuation should be considered word boundary? There is an document on the subject by Unicode Consortium: <http://www.unicode.org/reports/tr29/>

There is one important case where punctuation and whitespace do not constitue word boundary: the hyphen, as used for breaking word in hyphenation. In Unicode, U+2010 Hyphen, U+2011 Non-breaking hyphen and U+002D (Hyphen-minus, the usual `minus' character from keyboard, for backward compatibility with ASCII / ISO8859-*)

<comment><USER9> _Obviously whitespace does_

This has been the beginning of many hilarious conversations. (My first love was natural language processing. My second was Japanese, which treats every whitespace as a tragic waste of a place where you could have fit twenty three strokes.)

</comment></comment><comment><USER10> Article dated August 25th, 2005.

</comment><comment><USER11> I think the bigger problem is that most people don't know that dashes (or underscores) are even allowed in domain names. Thus we get domains like "penisland.com" for a company called Pen Island. Short of that kind of problem, multi-word names with no dashes are just hard to read.

So remember, the next time you go to register a multi-word domain name, use dashes!

<comment><USER12> Note that "penisland.net" (what you probably meant, since "penisland.com" redirects to something else) is a joke site making fun of the ambiguity in the name. And I personally don't find them harder to read, and they're easier to explain by mouth. I don't remember the last time I've seen dashes in a multi- word domain.

</comment></comment><comment><USER13> I guess Google didn't have any lisp programmers in the early days!

</comment><comment><USER14> There have been articles, on Google's Analytics-Support page(s), that have recommended otherwise or have made not that underscores are just the same. Some of those old links no longer work -- answer (id) expired, but the following still has language in support of underscores: [http://www.google.com/support/googleanalytics/bin/answer.py?...](http://www.google.com/support/googleanalytics/bin/answer.py?answer=66982)

</comment><comment><USER15> I was hoping this would be serious study on whether dash-style or underscore_style is better for variable names in code. Such a study would analyze readability, ease of typing, and any other relevant factors. Too bad this article isn't such a study, while the information it does impart is out- of-date.

<comment><USER16> Dashes in code variables seems pretty rare. Disallowed even in Python.

</comment></comment><comment><USER17> There's been massive advancements and updates since this was written in 2005 so don't expect this to be gospel.

</comment><comment><USER18> The answer is the article URL.

<comment><USER19> Which is in Matt Cutt's URL --> <http://www.mattcutts.com/blog/dashes-vs- underscores/> so the answer is dashes.</comment></comment>


The Ethical Non-Dilemma of Self Driving Cars - <AUTHOR> http://www.interpretiveauthority.com/theory/the-ethical-non-dilemma-of-self-driving-cars <comment><USER2> Interesting as something to explore, but I'm curious if a network of self- driving cars can be optimized to recognize and avoid these situations altogether.</comment>


Stop hitting your Invisible Wall. - <AUTHOR> http://www.47hats.com/2010/03/stop-hitting-your-invisible-wall/ <comment><USER2> _Why, when you know you should be motivated to [...] write the blog, do you sit there instead, with the motivation sucked out of you, reading Twitter?_

Haha, you wanted to make a timesink for others, but instead got sucked into one yourself! That's karma for ya.

</comment><comment><USER3> How important is writing a blog for the success of your startup? I wouldn't write a blog if the only reason I do it is to help my business.

The three things he lists, coding, networking and blogging all have to do with expressing your point of view. That is the motivating force behind your startup: your need to communicate the way you see the world.

<comment><USER4> "to communicate the way you see the world" --- and get paid for it, I might add.</comment></comment>


Show HN: Instantly pass your passwords securely - <AUTHOR> Hey HN!
I made a service to share passwords easy and secure but never promoted it.
It's called instapass.io I noticed that people besides my friends and clients actually started to use, so maybe it will be helpful for you too! You share one-time self-destruct message using one time links and I won't even be able to see what you wrote.
How does it work? When you generate a message the client-side makes a random password and use that to encrypt the message. The password is appended as an anchor tag which all modern browsers never send to the server. This way, I don't even know what you shared. Why this and not one of the fancy solutions that exist? Time and complexity. In my experience, people never get around to setup the services especially if you're a consultant like me.
And then comes the part of trying to explain to a non-technical person how a master password is and how to share it and signup etc. Instapass offers high security, zero setup time and works for non-developers.
Martin. <comment> mike-cardwell Don't forget to read all of the javascript loaded every time you use this website to verify that it hasn't had `$.get('?secret_msg=' \+ encodeURIComponent($('#id_text').val()))` or similar added to it.

Also, don't forget to let the recipient know to also read all of the javascript so that they can let you know if the plaintext was sent off to the provider the moment they open the link you sent them.

<comment><USER3> You not only have to trust the websites, you also need to trust your operating system, your web browser, and the web browser extensions. It's for example common for browsers to call home with anything you type/paste in the URL-bar. Both Chrome and Firefox did that last time I checked.

<comment><USER4> you forgot to mention you also need to trust the CPU, the motherboard among other hardware components, you also need to trust lack of cameras on the room you see the message among other physical eavesdropping.

<comment><USER5> You also have to trust yourself! Many people have given up their encrypted messages after having a few too many fermented malt beverages!

</comment></comment></comment></comment><comment><USER6> I'm sorry but this unfortunately is not a secure solution and should not be treated as such.

Either you are able to transmit the link via a secure channel, then you are able to transmit the message via this channel in the first place.

Logging might be something that can be circumvented with this service, but this instantly raises a second question: Why should users trust you versus any other service provider?

Please do not advertise this service as secure.

<comment><USER4> Yeah, in its current implementation it isn't secure, but if you added SRI checks for each CSS and SCRIPT link and then converted the site to a data:text/html link to be added to the user's bookmark bar it would be secure (in the sense that after auditing the code once you can be sure it cannot be changed)

<comment><USER7> I think the most important point is, that this solution requires a way to securely transmit the generated link. As described in another comment by @ryandvm this has two advantages over transmitting the password directly: 1\. It won't show up in logs or be otherwise accidentally stored. 2\. If the link expires after a single use you get security in the covert model. However, this comes with problems because some tools like virus scanners automatically hit links.

<comment><AUTHOR> Exactly exactly. I made sure to be resilient to Google bots/Virus Scanners by doing some fancy javascript tricks

</comment></comment></comment></comment><comment><USER8> This service is begging the question.

It encrypts a secret message by ... generating a random password and using symmetric encryption.

If only there was a way to safely pass the password that encrypts my password. Or should I recursively use this tool for the job?

<comment><USER9> One would hope something like Diffie-Hellman was used.

<comment><USER10> "one would hope" \- aspirational security!

</comment></comment></comment><comment><USER7> I don't understand the threat model here. The link needs almost the same kind of protection as the original password. The only difference is, that the link expires.

So how do you transmit those links securely and why didn't you use that for your passwords in the first place?

<comment><USER11> I think the key is that the message would be deleted by the server after ONE use. So... you send the link via whatever mechanism you want (Slack, SMS, email, etc.). If a man-in-the-middle intercepted it, they need to follow the link to decrypt it, thereby expiring the message. So if the recipient gets a dead link, then you know security has been compromised.

The main issues here are:

* You have to trust the client implementation to not surreptitiously record the one-time key (for both sender and receiver).

* You have to trust the site operator to actually expire the message after one use.

* Whatever secret you are transmitting MIGHT get intercepted, but at least you would know about it.

I briefly toyed with the idea of creating almost the exact same service - <USER2> down to using the URL hash to hide the secret. But at the end of the day, the concept has too many flaws for the security conscious and is too annoying to use for the layman.

