Slow leak detected aboard Space Station - <AUTHOR> http://blogs.esa.int/alexander-gerst/2018/08/30/slow-leak-detected-aboard-space-station/ <comment><USER2> Apparently a 1.5mm puncture due to a meteor/debris strike in the Russian Soyuz MS-09 module.

More information:

[http://blogs.esa.int/alexander-gerst/2018/08/30/slow-leak- de...](http://blogs.esa.int/alexander-gerst/2018/08/30/slow-leak-detected- aboard-space-station/)

[https://twitter.com/RussianSpaceWeb?ref_src=twsrc%5Egoogle%7...](https://twitter.com/RussianSpaceWeb?ref_src=twsrc%5Egoogle%7Ctwcamp%5Eserp%7Ctwgr%5Eauthor)

[http://www.russianspaceweb.com/soyuz- ms-09.html#leak](http://www.russianspaceweb.com/soyuz-ms-09.html#leak)

<comment><USER3> How does it not happen more often?

<comment><USER4> Micrometeoroid impacts happen fairly regularly, but they're usually not energetic enough to make a hole. For example, there was a instance in 2012 where one hit a window: [http://www.spacesafetymagazine.com/space- debris/kessler-synd...](http://www.spacesafetymagazine.com/space- debris/kessler-syndrome/micrometeroid-hit-iss-cupola/)

But as that incident shows, such impacts are often relatively benign - in that case, they didn't even need to replace the outer layer window.

The hull is reinforced with four or five layers of shielding - the above article has a nice diagram: [https://i2.wp.com/www.spacesafetymagazine.com/wp- content/upl...](https://i2.wp.com/www.spacesafetymagazine.com/wp- content/uploads/2012/06/MMOD-typical-shields.jpg)

This means the usual consequence of a micrometeroid impact is pitting of the outer layers that may not even be noticed.

For larger objects that present a serious danger, the US Space Surveillance Network attempts to track them and predict "conjunctions" with a zone around the ISS which extends 2km above and below it, and 25 km in each direction on the orbital path. Anything that's expected to intersect with this zone is analyzed and may result in the station being moved to get out of the way. These are mostly due to space junk of human origin. In 2013, there were at least ~70 of these "conjunction notifications", although this results in only about one move of the station per year, on average.

There's a description of how these cases are handled at [https://arstechnica.com/science/2013/07/how-nasa-steers- the-...](https://arstechnica.com/science/2013/07/how-nasa-steers-the- international-space-station-around-space-junk/) :

> "Any object with between a 1-in-10,000 and 1-in-100,000 chance of colliding > with the station meets the "yellow" threshold. Flight rules say that the > station must be moved out of the way in response to a yellow threshold > object unless such a move results in a mission impact—"Like, if we do the > burn, we're going to miss an opportunity to launch a Soyuz, for instance," > explains Parris. "Do we delay the Soyuz, or do we do the maneuver?" A "red" > threshold is assigned to any collision with a likelihood of between 1 (in > other words, absolutely certain) and 1-in-10,000. Flight rules are more > strict for maneuvers in response to red threshold objects: the station is > always moved for a red threshold object, regardless of mission impact, > unless a maneuver represents more risk than not maneuvering (for example, if > there's a piece of equipment that's damaged on the ISS and a maneuver would > exacerbate that damage)."

This doesn't help in the case of meteor showers, where the Earth is travelling through a zone full of small debris, typically caused by the trail of a comet. In those cases, the station has to rely on its shielding, but the debris sizes in those cases are almost all within the limits that the shielding can handle.

<comment><USER5> Very informative post, thanks!

</comment></comment></comment></comment><comment><USER6> "The rate of the leak was slowed this morning through the temporary application of Kapton tape at the leak site."

In tape we trust!

I hope they show close ups!

<comment><USER7> >Kapton tape

Is that duck tape for spaceships?

<comment><USER8> Duct tape?

Or tape for ducks?

<comment><USER9> [https://mentalfloss.com/article/52151/it-duck-tape-or- duct-t...](https://mentalfloss.com/article/52151/it-duck-tape-or-duct-tape)

</comment></comment></comment></comment><comment><USER10> At 1.5mm, a piece of tape would come closer than you'd think to being a permanent fix...

The vacuum of space seems drastically hard to keep at bay, but consider that you're only holding in enough gas to replicate sea-level air pressure (nominally 14 PSI or so). A typical soda can is pressurized to between 30 and 50 PSI depending on temperature, beverage etc.

Supposedly the apollo command module had a pressure skin that was as thin as 0.012" (0.3mm) in places.

<comment><USER11> I did a bit of searching and found that the ISS, along with Soyuz, are kept at sea-level atmospheric pressure (14.7PSI). This is unlike pressurised aircraft, which usually operate slightly below sea-level pressure at flying altitude.

[https://en.wikipedia.org/wiki/Cabin_pressurization#Spacecraf...](https://en.wikipedia.org/wiki/Cabin_pressurization#Spacecraft)

</comment></comment><comment><USER12> How do you find it, once you register that there IS a leak? Will there be a draft towards the hole? Or do they use an outside IR camera?

<comment><USER13> It might whistle, perhaps ultrasonically.

It might produce a tiny little thrust.

<comment><USER14> Indeed they used an ultrasonic leak detector.

</comment></comment></comment><comment><USER15> I don't think they could fit another video or unrelated image in that article.

Are people posting content here just to get the ads traffic?

<comment><USER16> This is the official ESA website, they don't generate ad revenue AFAIK, or any revenue from their site directly.

<comment><USER17> The original url was at independent.co.uk, one of the UK's national newspapers.

</comment></comment></comment><comment><USER18> At 1.5mm dust could block that hole from the inside and _sufficiently large (epoxy) bandaid_ could patch it from the outside.

Edit, from twitter link, "... has been sealed temporarily by tape ..."

<comment><USER19> Interesting, I was thinking you could use the pressure differential to flow epoxy into the hole before sealing pressure to stop flow and heating to cure, but makes sense that an epoxy bandaid would probably do just as well - probably good enough to just slap that over the hole.

Will they apply to both inside and out? Will epoxy cure properly if totally exposed to the cold low pressure of space?

<comment><USER20> Epoxy can cure in a vacuum, as demonstrated by common fabrication procedures (sort of). The temperature isn't actually that big of a thing. Space is "cold" because there's no heat but also nothing to conduct it away. It actually gets quite hot if you're facing the sun as well. Long story short though, as long as there's no gas passing through the hole, it should stay around the internal temperature of the ISS or at least close enough to cure.

<comment><USER21> Maybe even hotter than inside, since the epoxy reaction is exothermic as it cures.

</comment></comment></comment></comment><comment><USER22> ISS Live Stream: [http://www.ustream.tv/channel/live-iss- stream](http://www.ustream.tv/channel/live-iss-stream)

<comment><USER23> How did they locate the hole?

</comment></comment><comment><USER24> Sounds like they needed an inanimate carbon rod!

<comment><USER25> This is a Simpsons reference but it also sounds like a variation of the "the Russians used a pencil" copypasta.

</comment></comment><comment><USER26> Has been fixed by now.

IF you have spare monitor going at your office/home, its fun to watch the ISS up to second tracking locations [1].

Fun fact I learned lately about ISS: at 400km above Earth's surface, the gravity is about 80% of a normal Earth gravity. The ISS is constantly falling down but because of Earth rotation it is falling "at the edge" so to speak so it never actually fell on the ground. Hope that make sense, I'm sure you read better explanation on Wiki.

[1] [http://www.esa.int/Our_Activities/Human_Spaceflight/Internat...](http://www.esa.int/Our_Activities/Human_Spaceflight/International_Space_Station/Where_is_the_International_Space_Station)

<comment><USER27> > _Fun fact I learned lately about ISS: at 400km above Earth 's surface, the > gravity is about 80% of a normal Earth gravity._

That doesn't seem to match the movies of ISS shown, where there seems to be no (or very small) gravity. In 80% of normal earth gravity water wouldnt stay up in the air for example, and cosmonauts wouldn't be floating around in the station as we see in the videos...

<comment><USER28> This is why we should use the term "free-fall", instead of "zero-gravity".

There is no way known to remove gravity. At best, you can cause the room to fall at the same rate as the things inside the room, causing the contents to float around.

It's the same principle that allows specialized airplanes to create the sensation of weightlessness, while very-much in almost Earth-surface gravity.

<comment><USER27> > _There is no way known to remove gravity_

Well, you can go far away from large masses to effectively diminish e.g. earth's gravity though, no?

> _It 's the same principle that allows specialized airplanes to create the > sensation of weightlessness, while very-much in almost Earth-surface > gravity._

Yes, but I was confused because space offers also regular diminished gravity, and we also have the example of the astronauts on the moon, where gravity was much much smaller.

But I should have guessed that at the height ISS is it's too little to actually reduce gravity at any substantial way, and it's all the effect of the orbit/free fall.

</comment></comment></comment></comment><comment><USER29> I wonder what the procedure to locate the leak was.

<comment><USER30> You spray soapy water all over the outside of the module and watch for any spots that start bubbling.

<comment><USER31> Nah, you spray soapy water all over the inside of the module and watch where it egresses.

</comment></comment></comment><comment><USER32> I've seen several of these "F-35 is a failure" articles over the past few years, and I have a new theory about it.

Making the opposition think you're weak is a strategy. Straight from Sun Tzu. Negative press propaganda is a tool in itself.

</comment><comment><USER33> Would the leak be enough to significantly change the trajectory of the station such that it needs correction?