</comment></comment><comment><USER12> [https://instapass.io/](https://instapass.io/)

<comment><AUTHOR> Thanks :)

</comment></comment><comment> Pirate-of-SV It's like yopass[1]?

[1] [https://github.com/jhaals/yopass](https://github.com/jhaals/yopass)

<comment><AUTHOR> Woaa yea very similar and even the name is similar. It didn't exist when I started the project. Looks nice.

</comment></comment><comment><AUTHOR> Hey guys, thanks for all the comments. I'll try to address them before I am going to bed.

How I use instapass.io is sending an email/slack/telegram/etc. with the password in instapass. This way your password isn't stored on a email/slack/etc.. server in clear text forever. It also makes it possible to see if an attacker opened the password and take appropriate action. There is a slim risk of an MIIM where you edit the link super fast and have control over messaging service. This is exactly what @johnmarcus wrote. If you don't trust my service then you can just keep the password in Instapass and the other login info (url to login, email, username, etc..) inside the email. How should I know what you sent a password to? I think that's a better choice than sending login info in clear text.

</comment><comment><USER13> [https://sharelock.io/](https://sharelock.io/) [https://github.com/auth0/sharelock](https://github.com/auth0/sharelock)

<comment><USER14> I'd like to hear HN's take on ShareLock. I think the service is ingenious; my only issues after using it for so long:

1) The 500 character limit

2) If you enter someone's Gmail, and it's actually one of their aliases, then they can't decrypt the message when they sign in.

<comment><USER7> I don't understand how this relates to the original post. ShareLock is not end-to-end encrypted.

<comment><USER14> It solves the issue of secret-sharing much better than any of the other proposed solutions here, including InstaPass. You can post the URL in a public channel with confidence, as even if an attacker accesses the URL, they have to verify themselves with their social identity to decrypt the data.

But yes, it's not end-to-end encrypted, so you're better off self-hosting your own instance of sharelock.

</comment></comment></comment></comment><comment><USER15> wrote an OSS `Dory` using golang, this for similar self-hosted use-case a while back

[https://github.com/abhishekkr/dory](https://github.com/abhishekkr/dory)

* this is a secret sharing service for masses, where you don't need to be authenticated at service to store and share secret

* anyone with access to service can upload a secret and share the token with people they wanna share it

* if accessed without an explicit retention parameter, the secret gets purged on first fetch

* if stored in cache mode, it self expires after a TTL if not accessed for that duration

* even service admin can't decipher a secret posted by any user

<comment><AUTHOR> Very nice. I love your Dory mascot!

</comment></comment><comment><USER16> Cool product.

Regarding paid service you write:

> If you already like this service, I am sure you will love the next version! > The next version will include paid features, but signing up now you will get > two months of premium features once they are ready. By signing up you also > accept I will send you occasional emails when new stuff happens, such as > premium features. I will never sell nor give your email to anyone, and I > will send 2 emails maximum per month.

Its unclear what I'm signing up for. Am I signing up for the service or newsletter? I would suggest you phrase it as notify me of version 2.0 or something similar.

<comment><AUTHOR> Thanks bko! You're signing up for newsletter and get's notified when there's a version 2.0 and also get 2 months paid.

Great suggestion, I'll rephrase it.

</comment></comment><comment><USER17> It seems like this is relying on the server to delete the message when accessed?

I made a pastebin years ago that does similar using an anchor tag for the key, except it doesn't guarantee deletion. [https://paste.sh](https://paste.sh)

I've been thinking about making it more secure using service workers (something like a service worker combined with resource signing, so it can be cached in browsers and people have to explicitly "upgrade" — along with the hash of the script shown, which can be verified with a reproducible build from a git revision hash).

<comment><AUTHOR> Yep. Right now I just override any message securely. I was thinking of doing something like having all the messages in memory and just wipe the memory there, but the problem with that approach is I can't tell people if it expired and thus you can't see if people eavesdrop.

Woa [https://paste.sh](https://paste.sh) is awesome. I love it. Super minimalistic. I wouldn't use it for sharing passwords, but using it for sharing notes and permanent things could be pretty nice. Right now I use Google Docs and hackmd, but they are not encrypting stuff. How does it work with multiple users online?

</comment></comment><comment><USER18> Pretty old idea. I'd go for compliance and tested [https://privnote.com/](https://privnote.com/)

<comment><AUTHOR> Didn't know it existed when I made [https://instapass.io](https://instapass.io) privnote looks nice and I would definitely use it before I made my own service. I am planning to add more features that hopefully will be useful for you guys.

</comment></comment><comment><USER19> What's wrong with this trusted-third-party type of services (where neither you nor service provider cannot _prove_ your data can't be used maliciously) is that people get used to them (because "time and complexity"). And then malicious actors start asking email on signup and harvesting passwords.

<comment><AUTHOR> I am not following, could you elaborate a bit more?

</comment></comment><comment><USER20> Since I have found, Keybase is my favorite for this kind of situations. [https://keybase.io](https://keybase.io)

<comment><AUTHOR> KeyBase seems nice but a total different usecase I would argue.

</comment></comment><comment><USER21> And why should we trust a closed-source service?

<comment><AUTHOR> All the encryption part is javascript and visible in the browser. Go nuts

</comment></comment><comment><USER22> You are sharing messages in fact with different timeouts.??

<comment><AUTHOR> Exactly. Either a message expires or it get's viewed.

</comment></comment><comment><USER23> What kind of client side encryption does this use?

<comment><USER8> It's just some symmetric encryption with a randomly generated key (in the hash of the generated url).

Meaning you now have to find a way to safely send this URL ... and you are right where you started. It's no safety at all.

<comment><USER24> not really true. You can send the link via slack. the person would then need to actually be listening to your slack messages in real time, which is a threat but a very minor one. What this protects against is the real password being visible in Slack logs and archive history for all to see.

so, it doesn't solve every problem, but it does solve most real problems.

</comment></comment></comment><comment><USER25> I recommend [https://nachricht.co](https://nachricht.co)

Pros: messages are deleted completely, messages are individually AES-256 encrypted, can only be decrypted with the generated link, the wehsite itself cannot read or decrypt messages, no ip logging, multiple languages, exists since 2014, PWA available

Cons: ads (but deactivatable)

<comment><USER26> The messages AREN'T encrypted, they are very much visible with web developer tools, sent in plain text in requests. Ads can easily read messages (so you need to trust Google and random Google Ads users to not read messages in addition to the website owner... which is lol, not happening). This website is dangerous snake oil.

That's not to say other websites like this are trustworthy (they aren't, JavaScript can change at any time), but this is blatantly non-trustworthy.

<comment><USER27> It always depends on who you want to hide these messages from. Of course, end- to-end encryption is more secure than pure server-side encryption. But do you really need end-to-end encryption for such a webtool? After all, all TCP packets are already encrypted via TLS. The advantage of these web tools is in the temporary storage without being able to restore these messages, not hyper secure NSA-proof messaging.</comment></comment></comment>


Doubling down on stress: launching a startup while going through a divorce - <AUTHOR> http://heartofdorkness.com/2014/05/03/doubling-down-on-stress-launching-a-startup-while-going-through-a-divorce/

<comment><USER2> I feel like a breakup with a long term girlfriend is bad enough, let alone a breakup with a wife and kids. I've learned through all my strife that you have to learn to love the toughness to get you through it. Learn to love the strength. Crumbling and feeling sorry for yourself is a slippery slope and will only make things worse.

<comment><AUTHOR> Working on this startup was a way for me to reclaim my identity, to redefine who I was. It was very therapeutic, and hey, one of the great things about programming is that you get to feel in control, right?

</comment></comment><comment><USER3> Two years of nights and weekends and the divorce was all her fault?

<comment><AUTHOR> Yes.

<comment><USER4> Some things (whether they be true or not), should be kept to yourself. You can make your point about stress without bringing in the guilt of your ex (when she cannot defend herself)

<comment><AUTHOR> Couldn't agree more, which is what makes what I said ironic.</comment></comment></comment></comment>


This App Helps Users Detect ATM Skimmers - <AUTHOR> http://www.nextgov.com/mobile/2017/10/app-helps-users-detect-atm-skimmers/141439/ <comment><USER2> So i can find a skimmer like this, reverse engineer its connectivity and use the thieves own tools for my gain?</comment>


The U.S. women's team leaves the stage as a new kind of American role model - <AUTHOR> https://www.newyorker.com/sports/sporting-scene/world-cup-2019-the-us-womens-team-wins-and-leaves-the-stage-as-a-new-kind-of-american-role-model <comment><USER2> From the New Yorker:

> they offer an alternative to the nationalism of men who claim a monopoly on > the meaning of country and flag

From an opinion piece in The Globe and Mail titled "Two toxic legacies of Women's World Cup: Hatred of VAR and loathing of Team U.S.A."

> See, it's never just about results; it's about what the public extrapolates > and the U.S. team seems starkly ignorant of this fact. That's odd, since > most of the players are university educated. What they don't get is how the > rest of the world sees them. When the team is dominant and arrogant about > it, some people see the frightening, imperious military muscle of the United > States embodied in the team's strutting invincibility. That kind of > deduction is human nature.

> When the rest of the world looks at the smug behaviour and declarative, > narcissistic goal celebrations of U.S. players, it sees a U.S. need to > humiliate others. It sees more than childish brattiness; it sees a lack of > compassion. It thinks of migrant children separated from their families and > put in cages. No player goes to the World Cup emotionally equipped for > humiliation, but that's what the U.S. sets out to do – humiliate others and > sneer.</comment>


Why the Juju Charm Store Will Change the Way You Use Ubuntu Server - <AUTHOR> http://www.jorgecastro.org/2012/04/03/the-juju-charm-store-will-change-the-way-you-use-ubuntu-server/

<comment><USER2> Ok, so this is a system for deploying an appliance type setup on your server possibly comprised of several packages?

This would certainly be useful to me. Earlier this week I attempted to setup of a Linux mailserver from scratch using postfix,dovecot,spamassasin,clamav,sasl etc.

Wow, what a pain in the ass that was, trying to get all the pieces to talk to each other correctly and trying to think of possible security holes.

Most of the help online was either lengthy manuals that were pretty difficult to digest or somebody posting a tutorial basically saying "run these commands and paste this into your config".

Not really ideal.

What I really want to do is:

sudo apt-get install a-working-mail-server-with-sensible-defaults

<comment><USER3> I'm not looking forward to setting up my first Linux mail server next week. Any tips for a fellow noob? There's so much information and so many guides out there I don't know where to begin.

Debain/Ubuntu have a tasksel for a mail server but I haven't tried it yet. (<https://help.ubuntu.com/community/Tasksel>) > sudo tasksel install mail- server

I plan on trying some other semi-automated installers like iRedMail (<http://www.iredmail.org/>) in a VM first.

<comment><USER4> Advice from a long-time sysadmin? Don't.

Use Sendgrid, MailGun, or some other managed email provider and let them deal with the headaches of running mail servers. It's seriously not an industry you want to try and understand or deal with. Setup an account, pay the service usage fees, and know that you're saving yourself a lot of headaches.

All of these services now have good APIs, callback hooks, and statistics to help you track the behavior of your mail traffic without having to write your own parsing pipeline.

Trade money for time when appropriate. Believe me that the time involved to deploy, run, secure, and maintain a flexible and stable mail infrastructure really isn't worth the time better used building a good application.

</comment></comment></comment><comment><USER5> For those that were asking about real systems built with Go.

Canonical used Go to build the backend for the Juju Charm Store: [https://plus.google.com/107994348420168435683/posts/fdMcwvCq...](https://plus.google.com/107994348420168435683/posts/fdMcwvCqX4D)

</comment><comment><USER6> This bloody rocks with devil's horns.

Seriously, just the other day I had to install package A from source but first I had to install repo B to download it and install language X to install it as that was what the build script used. The guys who I manage are probably sick of me threatening to write something exactly like juju.

I'm going to investigate juju further but if juju can determine the path of least build dependencies that would also be great i.e. if there are two build scripts, one bash and the other language X, it chooses bash as you do not have language X installed.

It would also help if each project offered a link to a tar of their latest stable version so wget could be used instead of repo B.

I like using the systems tools first before installing other tools.

</comment><comment><USER7> A few questions maybe some of you already know. What's the "instance" that is spun up...an LXC container? Also, is this only for Server or will also be available on the desktop Ubuntu? Cloud only or is this also for local use?

<comment><USER8> Containers spun up depend on the provider, so if you deploy to Amazon it's going to spin up an AWS instance. However, if you're deploying to an Open Stack provider it all depends on the Open Stack configuration. Juju doesn't quite care what the provider does with regards to virtualization software.

However, for development you can setup a "local" provider ([http://askubuntu.com/questions/65359/how-do-i-configure- juju...](http://askubuntu.com/questions/65359/how-do-i-configure-juju-for- local-usage)) and deploy to your own machine using LXC. This makes development quick and affordable and makes it easy to test drive Juju without needing to use a cloud provider.

</comment></comment><comment><USER9> I can't understand what is this exactly for. It's a collection of scripts that let you easily develop you'r web applications in the cloud ?

Like, it helps you set up a Heroku or Google App Engine Application ?

Also, can I use it in another distro/Ubuntu desktop ?

<comment><USER8> It's more service orchestration. So it's a collection of charms to deploy services in to the cloud. Heroku and Google App Engine are more PaaS Platform as a Service, Juju more designed to deploy to Cloud providers like Amazon, Open Stack, and bare metal.

As for different distros Ubuntu is the only distro that Juju has been tested on, though Juju is all Python so it likely wouldn't take much to port and maintain Juju to other Linux distributions. As for the charms most all are reliant on apt-get so Charms for different distributions that used other package management software, then charms would need to be updated to use those instead.

</comment></comment><comment><USER10> A package manager whose packages are all install scripts that depend on packages from explicitly-specified repositories for a lower-level package manager. Somehow I feel like this must have been tried already before -- maybe in the RPM side of the tracks, or zero-install, or klik?

<comment><USER8> This does more than just package installation, it operates at a higher level. A service may require several packages that need to be installed, configured, then configured to work with each other. All of that is captured in a charm giving you a way to easily deploy a service. So capture your start to finish setup for any service you use in a charm and you can no deploy, and scale that service, using Juju.

<comment><USER11> All of which is possible by creating a package for existing package managers. It's how I tend to manage services: I build packages that depend on the other packages I need, and that uses post-install hooks to orchestrate the connections between various services, or replaces config files.

The level of support for cleanly handling things like replacing config files vary between package managers, but I've done this easily enough with both dpkg and rpm.

<comment><USER8> Sure, you can use dpkg to orchestrate connections between services on the same machine, but last I checked dpkg isn't aware of other machines running other services and orchestrating the connections between those. Service orchestration between machines is something Juju excels at. It's really server and service orchestration abstracted so that you don't have to worry about what machine is where and connected to who. Juju maintains those relations for you, so it's really more like apt for the cloud.

</comment></comment></comment></comment><comment><USER12> And then some people just use no-nonsense packaging systems. Like ArchLinux's pacman.