Surely the force of the leak is very small compared to the size of the station, but if it had been leaking for a while the change could add up.

</comment><comment><USER34> I've heard that the whole construction up there has been getting leakier over time. I wonder what exactly the threshold is these days to constitute a "slow leak"...

<comment><USER35> Enough to register on sensors, not enough to trigger an immediate evacuation?

<comment><USER17> Even this 1.5mm hole was so small that they didn't bother to wake anyone up, and instead waited until the next workday.

</comment></comment></comment><comment><USER36> "the hole is covered using Alexander Gerst's finger for now" \- [https://www.reddit.com/r/space/comments/9bi49u/the_iss_is_cu...](https://www.reddit.com/r/space/comments/9bi49u/the_iss_is_currently_experiencing_a_slow/e535dlh/)

<comment><USER11> A rough calculation of how much it'd hurt (or not): Atmospheric pressure is 10.1N/cm^2, or 0.1N/mm^2. The hole is 2mm diameter, or ~3mm^2 in area, so the force over that area would be ~0.3N or roughly 30 grams.

It's not a lot of force. I'd be more worried about my skin sublimating, however.

<comment><USER37> I feel like they'll take a little anti-freezer burn over suffocation.

If only they had an inanimate carbon rod to block the hole!

<comment><USER38> Are they still taking duct tape up there with them?

[https://www.nasa.gov/image-feature/duct-tape-saves-the- day](https://www.nasa.gov/image-feature/duct-tape-saves-the-day)

<comment><USER37> Apparently they have already used kapton tape on the hole.

</comment></comment></comment></comment></comment><comment><USER39> Does this mean water is rushing into the space (water) craft?

</comment><comment><USER40> ...perhaps a layer of self assembling/repairing nanoskin?...

[https://www.sciencedirect.com/science/article/pii/S167265291...](https://www.sciencedirect.com/science/article/pii/S1672652911600280)

...or somthing similar

<comment><USER40> yup bad idea alright but i stick by it... maybe someone has a better or more germane solution than relying on an astronaut to find a leak and patch it up by hand, but the idea of preemptively mitigating leaks sounds better than waiting for a problem then correcting if it can be found...</comment></comment>


Live coverage of Dart Keynote at GOTO - <AUTHOR> http://dartinside.com/2011/live-from-dart-launch/

<comment><AUTHOR> Any other sources? There's a #dart channel on freenode and Google's Dart Team just updated their twitter feed <http://twitter.com/#!/dart_lang>.

<comment><USER2> HN: <http://news.ycombinator.com/item?id=3092558>

</comment></comment><comment><USER3> Seems that Dart has a lot of features of Java, such as types, classes, inheritance, and interfaces.</comment>


Blizzard is getting rid of the Battle.net name - <AUTHOR> http://www.theverge.com/2016/9/21/13005162/blizzard-battle-net-name-transition <comment><USER2> Don't think I will ever be able to use the new name without cringing "Blizzard Tech" just doesn't have the ring to it as "Battle Net"</comment>


The Plastic Bag Wars - <AUTHOR> http://www.rollingstone.com/politics/news/the-plastic-bag-wars-20110725

<comment><USER2> I'm not carrying a bag with me all the time when I'm out just in case I buy something and if it's more than six items well, I don't know how to juggle.

Someone needs to come up with a better plan other than an outright ban.

<comment><USER3> They have these things called "paper bags." I bet that might be an alternative to plastic ones.

Another option (mentioned in the article) is to not ban plastic bags but have a small fee for using one. This encourages people to bring their own bags but has a solution for when they don't, or when they end up buying more than they expected.

<comment><USER2> Paper bags seem to have disappeared in the 1960s, they've never been an option in my area just plastic, your own bag or juggle.

I don't think a fee is a deterrent and it could be abused by stores more interested in a different kind of green.

Whatever the solution some company will make money from it and put the blame on the customer.

<comment><USER3> I recall being asked "paper or plastic" in the early 1990s, and Trader Joe's is a modern chain which only has paper bags. San Francisco, as the article points out, banned plastic bags. It can't be that everyone brings their own bags to the store, so clearly the issue isn't that paper is impossible in your area, only that it's not available for you.

In my experience, the fee is a deterrent. I live in a city where plastic bags cost at a grocery store about 15 cents and I can say that I would rather the store not make the profit when I could remember to bring my own or juggle.

In any case, what's wrong with profit? Or if it's a problem, then would you feel better if there was legislation (as there is with some deposit fees) where the state keeps the excess money instead of the store?

The main issue is that the cost of production and sales of plastic bags does not match the cost of the environmental impact. This is similar to beverage deposits. US states with beverage deposit laws have something like 50% fewer cans and bottles found as trash compared with those that don't. The two choices then are either eliminate the source of the problem, or include cleanup costs as part of the sale price.

<comment><USER2> I figure it would be easier to make bags using plastic-like substances than paper bags, potato starch or genetically engineered bacteria oozing out some sort of bio-plastic.

The cloth bags sold to people must require a large amount of energy to make and if they are not very durable may be no better than plastic in energy usage i.e. carbon output.

<comment><USER3> Consider the full lifecycle costs. Energy required for production is easily captured in the final price. Waste CO2 emissions less so, but let's assume that some sort of so-called "carbon tax" or "carbon cap" is in place.

Paper, plastic, cloth, and so on have costs. Stores choose bags because of several factors: cost, ease of storage, ability to keep the bags in stock and available at the cashier's stand, and so on.

But none of these include the post-use disposal costs. The argument is that plastic bags are more egregious than other waste: the bags are light enough to be blown long distances, they clog machinery designed to remove waste, they are more visible, and so on.

In other words, the points you bring up, while true, are not the major reasons for plastic bag fees or bans.</comment></comment></comment></comment></comment></comment>


Show HN: Python Module Update Checker (WebApp) - <AUTHOR> Hi,
I have created small Python module update checker on my site as a learning exercise (gevent / threading ), which i think is good enough to be released in wild!
Just copy output of "pip freeze" and hit submit it should show if you are using latest version of python module available.
You can give it a try at,
https://ninadmhatre.com/apps/py_upd_checker
Feedback is welcome :)
Note: I didn't realize that links in text are plain text! Sorry for that... <comment><USER2> I like it. The blog site that hosts it has a slightly strange menu, when at 'home' there are three links 'Blog', 'Apps', and 'Contact', when at Apps, there appears to be only 'Blog' and 'Contact', when at 'Blog', there appears to only be 'Contact'.

But the actual app, is great. I like the output, but I would consider sorting them into those dependencies which are up to date and those which are not.

If you really want some extra user-friendlyness __and __learn a bit of the github API, that would be a cool way to accept input. Instead of copy &pasting the pip-freeze output, how about just your github repository link, you could then search for a requirements.txt (or similar), OR a first effort at this would be to allow users to link to a requirements.txt file, for example one hosted on github.

Finally, what about a spin-off pypi library to do this? I'd love to be able to do this from the command-line inside my project's directory.

<comment><AUTHOR> I need to fix the top header - make it consistent!

for sorting, i gave 2 button at the top which will show/hide upto date/older versions but i guess that makes sense to put older/mismatched versions on top!

requirements.txt from github, that`s an excellent suggestion will implement that.

Initially i thought of creating PyPi module and i created one but its python3 specific, i am yet to make it python2 compatible considering lot of users are still on py2.

BTW you can use POST query to get the output from command line in json format :)

@allanderek, thanks for all your suggestions!

<comment><USER2> You're welcome. Thanks for a useful site. Would you like some code review of the source code done? I'm not sure how much time I'll have in the near future, but I can try?</comment></comment></comment>


Augmented Reality for the Web - <AUTHOR> https://developers.google.com/web/updates/2018/06/ar-for-the-web <comment><USER2> This excites me! One step away from projecting holographic planes onto real world surfaces ;)</comment>


Portable Standing Laptop Desk? - <AUTHOR>

I'm not sure if anyone else hates sitting down all the time, but I really want to be able to stand while I'm working on my computer. However, is there anything that they sell to use on the go?
I would use something that could be put on top of a normal desk. But I can't seem to find anything that is really portable (fits in my bag)
Anyone know if something like this exists? <comment><USER2> I use an ikea-esque wire rack. The small square one is very portable and is fully capable of supporting my netbook, but I got the larger rectangular one that has enough room for a lamp and a mouse too. It also has enough space to support my forearms.

<comment><AUTHOR> Thanks for suggestion!</comment></comment>


CS Broke - <AUTHOR> http://bitworking.org/news/388/broke

<comment><USER2> Everyday application programming is not isomorphic to theoretical CS (TCS). TCS is not "broken". Do not blame the awkwardness of your coding experience on the _study of computation_. What we need is _more_ TCS when we hack.

</comment><comment><USER3> Computer Science ≠ Software Engineering</comment>


Whistle-Blower Complaint Sets Off a Battle Involving Trump - <AUTHOR> https://www.msn.com/en-us/news/politics/whistle-blower-s-complaint-is-said-to-involve-multiple-acts-by-trump/ar-AAHxDU9 <comment><AUTHOR> _looks_ like Ukraine was promised something (loans, arms, help with Russia?) if they investigated Biden family over some business. Pretty bad IMO, using the position and trust to ruin rivals.

[https://www.nytimes.com/2019/08/21/us/politics/giuliani- ukra...](https://www.nytimes.com/2019/08/21/us/politics/giuliani-ukraine.html)

[https://www.politico.com/story/2019/09/19/giuliani-biden- ukr...](https://www.politico.com/story/2019/09/19/giuliani-biden-ukraine- trump-1506009)

</comment><comment><USER2> Wouldn't you love it if you were paying for a NYT subscription only to find out they give away many of their articles for free on MSN?</comment>


Show HN: Daily Rate Calculator to check how many days you need to work - <AUTHOR> https://www.wisecashhq.com/goodies/bootstrapper-calculator

<comment><AUTHOR> This was done by Thibaut Barrère but I found it cool so I posted it here.</comment>


Ask HN: What is your source of motivation at work? - <AUTHOR> Looking for honest answers. <comment><USER2> Once at a particular job, I'm primarily motivated by wanting my coworkers/managers to think highly of me and want to fast track me for various things.

<comment><AUTHOR> Is it more like looking for respect?

</comment></comment><comment><USER3> Craftsman's pride. I am very proud of how my systems function and how flexible they are, especially compared to the state I inherited.</comment>


Thank you for using Google Reader. - <AUTHOR> http://kfury.com/thank-you-for-using-google-reader

<comment><USER2> Am I the only one who had fingers in ears regarding Google Reader death until this week?</comment>


U.S. judge says Uber withheld evidence, delays Waymo trial - <AUTHOR> https://www.reuters.com/article/us-alphabet-uber-ruling/u-s-judge-says-uber-withheld-evidence-delays-waymo-trial-idUSKBN1DS26X <comment><USER3> The trial seems to be ongoing right now, live tweets can be found here:

[https://twitter.com/CSaid](https://twitter.com/CSaid)

But this doesn't look good for Uber at all:

[https://twitter.com/CSaid/status/935558449324212230](https://twitter.com/CSaid/status/935558449324212230)

"Jacobs became aware that Uber thru Clark & Henley, had a sophisticated strategy to conceal, cover up or destroy docs w intent to impede govt investigations."

and

[https://twitter.com/CSaid/status/935569588309327878](https://twitter.com/CSaid/status/935569588309327878)

"Judge quotes Jacob's atty letter: Uber employees went to Pittsburgh to educate the AV group about ephemeral, encrypted communications "to prevent Uber's unlawful schemes from seeing the light of day""

I have seen people wonder on HN whether Uber gets flak due to their nature or are they inherently worse than other giants. While other companies are no saints the constant stream of stupid decisions makes it seem that Uber has (had?) a culture of always trying to find shady way of doing things.

<comment><USER4> I think that most companies have 'N-month email retention policies', where N is somewhere between 1-6.

Did the malfeasance happen more than a few months ago? Gee, sorry, no internal communications; that's policy. Did someone keep incriminating communications from more than a few months ago? Oooh, that's against policy - <USER2> recalcitrant employee has since been terminated and clearly does not represent our lofty ideals.

But I don't think that most companies go out of their way to use encrypted platforms to shield communications which they know are likely illegal from investigators.

<comment><USER5> structural engineers are required to keep all communications, notes, etc for seven to ten years, depending on the jurisdiction.

These super short email retention policies seem extremely unethical to me.

<comment><USER6> The Sony Pictures hack of 2014 caused a lot of companies to reflect on their data retention policies. Uber's special in that they set their retention policy to subvert criminal investigations, not to protect "trade secrets"

I agree about structural engineers being an ideal though--old school engineers get "accountability" better than anyone

</comment></comment></comment></comment><comment><USER7> okay someone tell me if i missed anything uber has done...

* trying to dredge up dirt on journalist for being negative towards the company.

* kalanik denies that an incident involving a uber driver choking a passenger ever happened.

* kalanik boasting that he should have called the company "boober" from all the women he gets

* offering customers rides with "hot chicks" in france.

* having a "god view" that employees used to spy on exes, politicians and celebrities. they paid a measly $20k fine and supposedly continue to still allow employees to use god view.

* kalanik took people out to a escort bar in south korea (on company dime)

* created a greyball program, to try and avoid authorities from getting a ride and hide their wrong doings from city officials

* had a high level uber executive go into india and get the medical records of a rape victim and held onto those records for no good reason. oh yeah he also showed those records to kalanik and another executive and wasn't fired on the spot for it. they literally didn't fire him after their initial "cleaning up" of the company until news outlets started sniffing around

* ignored california's dmv and started putting self-driving cars onto the road, one of which decided to run a red light. then tried to pass off the issue as, "human error"

* paid off hackers to delete user data. did not notify proper authorities

* sexual harassment / toxic workplace issues

\</comment><comment>--- and now \</comment><comment>---

* withholding evidence from a trial

* using ephemeral messages so they dont leave a paper trail

* allegedly denied areas from service by redlining them

<comment><USER8> It's the Trump strategy: do sleazy and illegal things at such a high rate that no one can keep up with the firehose. They know apologists will bamboozle the public by taking each instance in isolation and going "it's no big deal", and it works because no one has enough working memory to keep the whole picture in their head at once and be appropriately outraged enough.

</comment></comment><comment><USER9> Welp. Someone has committed perjury today. [https://twitter.com/kateconger/status/935584091990138881](https://twitter.com/kateconger/status/935584091990138881)

"Russo is on the stand now. He says that Jacobs' statement about recruiting inside sources at competitors is false."

</comment><comment><USER10> When did some of these of prominent tech people begin thinking that acting like psychopaths was the way to achieve business success?

<comment><USER11> When they successfully popularized the narrative of Founder-as-Ubermensch, as modern-day titans tirelessly hauling human progress forward.

And conversely, the narrative that those with grievance against startups or their actions are anti-progress, that opposition to a tech startup means you're either stupid or corrupt.

When you're operating under the notion that what you're doing will literally move the human race forward, it becomes very easy to rationalize things that don't pass a simple smell test. Surely a bit of minor illegality is acceptable when you're going to Change The World(tm)?

I for one am glad to see this lie finally being challenged en masse.

It's unclear to me still how much of Startup/Founder Mythology was intended for PR purposes, and how much did startup execs end up believing for themselves.

<comment><USER12> > It's unclear to me still how much of Startup/Founder Mythology was intended > for PR purposes, and how much did startup execs end up believing for > themselves.

Why choose? For a while, everyone who counted won - execs, investors, ibankers, even some of the workers, some of the time - when the rubes bought the line.

But eventually it starts causing problems - like when the rubes start actually expecting accountability. If you're the, ahem, ubermench, then you are also at fault when you screw up, as much as the Kalanicks of the world try to weasel, bully or deflect.

The sooner this bullshit dies, the sooner we can behave like a somewhat sane industry.

</comment></comment></comment><comment><USER13> I indulged in a bit of forward-fantasy, imagining an eventual death penalty for Uber.

The objection to a corporate death penalty is usually "but what about the employees?"

Well, what about them? The desk-workers are mostly in high demand, no problem.

And the drivers ... well, I see lots of Lyft and Uber stickers on the same cars. If there's no Uber in town, Uber users will likely use Lyft.

Is that an unseen danger for corporations in the "sharing" economy? Your employees are portable by definition?

This got me also thinking, why isn't there a two way auction for ride sharing, with companies competing to "sponsor" the ride, and drivers competing to drive the ride, and on the other side, customers competing to buy a ride. Or just cut out the Uber/Lyft middlemen and have independent drivers compete?

Is it too soon to "Fix Ride Sharing!"?

<comment><USER14> Real-time bidding for ride sharing would be pretty cool, across any number of services and independents. A regulatory mess for sure, but as we're seeing, the extant players already constitute a regulatory mess.

<comment><USER15> Exchanges for distributed bidding exist for financial securities. It's a bit of an IT hassle, but not an unsolved problem.

<comment><USER14> As it does for adtech which I was referring to. I'm sure it's part of Uber and related services as well, but it should be applied across services to create maximal competition.

</comment></comment></comment></comment><comment><USER16> Did I get this right ? They got the letter because some one from a 3rd company CC'ed Waymo instead of Uber on an email containing that letter (the one that 1. Claims Uber did some nasty things and 2. Uber didn't submit as evidence as if it didn't exists) ?

That's either one hell of a fuck up, or someone took as big a stand as they could

<comment><USER17> Judge Alsup got the letter because the US Attorney's office passed it along to him. I haven't seen anything about how the US Attorney obtained it, but presumably criminal prosecution and subpoenas provide a greater disincentive to lying than civil suits. Also, there were two parties who would have had this letter: Uber and the lawyer(s) who wrote the letter on behalf of the former Uber employee. Unlike Uber, those attorneys would have little incentive to be anything but transparent.

<comment><USER17> Oh, now we know how the USA got it: [https://twitter.com/kateconger/status/935912822478794752](https://twitter.com/kateconger/status/935912822478794752). Uber "voluntarily disclosed the Jacobs letter" because Jacobs threatened to involuntarily disclose it. However, Uber tried to hide it in this case (despite it/Jacobs mentioning Waymo); the USA gave it to Judge Alsup because he had initially recommended the case for criminal investigation and they thought he might find it relevant in his trial. At this point, Uber has lied so consistently it seems like they should forfeit their opportunity to offer testimony. I wonder if the judge will allow any of this to be brought up with the jury.

<comment><USER17> Only in @kateconger's replies[0], but it appears Alsup is still deciding whether he'll allow the Jacobs letter to be admitted as evidence for the jury. Excluding a letter alleging Uber stole Waymo trade secrets would be a big blow to Waymo. Especially one that Uber paid $7.5m to suppress. There isn't going to be a smoking gun, so Waymo has to make the case that Uber probably stole Waymo trade secrets because they've acted like they probably did.