I bet you can write a PKGBUILD for, lets say, zookeeper, including the config _you_ want faster than it takes to deploy juju (which will use the configs _it_ wants)

<comment><USER13> I fear you didn't read the article, does pacman autoprovision the OS on the cloud for you and deploy it so the service is ready to use?

We're not talking about installing packages on your computer, we're talking about deploying services on a cloud.

<comment><USER14> I didn't get that till you mentioned it. Article talks about deploying to a cloud, but no details. I think the packaging of apt is great, but I don't understand how the cloud deployment fits in.

<comment><USER13> So pretend it's like apt, but for the cloud.

Instead of deploying a lamp server onto one machine you deploy the service you want to your datacenter. This can either be EC2, your openstack cloud, or local machines.

Let's say you want to deploy a scaleable mediawiki at work:

        juju deploy haproxy
        juju deploy mediawiki
        juju deploy mysql
        juju add-relation haproxy mediawiki
        juju add-relation mysql mediawiki

And then you have a load balancer, a mediawiki instance, and a mysql instance. You point your DNS to the haproxy instance, and you're ready to go.

2 months later your wiki becomes way popular. Since you're on the cloud you're totally elastic, so you can go "juju add-unit mediawiki" and you've got another mediawiki node load balancing. Or do "juju add-unit n=10 mediawiki" and have 10 nodes ready to go.

If you're on AWS, each of those deploys fires up an instance. Same on OpenStack. If you're on bare metal the Ubuntu orchestra server on your network will turn on machines and install/provision them to do the equivalent.

<comment><USER15> What does "add-relation" do, in terms of what happens on the machine? Do different charms need to be coded with explicit relation types?

Like could I simply switch postgres for mysql in your example and have it work, or does mediawiki specifically need a relation to a mysql?

<comment><USER8> Charms require different interfaces, so it depends on the charm. In this case mediawiki has two interfaces, a db (via MySQL) and a db-slave (for MySQL Slave configuration). When you add relations hooks fire on both charms, MySQL creates a username, password, database, and all other basic tasks to make a database work for an application, then passes that information to the mediawiki installation. From there Mediawiki charm db-relation hook fires to make sure Media wiki has all of this information in the right configuration files, install the basic MySQL structure for mediawiki, and several other tasks needed to make sure Mediawiki is installed.

On the flip side, adding a relation to haproxy, additional hooks fire in each charm. Mediawiki tells haproxy the address and port it's running on and haproxy hooks take care to ensure it's in the loadbalancer configuration.

What's excellent about these relationships is as you scale mediawiki to meet demand (juju add-unit mediawiki) all of this relation data stays in tact. So each additional unit will automatically fire the proper db hooks and loadbalancer hooks making sure every unit is setup exactly like the previous (in the case of MySQL, they'll be sharing the same MySQL database but it will skip re-installing the db for every unit) and HAProxy will loadbalance between each unit.

Same happens when you juju remote-unit mediawiki all the relavent hooks fire and each unit is removed from HAProxy.

</comment></comment></comment></comment></comment></comment><comment><USER16> Seems like this a popular idea lately! People striving for simplicity can only be a good thing. Also check out <https://github.com/j2labs/quickness> (from the guy who made the equally interesting brubeck python framework).

</comment><comment><USER17> Awesome. And not a moment too soon! It's been a bummer trying to get the latest application versions via PPA and other methods.

</comment><comment><USER18> I want something like this that is compatible with OSX and Ubuntu somehow.

<comment><USER19> Juju is written entirely in python (though a rewrite in Go is underway). In theory it will work fine on OS X, but there are a couple of challenges to making that happen:

* Juju is python, but links to the python zookeeper bindings which are C, so one needs something like homebrew to install Zookeeper. * Juju does sometimes make assumptions about Ubuntu specific stuff. We need some brave OS X users to try it out start reporting bugs so we can find out where these are and build tests around it (A good start would be if somebody wanted to donate an OS X machine to run the test suite on).</comment></comment>


A botnet is taken down in an operation by Microsoft, not the government - <AUTHOR> https://www.nytimes.com/2020/03/10/us/politics/microsoft-botnets-malware.html <comment><USER2> I'm glad this is getting coverage, but this is nothing new to Microsoft- they've been doing this for almost a decade (see for example [https://www.zeuslegalnotice.com/](https://www.zeuslegalnotice.com/)). DCU has a great reputation and they're doing great work ( _in conjunction with_ law enforcement and legal authorities) to make life better for all of us on the Internet.

</comment><comment><USER3> "Not the government" ooooh. As if AV vendors have been completely idle on that front.

I just find this article very fitting as Microsoft is right now running an ad campaign on reddit for their security services.

</comment><comment><USER4> [https://archive.md/Mbiy0](https://archive.md/Mbiy0)

</comment><comment><USER5> I remember when some of the earlier botnets I was exposed to used IRC networks and private/hidden channels to provide command/control interfaces to the bots/zombies/clients. In a lot of cases, the control mechanism had no redundancy (set to one specific network and/or server and channel).

People passed around lots of executables during those days (naively trusting sources/friends) which usually had additional side-loading mechanisms for the bot (sometimes from an HTTP request, sometimes FTP).

Used to grab these modified executables for plugins/game extensions/etc, sandbox them, and identify the control IRC networks, channels, passwords and have the networks shutdown the channels which essentially killed the botnet from further use.

I imagine most the clients are far more resilient and sophisticated these days. I think the largest botnet I identified and 'shut down' (obviously with help from IRC network admins) had around a million clients on separate networks.

Most of these were pushed on smaller relatively unknown/unpopular IRC networks where the admins somehow didn't notice tens of thousands of clients sitting idle on their network.

It was always a bit enjoyable to pop in one of the private password protected control channels and start a conversation, catching someone completely off guard who didn't expect anyone to find their little control interface. I imagine most these were built off a known library which wasn't too sophisticated. Most people were humorously surprised.

</comment><comment><USER6> This is the norm for Microsoft... it's the exception when governments lend their help.

</comment><comment><USER7> The article was devoid of any technical details... what exactly were they doing to "take down" the domains? Were the domains hosted on Azure? Were they given permission by ICANN to modify the DNS? I want details!

<comment><USER8> I don't know about this one specifically, but in the past, they've taken advantage of the fact that a lot of these scams claim to be Windows tech support and the like. With a creative application of US trademark laws, which allow manufacturers to seize counterfeit goods, they got a court order allowing them to seize the domains and computers hosting the "counterfeit" Microsoft websites.

</comment></comment><comment><USER9> Makes sense that a company that provides an operating system for billions of devices around the world takes some responsibility for any criminal actions taken on others that use said operating systems' potential exploits/bugs to harm other financially/personally/etc... Really cool to see an article written about it though. Makes you think that Microsoft are the good guys :P

<comment><USER10> Regardless if size,companies are not law enforcers. MS is also not responisble for the OS it has already sold to customers, that OS is not their property or concern outside of patches (fixing what they broke before sales).

I hate this idea of corporate heroes,next thing they'll let them do offensive operations (hack the hackers without any due process or authority).

<comment><USER11> Technically MS _does_ own the OS, the end user is just granted a license to _use_ it. They do however not own the hardware it runs on, so there _should_ be limits on what they can do, I agree that the idea that they can act as law enforcement without limits is chilling.

<comment><USER12> There are limits. The article describes them waiting on a federal court order giving them authority to execute their plan.

<comment><USER13> I also understand that they control what amounts to a substantial private police force. Which is exactly what government must do, not Microsoft

</comment></comment></comment></comment></comment><comment><USER14> Haven't they been doing this for years?