[0]: [https://twitter.com/kateconger/status/935971693192818688](https://twitter.com/kateconger/status/935971693192818688)

<comment><USER17> I was joking about Alsup allowing Uber's pretrial malfeasance to be disclosed to the jury. But the quotes in this Ars Technica article[0] make me wonder. "My normal inclination is, let's decide the case on the merits but I've never seen a case where there are so many bad things like Uber has done." "It looks like you covered [the Jacobs letter] up, refused to turn it over to the lawyers that were most involved in the case, [and] to me, for reasons that are inexplicable." It sounds like Alsup is split on the Jacobs letter because he might be a "disgruntled employee who sees the handwriting on the wall". And he really wanted to know why Jacobs' lawyer got $3m for writing a letter. Alsup knows something doesn't smell right about the Jacobs settlement. If it is allowed...

[0]: [https://arstechnica.com/tech-policy/2017/11/waymo-asks- ubers...](https://arstechnica.com/tech-policy/2017/11/waymo-asks-ubers-top- lawyer-does-uber-pay-money-to-extortionists/)

</comment></comment></comment></comment></comment><comment><USER18> Is there a transcript available yet? I love Alsups no-nonsense attitude and reading those are always great entertainment. Not to mention it's a primary source :)

<comment><USER19> I'm pretty sure it's still going on (so no), both [https://twitter.com/kateconger](https://twitter.com/kateconger) and [https://twitter.com/CSaid](https://twitter.com/CSaid) are live tweeting.

<comment><USER17> Unfortunately, @CSaid mistakenly used Waymo instead of Uber in a few places, but she did have an interesting tidbit I haven't seen in any of the subsequent articles[0]: the former employee of Uber claimed that he was reprimanded in a performance review and then demoted for "not protecting more info from discovery." How is that not a huge deal?

[0]: [https://twitter.com/CSaid/status/935573560461967360](https://twitter.com/CSaid/status/935573560461967360)

<comment><USER19> Are you sure that that should say Uber and not Waymo?

Judging by the tweets around there it was Waymo's turn to speak, and it seems more likely Waymo would be quoting the letter than Uber.

I think it is a pretty big deal

<comment><USER17> I didn't say the tweet I referenced was one she was mistaken about. I said it had an interesting tidbit that I had not otherwise seen reported. For ones she got wrong, see [https://twitter.com/CSaid/status/935599952515837952](https://twitter.com/CSaid/status/935599952515837952) and [https://twitter.com/CSaid/status/935541698284863488](https://twitter.com/CSaid/status/935541698284863488). The judge was clearly upset at Uber's lawyers, not those of Waymo. Mistakes happen, but it made her stream more confusing than it should have been, because you had to think harder about each reference to either company. @KateConger's stream was much clearer, but she didn't mention the performance review testimony.

<comment><USER19> Ah your right, my mistake.

</comment></comment></comment></comment></comment></comment><comment><USER20> And Uber wants this trial to be heard by a jury? Are they stupid or they can't settle this out of court without Waymo owing their ass?

I mean almost weekly in the press the public hears about how horrible Uber is and is operated.

Maybe the jury will be all older ppl and those who don't have smartphones.

<comment><USER21> I think you're overestimating how much the general public cares about Uber. The scandals haven't negatively affected Uber financials, I doubt they will have an impact on the trial.

<comment><USER22> > haven't negatively affected Uber financials

SoftBank share purchase discounts Uber by 30%

[https://www.ft.com/content/2a2131e0-d3ef-11e7-a303-9060cb1e5...](https://www.ft.com/content/2a2131e0-d3ef-11e7-a303-9060cb1e5f44)

</comment></comment></comment><comment><USER23> It never fucking ends with this company, does it?

</comment><comment><USER24> White collar tech bros _will not hold up under investigation_. A ivy-league mba has way too much to lose to risk going to jail over some stock options. Doing this kind of dirt can only survive via staying under the radar-- somebody is gonna flip and this whole house of cards is gonna go down in a stampede of Uber employees rushing to drop the dime on each other.

<comment><USER25> This is a civil lawsuit. Why would anyone go to jail?

<comment><USER26> Evidence of criminal activities could become apparent during a civil trial, and lead to subsequent criminal charges.

Plus perjury, etc.

</comment></comment></comment><comment><AUTHOR> Not much detail yet. I'm hoping for some more as time goes by...

<comment><USER27> >Not much detail yet. I'm hoping for some more as time goes by...

This has ben just posted with some more details:

[https://news.ycombinator.com/item?id=15799737](https://news.ycombinator.com/item?id=15799737)

[http://www.sfchronicle.com/business/article/Uber-Waymo- case-...](http://www.sfchronicle.com/business/article/Uber-Waymo-case- Dramatic-turn-as-judge-says-Uber-12388930.php)

</comment></comment><comment><USER28> This whole time I've been asking where is Uber in really deep shit? So here you go, Drogans, there could be some deep shit flooding out from Uber's septic tank. And the Trial is delayed again, at Judge Alsup's request. This whole time Alsup has been like 'let's get this on with already'. Now he's pushing back the trial date based on what the DOJ showed him behind a closed door. Now here's a weird thing. Larry Page has 3 flying car companies, and he funds them all himself. One of them is Kitty Hawk, of which Sebastien Thrun is CEO. Anthony Levandowski has worked for Kittyhawk, but I'm having a hard time figuring out if Levandowski was doing work for Kitty Hawk after he left Waymo, but it's possible he did. Larry Page also has a secret Flying car company called Tiramisu[1]:

>A motion filed last month by Uber to force Google's self-driving car spinoff company Waymo to provide witnesses on a range of topics reveals the existence of Tiramisu.

>The company is listed as relevant to an ongoing Uber-Google self-driving car spat because it alleges that Anthony Levandowski, the engineer accused of stealing lidar and other technical secrets from his workplace at Google's self-driving car project and taking them to Uber, may have been working for the company in his free time.

Now, in the Depositions of Larry Page and Travis Kalanick, it had been revealed that they had been in talks about Flying Cars, or VTOL aircraft. Possibly you recall when Uber dropped the white paper for Uber Elevate[2]. Uber has been talking about flying cars in the news, and has forecast 2020[3] as the year they reveal or deploy some kind of autonomous vertical take off and landing taxi.

So there is possibility that Uber and Larry Page are involved together in some way in Tiramisu. If true, there is also a possibility that Sebastien Thrun and Anthony Levandowski have both been involved. And as an extension of that, there is the possibility that they've already been using Waymo's top-secret technology in flying autonomous vehicles for Tiramisu for years. This increases the liklihood that Page may have known about the Otto stunt before it happened.

Alsup I think just learned about all this from the DOJ. Something is going on there with Tiramisu that screws everything up.

[1][https://motherboard.vice.com/en_us/article/433maw/larry- page...](https://motherboard.vice.com/en_us/article/433maw/larry-page-has- another-side-company-called-tiramisu-what-is-it)

[2][https://www.uber.com/info/elevate/](https://www.uber.com/info/elevate/)

[3][https://www.theverge.com/2017/11/8/16613228/uber-flying- car-...](https://www.theverge.com/2017/11/8/16613228/uber-flying-car-la-nasa- space-act)

</comment><comment><USER29> is there anyone in that company who's not an asshole? the lack of any culture there is appalling.

<comment><USER30> One of the nicest, shyest, and most polite persons I've worked with left Google for Uber a couple years ago. So I can assure they've got great people too, apart from the shady ones that make the news.

</comment></comment><comment><USER31> I hope they go hard on them. I hate the way in the US it's just become expected that everyone is corrupt as hell.

</comment><comment><USER32> I hope Google/Alphabet end up owning Uber after this trial. Then they can shut it down.

</comment><comment><USER33> Can a judge hold a company in contempt and fine them for disobeying a judge? Even if Uber isn't guilty of stealing IP from Waymo they have certainly been less than forthcoming. I'm sure that Waymo has done some shady stuff too. If a person withholds evidence or obstructs a case a judge can throw them in jail. What's the equivalent stick that the judge has to compel a corporation?

<comment><USER34> > "I'm sure that Waymo has done some shady stuff too."

Please point us to the memo from Uber that proves Waymo is operating a "Competitive Intelligence" team that looks more like a CIA Ops team than a Business Intelligence unit. I'll wait.

This "2017 and there's Bad Guys on Both Sides" bullshit needs to die.

<comment><USER35> Seriously, what's with this widespread assumption that because there are two sides, they must be relatively equal? The amount of harm this absurd belief has caused is immeasurable.

<comment><USER36> It's just another form of the law of averages, the signature ingredient in the rationalizer's cookbook.</comment></comment></comment></comment>


Rate my résumé, I think it's quite good. - <AUTHOR> http://robeastham.mightycv.com

<comment><USER2> I hate to have to point this out, but what he is saying is 'Check out my cool resume site that can host resumes, here is a code to sign up for beta' not literally 'Critique my resume I used for testing on my site'

</comment><comment><USER3> Your skill list is dumb. I learned JSON in twenty minutes. That's not a skill.

Also: skill: news.ycombinator.com ??

<comment><USER4> Clearly you missed the point which is that he is trying to promote his new site mightycv

<comment><AUTHOR> Martin is right, but I did want some feedback on the first draft of my résumé too.

I agree my skills list does look bad. Just listing a selection of gems and mentioning a few website does not a skill set make. I'll take a look today and try and improve things. Thanks for the feedback.

</comment></comment></comment><comment><AUTHOR> If any of you guys actually go and sign up for a Mighty CV I must apologise if you encounter a fail whale when you try to view your résumé. This is most likely to happen if you use the LinkedIn importer to create your résumé.