</comment><comment><USER15> eight years in the making? six million domain names? (how does one even address/disable/send requests to registrars for that many?) Big operation on both ends. Yikes.

</comment><comment><USER16> The present tense of the headline is so weird. Is this an NYT thing?

<comment><USER17> I love that style of writing. Neal Stephenson used it in his earlier work to great effect.

</comment></comment><comment><USER18> why is this surprising? because they are cleaning up a mess of their own making instead of making taxpayers foot the bill?

<comment><USER19> Exactly how is this Microsoft's fault?

<comment><USER18> they produce software that is vulnerable to exploitation by criminals

<comment><USER19> Human beings write code that is imperfect because people are human beings

I don't think it's particularly fair to make it out like Microsoft intentionally writes vulnerable software

<comment><USER18> i'm not saying they do it intentionally. i am saying that they should deal with the consequences and not let taxpayers take the downside while they take the upside

<comment><USER20> funny... so about those 1billion android devices that are no longer offered security updates.

I guess Google should be taking responsibility there as well?

<comment><USER18> yes, exactly! you get it.</comment></comment></comment></comment></comment></comment></comment>


Tips for using Priority Inbox - <AUTHOR> http://gmailblog.blogspot.com/2010/09/5-tips-for-using-priority-inbox.html <comment><USER2> So how are google deciding which emails are important? That's the only new thing with this Priority Inbox - you've been able to do this for some time with filters and multiple inbox (labs feature).

I want to explicitly filter things that are important to me. Even this article recommends that. Feels like Priority Inbox is just nice packaging/marketing on the multiple inbox feature + auto-filtering on your friends.</comment>


RNNs in TensorFlow: Practical Guide and Undocumented Features - <AUTHOR> http://www.wildml.com/2016/08/rnns-in-tensorflow-a-practical-guide-and-undocumented-features/ <comment><USER2> Related - does anyone know of a super basic, from-the-ground up example of RNNs with TensorFlow? Even this is a little more advanced when it comes to RNNs (and I've personally found that the official TensorFlow documentation on RNNs/LSTMs is a little spare in terms of how the official example actually works).

<comment><USER3> I tried to use TF to train an RNN recently and ended up using Keras, which is a layer on top of TF/Theano that made it much simpler, and I hear Theano's RNN implementation is better atm anyway.

This is the most straight forward TF example I could find, but it uses google's skflow library: [https://github.com/tensorflow/tensorflow/blob/master/tensorf...](https://github.com/tensorflow/tensorflow/blob/master/tensorflow/examples/skflow/text_classification.py)

One of the things I realized when trying to improve my Keras model is that Keras seems to have a lot of good defaults, so it's easier to get something working quickly, and then dig into all the options, rather than having to start from scratch.

<comment><USER4> I agree Keras is the easiest way to get into RNNs and deep learning in general.

<comment><USER5> I would like to start digging into Neural Tensor Networks, will Keras be also a good choice?

<comment><USER3> I'm not familiar with Neural Tensor Networks, so I'm not super sure. From the bit of reading I did, it seems like they're related to recursive neural networks somehow.

I couldn't find any implementations of either concept on top of Keras, so I probably wouldn't recommend it.

Your best bet is probably to find an existing implementation and study it in whatever language/framework it's in.

Depending on how related recursive neural networks are, I found a few implementations of those in theano, etc, and I'd probably suggest starting there.

If they're not super related, Keras may be a good option, since the learning curve isn't very steep to get started, but you'll probably have to assemble the architecture yourself and since it's an abstraction it will really depend on how easily NTNs can be expressed in that abstraction.

</comment></comment></comment></comment></comment><comment><USER6> If anyone is interested in RNNs for Java and Scala, we've documented them here: [http://deeplearning4j.org/usingrnns](http://deeplearning4j.org/usingrnns)

</comment><comment><USER7> Are there any tutorials on generative RNN's? Or is that a trivial task once you know how to implement an RNN?</comment>


Different Mobile Features - Same KPI's - <AUTHOR> http://twitchtv.github.com/blog/2012/07/03/mobile-analytics/

<comment><USER2> Interesting. This is in line with Fred Wilson's recent post.

[http://www.avc.com/a_vc/2012/07/mobile-is-where-the- growth-i...](http://www.avc.com/a_vc/2012/07/mobile-is-where-the-growth- is.html)

People see the phone as the application. Individual apps on the home screen are the features.</comment>


Bitcoin turning into a multi-layered system is most interesting thing in crypto - <AUTHOR> http://berk.es/2018/02/09/bitcoin-turning-into-a-multi-layered-system-is-the-most-interesting-thing-in-crypto-in-2018/ <comment><USER2> _We should note, though, that a layered architecture was not envisioned by the inventor and early adopters of Bitcoin. They envisioned it more as a monolith: a single piece of software that handles all the possible use-cases and features in itself. At least, that is how I read the whitepaper: no-where was there a mention of "Application layers" or even "layers"._

Many envisioned a layered system, including Satoshi himself:

 _Piling every proof-of-work quorum system in the world into one dataset doesn 't scale._

[https://bitcointalk.org/index.php?topic=1790.msg28917#msg289...](https://bitcointalk.org/index.php?topic=1790.msg28917#msg28917)

In this response (which revolves around the nascent Namecoin idea), he also describes cross-chain trades, something only now being implemented at scale.

In another post, Satoshi describes "high frequency trades" in which intermediate transactions between parties are discarded. This feature was present in the original version of Bitcoin, but was later disabled. It is being brought back in a sense through Lightning Network.

</comment><comment><USER3> Great article, great analogy. There are many interesting applications being built (distribution applications), but distinguishing them from the _application layer_ is an important point. Bitcoin Lightning and Ethereum's version of it (raiden network) are better compared to an application layer, whereas a particular Dapp is more like a particular application powered by that layer. And so far, many of these applications have been hindered by the lack of such a layer, up until 2018 when I think it will see mainnet usage.

</comment><comment><USER4> Saying that the Lighting Network is the most interesting thing in crypto is like saying IPv6 on IPv4 tunneling is the most interesting thing in networking.

No no no

You know what's instead the most interesting thing for building on top of crypto? More people using crypto for _various_ purposes, whether it's for running programs (ETH), private transactions (Monero/zcash), or name lookup (Namecoins).

<comment><USER5> People have been using bitcoin for various purposes for a while now, it's nothing new.

Lightning is seeming like a viable options as it grows ever larger, additionally most of the new development in privacy is happening in Bitcoin. Very cool stuff.

<comment><USER4> And LN is nothing new- it just allows people to transact ...cheaper and faster. Okay that's cool, but that's not a new goal; That's the original goal of Bitcoin

As for adding new functionalities into Bitcoin, the creator of Ethereum originally wanted to build Smart Contract on Bitcoin but was rebuffed by Bitcoin developers. Ditto for Zcash. Bitcoin developers don't have a good track record of incorporating new functionalities into the Bitcoin protocol...

<comment><USER3> You're missing the point of the article. A particular smart contract, or zk- snarks, or a new Bitcoin protocol functionality... these are not application layers, they are a particular application. Lightning is an application layer that enables a whole new set of applications.

And this is groundbreaking stuff, you can't expect it to have been released in Bitcoin's original 2009 client.

</comment></comment></comment></comment><comment><USER6> This is also one reason why bitcoin price went up too too much [https://www.coingecko.com/en/price_charts/bitcoin/usd](https://www.coingecko.com/en/price_charts/bitcoin/usd)

The expectation for a proper scaling solution to open up bigger possibilities. Ofcourses privided this is best course of action against bigger blocks only

</comment><comment><USER7> I also found Evan Duffield's post about on-chain scaling ([https://medium.com/@eduffield222/how-to-enabling-on-chain- sc...](https://medium.com/@eduffield222/how-to-enabling-on-chain- scaling-2ffab5997f8b)) pretty interesting.