My number one priority tomorrow is to squash whatever bug is causing this. Pretty sure it's to do with blank months in the LinkedIn profile. Hope you don't encounter the bug but just thought I should mention it. Any feature request you have please ad via the uservoice feedback button. Thanks!

</comment><comment><USER5> Feedback purely on the résumé. I noticed at least the following upon a quick look:

* Several run-on sentences with too many "and"s; otherwise wordy as well--too wordy; too many buzzwords; you use the word "sector" too much

* Say "technology" rather than "tech"

* It's "MacBook Pro" and "OS X" (upper-case B and space between S and X)

* You dabble _in_ something

* "I also hope it showcases it might lead": I think you mean "what might lead"

* "one half of a team of two" (sounds redundant)

* "Ryan B's nifty generators": apostrophe

* I would punctuate "etc", but it's acceptable usage to omit the "."

Trim and tighten it, a lot.

</comment><comment><USER6> Your skill list makes you look like a noob, which I suspect you are not.

Btw: There is a broken link to http//mightycv.com under "Experience" (in the first entry), which doesn't work because of the missing colon.

<comment><AUTHOR> Thanks to you and others for the broken link report. Fixed now.

The consensus seems to be that my skill list sucks. I've modified it a little, but I think there's still room for improvement.

</comment></comment><comment><USER7> RE: your GitHub section on the right hand side. I couldn't care less how many repos you're watching. I care about what you're committing, its quality, and general use by some (any) community.

However, putting such details into a CV is way, way too specific, IMO. From a perspective of a recruiter, they have literally 30 seconds to be impressed by your CV. How are they possibly going to be able to evaluate the quality of GitHub commits from the top two or three screenfuls of your CV? As an alternative, consider adding links to particular GitHub commits as proof of some skills, e.g.

"I've added end-to-end encryption to ZeroMQ, here's the GitHub commit and a blog post to prove I'm not a charlatan".

<comment><AUTHOR> Thanks for the feedback. Though currently Mighty CV doesn't actually display the number of repos watched. My feeling was that listing the last five repos watched would act as a top line indicator as to what someone was currently working on or interested in. The link to your real github profile provides a much better way of showing your activity than can fit in Mighty CV sidebar. That said, I really like your idea of allowing for a couple of handpicked choice commits. I'll give some thought to how to integrate this.

Also my choice to use watched items rather than commits stems from my assumption that there are more non active github users, lurkers if you will, watching repos than actively contributing to them. People like me who don't commit or contribute as much as they should probably still watch a lot of stuff. There are likely many reasons for lack of commits from folks such as myself. These could range from lack of time and/or confidence to things like work and family commitments etc. For me I know it's something I need to work on finding the time for, I really hope that I'm able to do this sooner rather than later.

</comment></comment><comment><USER8> The sign up link points at <http://http://www.mightycv.com/users/sign_up>

</comment><comment><USER9> jQuery is particular about it's capitalization. :)

<comment><USER10> What about grammar?

<comment><USER9> OMG so pwned. :)

</comment></comment></comment><comment><USER11> This is a pretty cool service! The link to your own service sign-up page is broken though (the link right before the offer code).

</comment><comment><USER12> You have a broken link in the first section under "experience". Just a little typo (forgot the : in <http://www.mightycv.com/users/sign_up>)

</comment><comment><USER13> Seems a little too wordy to me -- perhaps more content could be hidden behind 'click to expand' sections?

</comment><comment><USER14> IMHO the résumé is pretty good and the site is awesome. #nitpicking: capitalize the 'B' in MacBook

<comment><USER15> Personally I'm not a big fan of the bait linky nature of the title. The service looks useful, but I'm not a huge fan of said skill list...

<comment><AUTHOR> Apologies for the link bait nature of the title. I'm a bit new to the business of self promotion. Perhaps I sometimes get carried away when dreaming up ways to get Mighty CV noticed.

Agreed - skills list looks lame. Time to refactor.

</comment></comment></comment><comment><USER16> I stopped reading when I saw "Macbook Pro" in the 'Skills' section.

If you're talking about a social resume-rating site, my own, simple resume is much easier on the eyes. Also: photographs?</comment>


A paper trail of betrayal: Google's net neutrality collapse - <AUTHOR> http://arstechnica.com/telecom/news/2010/08/a-paper-trail-of-betrayal-googles-net-neutrality-collapse.ars?utm_source=rss&utm_medium=rss&utm_campaign=rss <comment><USER2> dupe: <http://news.ycombinator.com/item?id=1594925></comment>


What fucking programming language should I use? - <AUTHOR> http://www.wfplsiu.com/ <comment><USER2> TL;DR (I don't blame you, it's not that funny):

      Have you already established a language for your project or team?
        Yes:  Keep using that fucking language. Unless you can't accomplish your goals with your current language, you're setting back progress by starting with a new language.
        No: Are you building a mobile app?
          Yes: Are you building for Android, iOS, or both?
            Android: Looks like you're using fucking Java. Hybrid apps suck.
            iOS: Use fucking Swift. Hybrid apps suck.
            Both: Time to learn fucking Java and Swift. Hybrid apps suck, so your dumb ass needs to learn both.
          No: What the fuck are you building?
            Web app/Networked application: Is it a client-side app?
              Yes: Looks like you're stuck with fucking JavaScript you poor bastard.
              No: Are you working for an established enterprise or a startup?
                Enterprise: Just use fucking Java. No one ever got fired for choosing Java.
                Startup: Do you give a shit about concurrency?
                  Yes: Do you know why you give a shit about concurrency?
                    Yes: Are you into functional programming?
                      Yes: Do you need to use the Java Virtual Machine for some fucking reason?
                        Yes: Use fucking Clojure
                        No: Use fucking Rust or Elixir. I've got you this far, choose whichever one doesn't look like shit to you.
                      No: Use fucking Go.
                    Not really: I didn't think so you asshole. Just use Ruby - probably with Rails - and get the fuck out of my office.
                  No: Do you need static types?
                    Yes: Use fucking Dart
                    No: Do you want only one language in your codebase?
                      Yes: You're stuck with fucking JavaScript, but you already knew that
                      I don't care: Are you already familiar with at least one programming language?
                        Yes: Are you nostalgic for the web of the early 2000s?
                          Yes: You should probably stick with fucking PHP
                          No: Use fucking Ruby
                        No: Use fucking Python. It's easy to learn and very powerful.
            Desktop app: How fucking lazy are you?
              Really lazy: Damn it. Just use fucking Visual Basic. I hope you're proud of yourself.
              Sort of lazy: Just use fucking Java.
              I'll sleep when I die: Do it properly in some fucking dialect of C

<comment><USER3> I'm kinda puzzled there is nothing in-between a C dialect and Java for desktop applications.

<comment><USER4> Unless you consider both C++ and C# "dialects" of C :)

</comment></comment></comment><comment><USER5> Maybe I'm getting old. I love these sorts of technology selector flowchart things in general. However, the trope of throwing in a bunch of random "fucks" and getting a ton of upvotes for it feels played out to me.

<comment><USER6> It's just poorly done. The bits like "I hope you're proud of yourself" and "Just use Ruby - probably with Rails - and get the fuck out of my office." are actually how you write in this style; the rest just seems like a templated "I'll write it like this and then come up with something better" first pass, that never got fixed.

</comment></comment><comment><USER7> Off topic from the article, I don't understand the purpose of using profanity and then censoring it. Writing things like F!@K just seems like a weird middle ground that loses the intensity of cursing and the professionalism of not cursing.

<comment><AUTHOR> I originally titled the article with the censored version as that was the name on the page. I believe they censor it on the first page as a way around workplace filters, as there's a SFW button at the top. I think once you get into it, the language is uncensored.

</comment></comment><comment><USER8> The "really lazy desktop app" choice is Qt, not Visual Basic.

Visual Basic hasn't really existed for decades.

<comment><USER9> VB.NET is still a thing isn't it?

<comment><USER10> Yeah but why lock in with Microsoft when you can have a cross platform app at the same abstraction and difficulty level?

<comment><USER11> depends on whether the additional platforms are trivially ignorable or not.

</comment></comment></comment></comment><comment><USER12> It would be nice to be able to back up a question. It was pretty funny, but having to start over every time to check out the whole decision tree was a bit tedious.

</comment><comment><USER13> No quiz needed, the actual answer should be just "Whatever language you know and can get shit done with".

</comment><comment><USER14> I would say that if one does not have experience with an enterprise stack they should really choose to work with one irrespective of whether they are a startup or no. Your startup will probably fail anyway. The experience you get is the only thing that you'll be left with. And if you chose to work with chicken-scheme and what not, good luck putting that on your CV.

<comment><USER15> Most "enterprise" stacks introduce complexity that isn't ever going to be needed really early on, and in general that slows down initial development, and the road to something that does its' job. Many of them are over-engineered and a bad fit, used badly too often.

Of course the alternative is understanding your problem domain and picking appropriate tools and approaches instead of using (insert .Net or Java framework here) for everything.

</comment></comment><comment><USER16> Curious then realized it was very light in fun content. There is no way to get to cobol for instance

</comment><comment><USER10> It got the wrong language for my example, a digital audio workstation with peer to peer collaboration.

It said use Go, but Go is garbage collected and that is unacceptable for an app that needs to process real time audio with low latency.

Same thing applies to any networked video game.

<comment><USER17> I believe you can turn off the garbage collector in go.

<comment><USER10> Uh. Citation needed.