</comment><comment><USER8> Where this analogy falls apart is when it becomes slower and more expensive to use the lower layers than the higher ones.

</comment><comment><USER9> The political angle is more interesting to me, since the Lightning Network is developed by Blockstream, whose investors include:

Reid Hoffman, Khosla Ventures and Real Ventures, Nicolas Berggruen, Crypto Currency Partners, Future\Perfect Ventures, Danny Hillis, Eric Schmidt's Innovation Endeavors, Max Levchin, Mosaic Ventures, Ray Ozzie, Ribbit Capital, Jerry Yang's AME Cloud Ventures, Horizons Ventures, AXA Strategic Ventures, and Digital Garage.

Think again, if you REALLY still think Bitcoin (core) is "decentralized".

(For the record, I don't think Bcash is either).

<comment><USER10> Lightning Network is not "developed by Blockstream". There are 3 primary teams that have contributed to the specification: ACINQ, Blockstream, and Lightning Labs. All of the projects are open source and have outside contributors.</comment></comment>


Ask HN: Cross platform alternatives to Google Inbox client? - <AUTHOR> While migrating away from gmail servers is one matter, the main thing keeping me on Google's service is Inbox. It's quite simply revolutionised the way I deal with my mail, and I can't really come to terms with using a traditional mail client again.
If I were to switch to some IMAP-providing alternative to gmail servers, is there a frontend product I can use that gives me an Inbox-like experience on the frontend? My requirements are:
* Bundling of newsletters with no notifications, pinning * Snoozing * Undo send (delayed sending) * Good search * Cross platform
Nice to have:
* Open source * Notification sync * Attachment preview <comment><USER2> I think Postbox ([https://www.postbox-inc.com](https://www.postbox-inc.com)) has all of the features that you're looking for; Mailspring ([https://getmailspring.com](https://getmailspring.com)) has most.</comment>


Meetup CEO Points To Booming Growth As His Company Hits 100 Million RSVPs - <AUTHOR> http://www.forbes.com/sites/alexkantrowitz/2013/04/23/meetup-ceo-points-to-booming-growth-as-his-company-hits-100-million-rsvps/

<comment><USER2> Meetup is a really solid service. I've used it for many years now, and increasingly so. The activities/in-person focus makes it a much stronger and stickier social network than most.

Also, there's a critical-mass issue that explains why it's built up gradually. Lots of Meetup groups are purely "hookups" or "networking," but the really good ones tend to exist as long tail niches.

</comment><comment><USER3> Meetup is on the very short list of services used regularly by an elderly friend who got her first computer (an iPad) less than 2 years ago.</comment>


Slack is making its in-app search less awful – The Verge - <AUTHOR> https://www.theverge.com/2018/7/10/17554332/slack-in-app-search-better-improvements-suggested-filtering <comment><USER2> I find this interesting, because while the search is not ideal, I consider it the reason I enjoy Slack over the other IRC-like offerings - in addition to lurking on 50 (!) channels for my job, I have a personal slack for my family to communicate and another for a class I teach. The search is a key feature allowing me to connect the "I vaguely recall something..." to usable information (and info on who to contact for more details)</comment>


Could OCR conquer the calligraphylion? - <AUTHOR> http://wordaligned.org/articles/calligraphylion

<comment><USER2> That picture of a lion is definitely not a picture of a lion, no-sirree.

You can do the same sort of thing with roman letters making them pretty impervious to OCR too. Arabic does appear to be designed more as an art form than as a script though.

edit:typo</comment>


Analysis of all YouTube trending videos in US for 2019 - <AUTHOR> https://ammar-alyousfi.com/2020/youtube-trending-videos-analysis-2019-us <comment><USER2> I find it kind of sad looking at what popular Youtube channels looked like 5-10+ years ago, and comparing it to their videos today.

As you scroll down the list of videos from oldest to newest, the lengths get longer. No longer are there any petty three minutes or five minute videos, let alone a one minute video. Now videos are all 10-25 minutes, the perfect length for maximum ad revenue.

Similar things happen to the thumbnails, which start containing more and more exaggerated, sometimes creepily-so, faces, reacting to absurd images that last for a fraction of a second in the video. The titles change too, becoming more and more outrageous, begging for you to click on them and spend hours watching anticipatory and 'exciting' content.

A lot of things have gotten better too, of course, and the amount of content that is available is amazing. But I do really miss when it felt like a place where people went to share videos and socialize, rather than where all the popular channels are ran like companies that follow the same clickbait format news organizations now also follow.

<comment><USER3> > Similar things happen to the thumbnails, which start containing more and > more exaggerated, sometimes creepily-so, faces, reacting to absurd images > that last for a fraction of a second in the video.

There was a nice little examination of this phenomenon, dubbed YouTube Face, a couple of years ago.

Article: [https://openspace.sfmoma.org/2018/04/your-pretty-face-is- goi...](https://openspace.sfmoma.org/2018/04/your-pretty-face-is-going-to- sell/)

HN thread: [https://news.ycombinator.com/item?id=16803937](https://news.ycombinator.com/item?id=16803937)

<comment><USER4> In Japan so much of mainstream prime time TV programming is reactions videos. Often people reacting to food from another prefecture with a minimum of two picture-in-picture heads reach the to the video.

My wife is addicted to YouTube videos / YouTubers and I think there's a high degree of similarity.

This content feels low quality and cheap to produce.

I think that article captures this phenomenon well.

</comment></comment></comment><comment><USER5> Another excellent analysis of what Trends on YouTube [0]

"Is the trending tab rigged against creators? Is late night dominating the charts? Why does it feel your favorite controversial creator never trends. All of that and more, in the first ever data-driven look at the trending tab."

What 40,000 Videos Tell Us About The Trending Tab:

[0] [https://www.youtube.com/watch?v=fDqBeXJ8Zx8](https://www.youtube.com/watch?v=fDqBeXJ8Zx8)

<comment><AUTHOR> I like that. Excellent storytelling, inspiring. Thank you for sharing.

</comment></comment><comment><USER6> This is really great - and kudos for providing methodological details and code! I love seeing this kind of large-scale descriptive research, it's a real bummer that YouTube is starting to close up access to their API. We did a similar kind of analysis looking at videos posted by popular channels last year, including some analysis of keywords that boosted views - figure you might find it interesting (and I'd love to see if our findings hold up with your dataset!) [https://www.pewresearch.org/internet/2019/07/25/a-week-in- th...](https://www.pewresearch.org/internet/2019/07/25/a-week-in-the-life-of- popular-youtube-channels/)

<comment><AUTHOR> Thank you.. The analysis you've done seems really interesting and gave me some more ideas to implement in future analyses.

For keywords that boost views, I'll run a similar analysis on my data and report the results to you here in another comment. Probably this weekend.

And I just heard from you that YouTube is starting to close up access to their API. I visit YT API website from time to time but haven't noticed such a thing. It's really a bummer. They should be more open not the opposite. Do you have some source if I want to know more about that?

<comment><USER6> Would love to see what you come up with, will stay tuned!

As for the API restrictions, they aren't advertising it but about a year ago they started warning users about forthcoming extensive audits to maintain access, and about six months ago they started reducing access for API keys if you stopped maxing them out for a day or more. Our last API key got shut down for good a couple of weeks ago. We're going to try to fill out the form and get our access reinstated, but I'm not sure how willing they'll be to allow access for research. The form seems intended for client-facing apps. But who knows - Facebook/CrowdTangle/Twitter have been very supportive of legitimate research initiatives, I'm hoping YouTube follows that trend!

<comment><USER6> To clarify - the current API has a limit of 10,000 "query points" per day for new API keys (most endpoints cost 1-5 points per query). It used to be 1 million; they've since throttled everyone down and started forcing audits. 10k is still something, but it certainly doesn't allow large scale research.

<comment><USER7> It used to be 50 million, it used to be 500000% more. I would have expected it to increase as bandwidth got cheaper yet it for whatever reason has decreased.

[https://stackoverflow.com/questions/15568405/youtube-api- lim...](https://stackoverflow.com/questions/15568405/youtube-api-limitations)

<comment><AUTHOR> Wow. That makes me sad and suspicious. Why would they close themselves to this degree? From 50 million to 10,000!

</comment></comment></comment></comment></comment></comment><comment><USER8> This is a lot of work for a lot of practically meaningless results. These are only examples: The urls and social links in the descriptions. The "the" in the titles. The other findings offer very little insight. Be popular, post videos.

</comment><comment><USER9> My web archival group (nonprofit) has international trending data for the same period. I've been meaning to get around to analysis for a while. This article is a good point of reference.

<comment><AUTHOR> Glad it helped. If possible, could you share your analysis results with us after you finish?

</comment></comment><comment><USER10> > The minimum number of views a video had when it first became trending was > 53,796 views.

How does that happen?

<comment><AUTHOR> There is a video that had only 53,796 views on the day it became trending. That video is "Phora - Don't Change [Official Music Video]". If you look at the data, you find that it became trending on the same day it was published. So before accumulating a large number of views, it became trending. Maybe it acquired thousands of views very quickly which sent it to the trending list? Maybe other factor.

<comment><USER11> Probably easily done if the publisher has a large fanbase and uses other social media channels to send them all to Youtube the moment the video is published.

</comment></comment></comment><comment><USER12> I do wonder what would be the results for other countries - like in the EU zone (it would be interesting, moreover, to see if / what are the differences between denmark, germany, italian etc.. youtube trending videos)

<comment><AUTHOR> I have the same data for Canada, Denmark, UK, Malaysia, and other 13 countries. I plan to analyze this data soon. So stay tuned.

</comment></comment><comment><USER13> From my understanding any channels you subscribe to with new content/video have a good chance to appear there. This is for the generic viewer.

</comment><comment><USER14> Cool analysis but I don't think any interesting conclusions came from it.</comment>


Functional architecture is Ports and Adapters (2016) - <AUTHOR> http://blog.ploeh.dk/2016/03/18/functional-architecture-is-ports-and-adapters/ <comment><USER2> Interestingly, if you rewrite the function with a more general type such as

        checkCapacity' :: forall f. Functor f => Int -> (ZonedTime -> f Int) -> Reservation -> f (Either Error Reservation)

you can guarantee that any effects in the final result only come from the function you supplied to it, i.e. checkCapacity' cannot add any effects of its own(Also, it can only "run" the function exactly once).

The type of the arguments of checkCapacity' are also a strict generalisation of the arguments to

        checkCapacity :: Int -> (ZonedTime -> IO Int) -> Reservation -> Either Error Reservation

meaning that any valid arguments to checkCapacity are valid for checkCapacity' as well.

<comment><USER3> I think you must mean

        checkCapacity :: Int -> (ZonedTime -> IO Int) -> Reservation -> IO (Either Error Reservation)

</comment></comment><comment><USER4> Interesting that the foray into Haskell led him to pass in a _value_ rather than a function ... which is exactly what "Functional Core, Imperative Shell" proposes.

(Functional Core, Imperative Shell is often linked with Hexagonal / Onion / Ports and Adapters. It is a bit more opinionated about using values as boundaries I believe ... and I think it is right).

EDIT: TFA is a good article, worth reading.

<comment><USER5> functional core & imperative shell / haxagonal / onion / ports & adapters / DDD I really can't figure out the commonality of these metaphors

<comment><USER6> At it's core all of these things are pretty much new names and some constraints on existing architectural patterns like service/service interface (facade), layered design, and service agent/service. They tend to be a bit divisive in that traditional layers, for example (presentation/business/data) is seen as a constraint, and layers in onion have no constraint. Detractors of hexagonal architetcure suggest it implies no more than 6 ports and adaptors, and so on.

Ultimately none of these patterns matter. The design philosophy that underlies them (separation of concerns, for example) does. It's something that becomes self-evident as you progress from junior to senior and beyond. We as an industry seem to love telling each other how our way is the one true way.

</comment></comment></comment><comment><USER7> My Haskell is a bit rusty, but I think the Haskell example could improve A LOT by using monad transformers or a free monad?

<comment><USER8> Wouldn't that make it harder to directly translate back to F# which is his goal?

I understood the only purpose of writing the Haskell was didactic, and to improve his F# code. It seems that moving further from constructs in F# would work against this.

<comment><USER7> I think that computation expressions would allow him to do the same in F#?</comment></comment></comment>


Data USA: explore, map, compare, and download U.S. data - <AUTHOR> https://datausa.io/ <comment><AUTHOR> I'm finding this data fascinating. For example, here is the "Software developers":

[https://datausa.io/profile/soc/software-developers- applicati...](https://datausa.io/profile/soc/software-developers-applications- systems-software)

A few points that struck me:

\- income is a lot more evenly distributed than the US average.

\- "Video tape & disk rental" is by far the highest paying sector. I guess that is all down to Netflix? "Taxi and limousine service" is in 4th place. That's Uber and Lyft?

<comment><USER2> Good eye. I have heard that Netflix pays particularly well, so that would make sense. Also I suppose if you worked on Hulu or any other online streaming platform it wouldn't fall in the same category so I wonder what other companies would fall under that category.

Finally, how do they derive those categories? NAICS codes?

<comment><USER3> It looks like BLS categories (they list BLS as a source too):

[https://www.bls.gov/oes/current/oes_nat.htm#15-0000](https://www.bls.gov/oes/current/oes_nat.htm#15-0000)

</comment></comment></comment><comment><USER4> FYI, this is not a USA government web site, it is run by Deloitte and is republishing public domain US government data under an AGPLv3 license.

</comment><comment><USER5> There's also [https://datachile.io](https://datachile.io), a sister site built by the same team

</comment><comment><USER6> Is it possible to get some of the data for personal projects? I'm not seeing and option to get data by csv (or anything really).

Curious to know if it's possible. I'm learning more about data viz this year and areas where you can get data easily is a God send.

<comment><USER7> All of the data sets are listed here:

[https://datausa.io/about/datasets/](https://datausa.io/about/datasets/)

You should probably also check out the federal data catalog at:

[https://data.gov](https://data.gov)

</comment></comment><comment><USER8> The site loads super fast - definitely a plus these days.

</comment><comment><USER9> Is there any site like this for environment related data - pollution, air quality, water quality etc?

<comment><USER10> It's not as nice as this, but Climate.gov has decent data

[https://www.climate.gov/maps-data/datasets](https://www.climate.gov/maps- data/datasets)

<comment><USER10> And AirNow is the EPA's site, there are datasets and real time APIs

[https://www.airnow.gov/](https://www.airnow.gov/)</comment></comment></comment>


At the Battle of the Codecs, Answers on AV1, HEVC, and VP9 - <AUTHOR> http://www.streamingmedia.com/Articles/Editorial/Featured-Articles/At-the-Battle-of-the-Codecs-Answers-on-AV1-HEVC-and-VP9-128213.aspx <comment><USER2> This looks like a cry of MPEG "we are not dead yet".