<comment><USER18> You can set the environment variable GOGC=off [1]

There doesn't actually seem to be a way to explicitly free memory though so I doubt this is actually used.

[1]: [https://golang.org/pkg/runtime/](https://golang.org/pkg/runtime/)

<comment><USER19> It's only intended for debugging purposes, near as I can tell (and I'm not sure why anyone would want to do it in the first place beyond debugging):

[https://github.com/golang/go/issues/13761#issuecomment-16772...](https://github.com/golang/go/issues/13761#issuecomment-167721220)

</comment></comment></comment></comment></comment><comment><USER20> I always just choose whatever I'm most comfortable with.

You don't always need an edgy language to use. Just use what you know.

</comment><comment><USER21> I answered in such a way that I was expecting Python or Ruby but got JavaScript. Is that the joke?

</comment><comment><USER22> Kids these days. You could replace ALL of this dynamic content with a static page that says:

        Use the language that's right for the job.

You don't even need Javascript!

</comment><comment><USER23> It's telling me to use Java and Swift for mobile development because hybrid apps suck. But Xamarin is fine, I don't get it.

</comment><comment><USER24> If I could use cython everywhere I'd probably use cython.

</comment><comment><USER25> Request: what fucking text editor/IDE should I use?

</comment><comment><USER26> I enjoy gratuitous profanity and PLs, well done.

</comment><comment><USER27> ..must.. not .. give in.. to .. my.. negativity

</comment><comment><USER28> Found this really funny, thanks :)

</comment><comment><USER29> javascript

<comment><USER30> For desktop app. You will regret it.

<comment><USER15> Electron and nwjs seem pretty solid... VS Code works really well (for example), and can leverage one of the most diverse module systems around.

<comment><USER31> I feel the urge to cry.

<comment><USER15> I'm not saying it's the best option... more that it isn't a bad one, and depending on your needs, can be a good one. If you want to share logic across mobile apps, a web presence and a desktop deployment, leveraging your existing developers and creating a relatively cohesive experience, it isn't a bad thing.</comment></comment></comment></comment></comment>


Amazon S3′s PermanentRedirect and cURL error code 51 Problems - <AUTHOR> http://webscepter.com/amazon-s3s-permanentredirect-and-curl-error-code-51-problems/

<comment><USER2> It's my experience that wildcard security certificates (like the one amazon has for _.s3.amazonaws.com) do not work past one level of subdomain. That is to say a certificate issued to_.example.com will work on www.example.com and sales.example.com, but not www.sales.example.com or shipping.us.example.com.</comment>


Get-Rekt React CLI - <AUTHOR> https://www.npmjs.com/package/get-rekt <comment><AUTHOR> Pls stop creating components and containers manually :D</comment>


HTTP Security Headers – A Complete Guide - <AUTHOR> https://nullsweep.com/http-security-headers-a-complete-guide/ <comment><USER2> This is a good basic overview of the basic headers, but I suggest spending some time on Scott Helme's blog. He runs securityheaders.io, a free service that scans your site, and assigns it a letter grade based on what headers and configurations you've applied.

For instance, his explanation of Content Security Policy headers is much more detailed than in the OP's link.

[https://scotthelme.co.uk/content-security-policy-an- introduc...](https://scotthelme.co.uk/content-security-policy-an- introduction/)

<comment><USER3> securityheaders.io is now securityheaders.com

[https://scotthelme.co.uk/security-headers-is-changing- domain...](https://scotthelme.co.uk/security-headers-is-changing-domain-and- branding/)

</comment></comment><comment><USER4> It's definitely worth repeating the warning that, while very useful, Strict- Transport-Security should be deployed with special care!

While the author's example of `max-age=3600` means there's only an hour of potential problems, enabling Strict-Transport-Security has the potential to prevent people from accessing your site if for whatever reason you are no longer able to serve HTTPS traffic.

Considering another common setting is to enable HSTS for a year, its worth enabling only deliberately and with some thought.

<comment><USER5> Unless your site is nothing but a dumb billboard serving nothing but static assets (and maybe even then...), the inability to serve HTTPS traffic should be considered a breaking issue and you shouldn't be serving _anything_ until your HTTPS is restored. "Reduced security" is not a valid fallback option.

That might not be something that a company's management team wants to hear, but indicating to your users that falling back to insecure HTTP is just something that happens sometimes and they should continue using your site is one of the _worst things you can possibly do_ in terms of security.

<comment><USER6> Here's a real example of how HSTS can break a site: My personal, non-public wiki is secured by HTTPS with a certificate valid for 5 years. I thought it would be neat to enable HSTS for it because what could go wrong?

Well, just last week the HTTPS certificate expired in the middle of the day. I had about a half days' worth of work typed up into the browser's text field and when I clicked "submit", all of my work vanished and Firefox only showed a page stating that the certificate was invalid and that nothing could be done about it. I clicked the back button, same thing. Forward button, same thing. A half-days worth of work vanished into thin air.

Is this my fault for letting the certificate expire? Absolutely. Should I have used letsencrypt so I didn't have to worry about it. Sure. Should I be using a notes system that doesn't throw away my work when there's a problem saving it? Definitely. I don't deny that there's lots that I could have done to prevent this from being a problem and lots that I need to fix in the future.

But it does point out that if you use HSTS, you have to be _really_ sure that _all_ your ducks are in a row or it _will_ come back to bite you eventually.

<comment><USER7> Without HSTS how do you think your scenario plays out differently? Your expired cert still isn't good, and I assure you Firefox isn't going to say "Oh, there's an insecure HTTP site we could try, would you like me to send the HTTP POST there instead?". So I think this only works out "fine" in the scenario where lack of HSTS means you just never use any security at all. Which is a fairly different proposition.

Since the expired cert can't be distinguished from an attack my guess is that the text contents aren't lost when that transaction fails due to the expired cert (as then bad guys could throw your data away which isn't what we want) so I think you could just have paused work, got yourself a new valid certificate, and then carried on.

Now, of course, it may be that your web app breaks if you do that, the prior session you were typing into becomes invalid when you restart, and new certificates can't be installed without restarting, that sort of thing, but that would be specific to your setup.

<comment><USER8> Wouldn't the browser allow you to inspect the cert and choose to continue the connection? Then you can decide for yourself if you trust the cert.

</comment></comment></comment></comment></comment><comment><USER9> Nice list. You might want to consider setting a "Referrer-Policy"[1] for sites with URLs that you'd prefer not to leak.

Also, for "Set-Cookie", the relatively new "SameSite"[2] directive would be a good addition for most sites.

Oh, and for CSP, check Google's evaluator out[3].

[1] [https://developer.mozilla.org/en- US/docs/Web/HTTP/Headers/Re...](https://developer.mozilla.org/en- US/docs/Web/HTTP/Headers/Referrer-Policy)

[2] [https://www.owasp.org/index.php/SameSite](https://www.owasp.org/index.php/SameSite)

[3] [https://csp-evaluator.withgoogle.com](https://csp- evaluator.withgoogle.com)

<comment><USER10> Referrer-Policy is nice, but browsers should just default to strict-origin- when-cross-origin and end the mess.

</comment></comment><comment><USER11> Instead of X-Frame-Options one should use CSP's frame-ancestors option, it has wider support among modern browsers. But CSP deserves more than one paragraph in general.

He also missed Expect-Staple and Expect-CT, in addition to that, most of security headers have the option to specify an URI where failures are sent, very important in production environments.

<comment><USER7> Expect-CT is pretty marginal. In principle a browser could implement Certificate Transparency but then only bother to enforce it if Expect-CT is present, in practice the policy ends up being that they'll enforce CT system- wide after some date. Setting Expect-CT doesn't have any effect on a browser that can't understand SCTs anyway, so that leaves basically no audience.

Furthermore, especially with Symantec out of the picture, there is no broad consumer market for certificates from the Web PKI which don't have SCTs. The audience of people who know they want a certificate is hugely tilted towards people with very limited grasp of what's going on, almost all of whom definitely need embedded SCTs or they're in for a bad surprise. So it doesn't even make sense to have a checkbox for "I don't want SCTs" because 99% of people who click it were just clicking boxes without understanding them and will subsequently complain that the certificate doesn't "work" because it didn't have any SCTs baked into it.

There are CAs with no logging for either industrial applications which aren't built out of a web browser (and so don't check SCTs) and are due to be retired before it'd make sense to upgrade them (most are gone in 2019 or 2020) or for specialist customers like Google whose servers are set up to go get them SCTs at the last moment, to be stapled later. Neither is a product with a consumer audience. Which means neither is a plausible source of certificates for your hypothetical security adversary.

As a result, in reality Expect-CT doesn't end up defending you against anything that's actually likely to happen, making it probably a waste of a few bytes.

<comment><USER11> Unfortunately yes, Expect-CT could use more enforcement and support but I think spending those few bytes is worth in the sense of indicating people want to see CT enforced more.

</comment></comment></comment><comment><USER12> Should mention for Access-Control-Allow-Origin that the default value is the safe default and setting this header weakens site security.

<comment><AUTHOR> Great point! I added a sentence to say that the default is all that's needed.

</comment></comment><comment><USER13> * [Signing HTTP Messages]([https://tools.ietf.org/id/draft-cavage-http-signatures-09.ht...](https://tools.ietf.org/id/draft-cavage-http-signatures-09.html))

* [HTTP Signatures]([https://tools.ietf.org/id/draft-cavage-http-signatures-01.ht...](https://tools.ietf.org/id/draft-cavage-http-signatures-01.html))

* [draft-cavage-http-signatures-10 - Signing HTTP Messages]([https://tools.ietf.org/html/draft-cavage-http-signatures-10](https://tools.ietf.org/html/draft-cavage-http-signatures-10))

* [[https://www.rfc-editor.org/rfc/rfc4686.txt](https://www.rfc-...](https://www.rfc-editor.org/rfc/rfc4686.txt\]\(https://www.rfc-editor.org/rfc/rfc4686.txt\))

* [[https://www.rfc-editor.org/rfc/rfc3335.txt](https://www.rfc-...](https://www.rfc-editor.org/rfc/rfc3335.txt\]\(https://www.rfc-editor.org/rfc/rfc3335.txt\))

</comment><comment><USER14> X-frame-options is obsolete. Most browsers complain loudly on the console or ignore the header. Use csp instead

<comment><USER15> For those wondering, CSP 'frame-ancestors' if I remember correctly.

<comment><USER16> It's a shame browsers are breaking the X-Frame-Options.

It was an easy option to force with load balancers or any intermediate server. Frames should always be blocked on the open internet.

The content security policy can't be adjusted easily. It screws with applications and frameworks that use it for any of the twenty other options it covers.

<comment><USER15> Why? It's been deprecated for years and years. You don't have to set any of the other 20 CSP options to set CSP:frame-ancestors. There's no reason to avoid it except taking a completionist approach to CSP headers ("we have to set all possible CSP attributes for maximum security in a single go on our first try") which I strongly discourage.

<comment><USER16> You can't just do a "set header Content-Security-Policy frame-ancestors none" on all traffic. This is gonna break anything using CSP for any of the 20 settings it provides.

<comment><USER15> Correct. You would be expected to merge it into any CSP headers used by your app, either using (in your Apache scenario) If/Else and Header modify or by modifying your application where appropriate.

While XFO is simpler to overwrite on a global basis, it's imprecise and doesn't permit "allow certain sites to frame, deny all others" and is likely to become fully unsupported whenever _any_ CSP policy is defined, given its deprecated status. Taking the XFO way out will only help you short-term at best.

</comment></comment></comment></comment></comment></comment><comment><USER17> There is the Feature-Policy header too : allow and deny the use of browser features in its own frame. I've seen this header on a bank website.

Example :

      Feature-Policy: accelerometer 'none'; autoplay 'none'; camera 'none'; fullscreen 'none'

Documentation: [https://developer.mozilla.org/en- US/docs/Web/HTTP/Feature_Po...](https://developer.mozilla.org/en- US/docs/Web/HTTP/Feature_Policy)

</comment><comment><USER18> I'm a little confused by the examples for Access-Control-Allow-Origin:

> Access-Control-Allow-Origin: > [http://www.one.site.com](http://www.one.site.com)

> Access-Control-Allow-Origin: > [http://www.two.site.com](http://www.two.site.com)

And in the examples setting both. Because in my experience you cannot set multiple [1]. Lots of people instead set it to * which is both bad and restricts use of other request options (such as withCredentials). It looks like the current working solution is to use regexes to return the right domain [2], but I'm currently having trouble getting that to work, so if there's some better solution that works for people I'd love to hear it.

1\. [https://developer.mozilla.org/en- US/docs/Web/HTTP/CORS/Error...](https://developer.mozilla.org/en- US/docs/Web/HTTP/CORS/Errors/CORSMultipleAllowOriginNotAllowed) 2\. [https://stackoverflow.com/questions/1653308/access- control-a...](https://stackoverflow.com/questions/1653308/access-control- allow-origin-multiple-origin-domains)

<comment><AUTHOR> You are right on this - I thought you could set multiple sites by setting multiple headers, but it doesn't work that way, which I should have known because headers don't work that way in general...

The recommended way to do multiple sites seems to be to have the server read the request header, check it against a whitelist, then dynamically respond with it, which seems terrible.

Thanks for catching this - I updated the post to reflect this and make it more clear.

<comment><USER19> Actually, headers _do_ often work that way. HTTP says:

Multiple message-header fields with the same field-name MAY be present in a message if and only if the entire field-value for that header field is defined as a comma-separated list

Which applies to HTTP headers such as Cache-Control:, and probably goes back to the email RFCs allowing multiple To: headers.

It's just that Access-Control-Allow-Origin isn't defined to accept a comma list, just like Content-Security-Policy doesn't (which is another header breaking things if it appears more than once)

</comment></comment></comment><comment><USER20> Great overview.

If anyone's interested, I wrote a guide a while ago on adding these headers via Cloudflare Workers, which can be helpful if you're hosting a static site on S3, GitHub Pages, etc. where you can't add these headers directly:

[https://jarv.is/notes/security-headers-cloudflare- workers/](https://jarv.is/notes/security-headers-cloudflare-workers/)

</comment><comment><USER21> The nginx header directives are all not in correct syntax with the extra ":", and for those directives with multiple values, it should be wrapped within a "" (such as "1; mode=block"), here is the correct settings:

        ## General Security Headers
        add_header X-XSS-Protection "1; mode=block";
        add_header X-Frame-Options deny;
        add_header X-Content-Type-Options nosniff;
        add_header Strict-Transport-Security "max-age=3600; includeSubDomains";

</comment><comment><USER22> [https://www.netsparker.com/whitepaper-http-security- headers/](https://www.netsparker.com/whitepaper-http-security-headers/)

<comment><USER23> This is such a great and completed guide. Lots of headers with example and explanations. Have been looking for it.

I will include in in my newsletter[0] next monday if you don't mind.

\---

[0]: [https://betterdev.link](https://betterdev.link)

</comment></comment><comment><USER24> For Node.js servers running on express, check out helmet[1] which adds a lot of these headers for you :)

[1] [https://www.npmjs.com/package/helmet](https://www.npmjs.com/package/helmet)

</comment><comment><USER25> The X-XSS-Protection header recommendation is a Zombie recommendation which is at best outdated and at worst harmful. Its origins are based on old IE bugs but it introduces worse issues.

IMHO, the best value for X-XSS-Protection is either 0 (disabling it completely like Facebook does) or not providing the value at all and just letting the client browser use its default. Why?

First, XSS 'protection' is about to not be implemented by most browsers. Google has decide to deprecate Chrome's XSS Auditor[0], and stop supporting XSS 'protection'. Microsoft has already removed its XSS filter from Edge[1]. Mozilla has never bothered to support it in Firefox.

So most leading net companies already think it doesn't work. Safari of course supports the much stronger CSP. So it's only possibly useful on IE - if you don't support IE, might as well save the bytes.

Second, XSS 'protection' protects less than one might think. In all implementing browsers, it has always been implemented as part of the HTML parser, making it useless against DOM-based attacks (and strictly inferior to CSP)[2].

Worse, the XSS 'protection' can be used to _create_ security flaws. IE's default is to detect XSS and try to filter it out, this has been known to be buggy to the point of creating XSS on safe pages[3], which is why the typical recommendation has been the block behaviour. But blocking has been itself exploited in the past[4], and has side-channel leaks that even Google considers too difficult to catch[0] to the point of preferring to remove XSS 'protection' altogether. Blocking has an obvious social exploitation which can create attacks or make attacks more serious.[5]

In short, the best idea is to get rid of browsers' XSS 'protection' ASAP in favour of CSP, preferably by having all browsers deprecate it. This is happening anyway, so might as well save the bytes. But if you do provide the header, I suggest disable XSS 'protection' altogether.

[0] [https://groups.google.com/a/chromium.org/forum/#!msg/blink-d...](https://groups.google.com/a/chromium.org/forum/#!msg/blink- dev/TuYw-EZhO9g/blGViehIAwAJ)

[1] [https://developer.microsoft.com/en-us/microsoft- edge/platfor...](https://developer.microsoft.com/en-us/microsoft- edge/platform/changelog/desktop/17723/)

[2] e.g. [https://github.com/WebKit/webkit/blob/d70365e65de64b8f6eaf1f...](https://github.com/WebKit/webkit/blob/d70365e65de64b8f6eaf1ff5bf1a901765e47923/Source/WebCore/html/parser/XSSAuditor.cpp)

[3] CVE-2014-6328, CVE-2015-6164, CVE-2016-3212..

[4] [https://portswigger.net/blog/abusing-chromes-xss-auditor- to-...](https://portswigger.net/blog/abusing-chromes-xss-auditor-to-steal- tokens)

[5] Assume that an attacker has enough access to normally allow XSS. If he does not, the filter is useless. If he does, the attacker can by definition trigger the filter. So trigger the filter, make a webpage be blocked, and call the affected user as "support". From there the exploitation is obvious, and can be much worse than mere XSS. Now, remember that all those XSS filters in all likelihood have false positives, that may not be blocked by other defences because they're not attacks. So It's quite possible the filter introduces a social attack that wouldn't be possible otherwise!

Hattip: [https://frederik-braun.com/xssauditor-bad.html](https://frederik- braun.com/xssauditor-bad.html) which gave me even more reasons to think browsers' XSS 'protection' is awful. I didn't know about [2] before reading his entry.

<comment><USER25> For [3] (exploiting IE's XSS filter default behaviour to create XSS) see also [https://www.slideshare.net/codeblue_jp/xss-attacks- exploitin...](https://www.slideshare.net/codeblue_jp/xss-attacks-exploiting- xss-filter-by-masato-kinugawa-code-blue-2015) .

The author recommends either changing the default behaviour to block or disabling the filter altogether. I believe experience has shown this protection method cannot be fixed.