Discussing the viability of a codec that is still 2 years out and throwing a comparison like that in the mix seems dishonest. Also every "graph" drawn is deceptive and seems clearly biased in favor of vvc (the most obvious one is "decoder install base" and "ecosystem adoption" where vvc didn't score 0)

But I will be happy as long as we have a good competition in the codec space.

</comment><comment><USER3> The speed of encoding AV1 seems to have increased 60-fold in a fairly short period of time. If it doubles in speed again then it's within the speed range that Netflix said they'd start using it for real (4-10x slower than VP9).

Would be interesting to read about what went into that speedup.</comment>


Ask HN: What novels feature realistic computing? - <AUTHOR> We've all come across the hacker who is programming a worm in a time race with the three letter agency trying to trace their phone call. Or the descriptions of state of the art UIs that sound like a reject from a high-school UX module. Or computing as far-future brain-jacked retina-implanted VR mumbo-jumbo.
But are there good programmers or technical folks in novels too? Are there storylines that give you the sense that the author knows what he's talking about?
Any recommendations? <comment><USER2> _A Deepness in the Sky_ has some pretty good moments (not surprising since Vinge is a CS professor).

</comment><comment><USER3> Adolescence of P-1 - oldie, but goodie</comment>


How periscope onboards new users - <AUTHOR> http://www.useronboard.com/how-periscope-onboards-new-users/

<comment><USER2> Hi all! I'm the person who did this teardown. If anyone would like to fire some questions or critiques my way, I will be watching this thread like a hawk.

</comment><comment><USER2> @mxstbr Thank you very much for posting this here!</comment>


We've Gotta Stop Using "Lifestyle Business" as a Pejorative - <AUTHOR> https://sparktoro.com/blog/weve-gotta-stop-using-lifestyle-business-as-a-pejorative/ <comment><USER2> The term is pejorative in the world of venture capital and means little outside of it. It's pejorative because in the world of VC investing, a lifestyle business is not win-win. The founders get something good and the VC's get "nothing:" unsustainable returns and no recycling of founders into a new business. At it's core, the VC model of investment tries to align investor and founder interests by using equity value growth as the vehicle for returns.

The downside of lifestyle businesses is that investments are made on the basis of cashflows. And these are inherently adversarial. Returns for the investors come at the expense of founders and vice versa. This means there is always the potential to struggle for control. Investors in lifestyle businesses are not inclined to write off an investment. They are likely to seek control when payment isn't made.

Investments in lifestyle businesses follow ordinary investment logic. The advantage of VC is that it does not. None of which is to say that one is better than the other as a matter of general principle. Only to observe that ordinary investment strategies tend to be adversarial at their core.

</comment><comment><USER3> I think people that believe in and run lifestyle businesses like the fact that it's a bit counter-culture. Not sure we need to do anything about that and if we do, will it lead to ruining what's great about it by popularizing it?</comment>


How Burmese Elephants Helped Defeat the Japanese in World War II - <AUTHOR> http://news.nationalgeographic.com/news/2014/09/140928-burma-elephant-teak-kipling-japan-world-war-ngbooktalk/

<comment><USER2> There's an excellent radio adaptation of the "elephant stairway" story from the book here: [http://snapjudgment.org/bandoola](http://snapjudgment.org/bandoola)</comment>


Show HN: Serverless Apps with Node and Claudia.js Book - <AUTHOR> https://www.manning.com/books/serverless-apps-with-node-and-claudiajs <comment><AUTHOR> Serverless Apps with Node and Claudia.js walks you through building serverless apps on AWS using JavaScript. Inside, you'll create a full project designed to help you understand and apply general serverless design principles and concepts. Along the way, you'll also discover what Claudia brings to the table.</comment>


Arrow of time no longer double-ended - <AUTHOR> http://arstechnica.com/science/news/2009/08/arrow-of-time-no-longer-double-ended.ars <comment><USER2> There is much debate about the arrow time. (Related disciplines are thermodynamics, statistical physics, quantum mechanics, gravity, inflation, so it gets technical.)

Here are some good papers, look them up at <http://arxiv.org>

Hollands and Wald. An Alternative to Inflation. arXiv (2002) vol. gr-qc

Wald. The Arrow of Time and the Initial Conditions of the Universe. arXiv (2005) vol. gr-qc

Kofman et al. Inflationary Theory and Alternative Cosmology. arXiv (2002) vol. hep-th

Carroll. Is Our Universe Natural?. arXiv (2005) vol. hep-th

Carroll and Chen. Spontaneous Inflation and the Origin of the Arrow of Time. arXiv (2004) vol. hep-th

Lebowitz. Boltzmann's Entropy and Time's Arrow. Physics Today (1993) pp. 1-7

Wallace. Gravity, Entropy, and Cosmology: In Search of Clarity. arXiv (2009) vol. cond-mat.stat-mech

Maccone. A quantum solution to the arrow-of-time dilemma. arXiv (2008) vol. quant-ph

</comment><comment><USER3> That certainly explains why we never observe entropy running exactly backwards, but there are conceivable pathways that could result in entropy running backwards into a less entropic state. For instance, put two gasses of equal density into a container, where one gas is on top and one is on the bottom, separated by a sheet of glass. Remove the sheet of glass. The gasses mix. Now, entropy could run backwards for no known reason, and re-order the gasses, but in the other direction; the top gas now separated on the bottom, the bottom gas on the top.

This argument, while essentially correct IMHO, doesn't seem to cover the entire state space of what backwards-running entropy could do. But it's still an interesting argument.

<comment><USER4> Actually, statistical arguments explain why we don't observe (in macroscopic systems) entropy running backwards. Yes, the molecules could, through collisions, spontaneously re-order. But that is such an unlikely occurrence that it's probability of being observed (for a large number of molecules) is very near zero.

<comment><USER3> This paper, and my post in reply, is about a question deeper than that, namely, why doesn't _time itself_ run backwards sometimes, in essence? (That elides over some things, which unfortunately including the essence of the question, but there isn't a snappy English formulation of the problem that I know of.) Nothing seems to stop it, except inasmuch as it never happens so something clearly is.

What you're talking about is a foundation to that argument, but the argument itself is beyond that. While the physicist in question has hopefully considered the point I make, he _certainly_ knows about the statistical nature of entropy. However, while that is necessary knowledge, it is not sufficient to explain the other mysteries of entropy that this paper is about.

<comment><USER4> I understood what the article was saying, but it seems I didn't understand what you were saying. If I understand it now, you are saying that to prove his case he has to not only show that entropy can't directly decrease by, essentially, undoing the process and getting back to the original state, but he also has to show that entropy can't decrease by the system ending up in a state different from the first, but yet which is also of lower entropy? It seems to me that you are correct.

</comment></comment></comment></comment><comment><USER5> For anyone looking for a version of the article that you can download without a Physical Review account: <http://arxiv.org/abs/0802.0438>

</comment><comment><USER6> This actually is not a new result. See <http://www.flownet.com/ron/QM.pdf>, section 5.4.

</comment><comment><USER7> For some reason, this reminded me of OCaml's time travelling debugger.</comment>


The 3 types of developers you will find in Africa . - <AUTHOR> http://thiswas.codedinafrica.org/2011/01/01/the-3-types-of-developers-you-will-find-africa/

<comment><USER2> Somehow, comparisons involving murderous dictators are neither funny, nor very interesting.

</comment><comment><USER3> I've noticed these archetypes as well (in Texas), and its interesting to see that the US public schooling system, US college system, and even US pop culture / social norms aren't necessary for these to arise. they appear more universal in nature than I would have thought.

</comment><comment><USER4> Really interesting</comment>