Ultimately, safe code is code that can be reasoned about but there never was even any specification for this 'feature'. By comparison, CSP has a strict specification. It covers more attacks, and has a better failure mode between XSS protections' filter and block entire page load behaviours.</comment></comment>


Ask HN: What happened to the HNNotify service? - <AUTHOR> We used to get emails whenever anyone replied to a comment we posted on HN - but that seems to have stopped... Anyone know why? <comment><USER2> Here is a simple html 5 app that I made, that lets you add watchers for HN and reddit threads as part of its functionality.

[http://z-petal.com/ceasium/#/hackerNews](http://z-petal.com/ceasium/#/hackerNews)

It runs in your browser itself, and stores all the data in browsers local storage.

</comment><comment><USER3> Not sure, but I just emailed the creator.

<comment><USER4> Emails are flowing again it appears.

</comment></comment><comment><USER5> FYI: I just got notice of a reply that happened 26 days ago. Perhaps it is currently being sorted out.

</comment><comment><USER6> Same here.

<comment><USER4> Could it be because Firebase provides HNs API, and Firebase is going through a technical transition as part of Google? I.e. Something broke and someone hasn't noticed or the right person can't be contacted to get it fixed.

<comment><USER5> That's an interesting thought. It has gone on the fritz before and then returned to functioning, so I am not yet all up in arms. I hope you are right and things will start working again some time soon.

<comment><USER4> Looks like HN Notify emails are flowing again :D</comment></comment></comment></comment>


NSA attempting to squash entrepreneur for selling parody t-shirt - <AUTHOR> http://www.rawstory.com/rs/2013/10/30/minnesota-man-sues-nsa-dhs-after-they-try-to-quash-his-parody-merchandise/

<comment><USER2> From the National Security Agency Act of 1959 [1]:

          Sec. 15. (a) No person may, except with the written permission
       of the Director of the National Security Agency, knowingly use the
       words 'National Security Agency', the initials 'NSA', the seal of
       the National Security Agency, or any colorable imitation of such
       words, initials, or seal in connection with any merchandise,
       impersonation, solicitation, or commercial activity in a manner
       reasonably calculated to convey the impression that such use is
       approved, endorsed, or authorized by the National Security Agency.

Up to the Supreme Court whether or not it's in accord with the First Amendment. Either way, using the word 'squash' to describe a cease-and-desist letter strikes me as a bit inflammatory.

[1]: [http://www.intelligence.senate.gov/nsaact1959.htm](http://www.intelligence.senate.gov/nsaact1959.htm)

<comment><AUTHOR> The NSA is still the one pursuing this ridiculous claim.

<comment><USER2> Well, they would be if anyone were.

Now that I read the quotation more closely, though, I find cause in it to reconsider my original opinion:

> [...] in a manner reasonably calculated to convey the impression that such > use is approved, endorsed, or authorized by the National Security Agency.

Frivolous as I find it, I rather strongly doubt that anyone is going to mistake McCall's parody for something 'approved, endorsed, or authorized' by NSA. As such, I doubt the case will get anywhere near the Supreme Court, unless whoever in NSA's legal office is behind the C&D really feels the need to pursue a hopeless cause that far; it seems almost certain that the first court to rule on the matter will do so in McCall's favor.</comment></comment></comment>


A Search Engine for the Internet's Dirty Secrets - <AUTHOR> http://www.technologyreview.com/news/544191/a-search-engine-for-the-internets-dirty-secrets/ <comment><USER2> Looks like a great effort. Appears that you can use it 5 times before you have to create an account. One enhancement might be to "Lookup my ip address" but it is provided on the page so you can easily copy and paste it.</comment>


Intel releases 27 Comet Lake vPro processors with mandatory hardware shield - <AUTHOR> https://www.zdnet.com/article/intel-releases-27-comet-lake-vpro-processors-with-mandatory-hardware-shield/ <comment><AUTHOR> Related to new Windows 10 Secured-Core technology.

[https://www.microsoft.com/en- us/windowsforbusiness/windows10...](https://www.microsoft.com/en- us/windowsforbusiness/windows10-secured-core-computers)

'Intel has released its latest batch of 14-nanometre chips. In this case, it is a collection of Comet Lake CPUs consisting of mobile and 18 desktop chips -- a mix of Core and Xeon chips -- all bearing the vPro badge.

'For this release of its 10th generation chips, Intel said it had made its previously optional hardware shield [0][1] mandatory.'

[0] [https://www.intel.com/content/www/us/en/architecture-and- tec...](https://www.intel.com/content/www/us/en/architecture-and- technology/hardware-shield.html)

[1] Intel Hardware shield demo [https://youtube.com/watch?v=PO3GhZ_cyMg](https://youtube.com/watch?v=PO3GhZ_cyMg)</comment>


Was the Covid-19 Virus Designed? - <AUTHOR> https://mindmatters.ai/2020/03/was-the-covid-10-virus-designed-the-computer-doesnt-know/ <comment><USER2> [https://www.technologynetworks.com/genomics/news/scientists-...](https://www.technologynetworks.com/genomics/news/scientists- firmly-determine-that-sars-cov-2-was-not-engineered-332244)

<comment><USER3> That's the article being responded to. It leaves so many questions in the air, like why is excellent targeting indicative of natural selection, as opposed to excellent genetic engineering? or, why can't engineers use an unknown backbone? I don't see how their analysis entails such a definitive conclusion.

</comment></comment><comment><USER4> If not, where is patient 0?</comment>


Show HN: Surfboard - A flippable way to experience the web in HTML5/CSS3 - <AUTHOR>

I love to use Flipboard on my iPad, but I was bummed that the experience couldn't follow me to the phone or desktop, so I decided to do something about it...
I built http://ridesurfboard.com over the winter holiday and just finished it up last night, so I wanted to share it with the HN community first.
The app turns any website with an RSS feed into a more human, flippable format. It's all HTML5/CSS3/JS and works best in either desktop Safari or on an iOS device, although you can use Chrome if you enable the experimental GPU Accelerated Compositing flag (a how-to is on the Surfboard blog).
Feedback, questions and ideas are all greatly welcomed. <comment><AUTHOR> Clicky: <http://ridesurfboard.com>

</comment><comment><USER2> I like it! Tried it on a couple non mainstream sites and it parsed everything pretty well. I think I would use it more on my phone or iPad than a desktop, cool that it works on mobile devices.

</comment><comment><USER3> Looks great! Looking forward to trying it out on my iOS device.</comment>


Quantum Computing, Capabilities and Limits: An Interview with Scott Aaronson - <AUTHOR> https://gigaom.com/2019/01/17/quantum-computing-capabilities-and-limits-an-interview-with-scott-aaronson/ <comment><USER2> Lots of progress in this field lately. Google, IBM, and Intel all say they've built experimental QCs or quantum processors with 50-70 qubits, and a startup called Rigetti plans a QC with 120 qubits. And Microsoft seems to be betting big on exotic physics (Majorana fermions) that could create far more stable qubits, in theory.

With all this investment, quantum computing may be coming soon.

ETA: links

[https://www.technologyreview.com/s/609451/ibm-raises-the- bar...](https://www.technologyreview.com/s/609451/ibm-raises-the-bar- with-a-50-qubit-quantum-computer/)

[http://ai.googleblog.com/2018/03/a-preview-of-bristlecone- go...](http://ai.googleblog.com/2018/03/a-preview-of-bristlecone-googles- new.html)

[https://newsroom.intel.com/press-kits/quantum- computing/#49-...](https://newsroom.intel.com/press-kits/quantum- computing/#49-qubit-processor)

[https://medium.com/rigetti/the-rigetti-128-qubit-chip-and- wh...](https://medium.com/rigetti/the-rigetti-128-qubit-chip-and-what-it- means-for-quantum-df757d1b71ea)

<comment><USER3> 50-70 qubit quantum computers? Surely not. Maybe "quantum devices" but not actual computers capable of general computation?

<comment><USER4> This is a good resource for keeping track of viability.

[https://quantumcomputingreport.com/scorecards/qubit- quality/](https://quantumcomputingreport.com/scorecards/qubit-quality/)

</comment></comment></comment><comment><USER5> "if you're doing superconducting qubits, which is maybe the most popular approach today, then at a bare minimum, you need to cool everything down to 10 mKB,"

Anyone know what that temperature is supposed to be? Googling for "mkb" doesn't come up with anything I can scrounge up. mK for milli-Kelvin doesn't make much sense, as you don't need to get that low for superconductivity in general, and that's a pretty hard temperature to reach.

<comment><USER6> Yup, he meant 10 milliKelvin: [https://www.scottaaronson.com/blog/?p=4121#comment-1804067](https://www.scottaaronson.com/blog/?p=4121#comment-1804067)

<comment><USER5> Thank you, and thank you to the other repliers who answered. I have learned something today.

</comment></comment></comment><comment><USER7> Wow! This is the best explainer of quantum computing I have ever read. Scott does a great job at capturing the essential challenges and potential applications, without embellishing or being overly pessimistic. Good stuff.

<comment><USER3> Scott he the quantum man. Checkout his blog for more [https://www.scottaaronson.com/blog/](https://www.scottaaronson.com/blog/)

<comment><USER8> But stay away from his talks. His "uh" to word ratio is ~1.

<comment><USER9> One of the world's smartest folks. In one of the world's most interesting fields. Is kind enough to take time away from his research, and his family, to share with us dummies.

Not a world-class deliverer of speeches. Seems like a forgivable flaw to me.

</comment></comment></comment></comment><comment><USER10> I understood some of it, but quite a bit of it went over my head. Is there a more detailed resource for understanding quantum computing for a layman?

<comment><USER11> Try this video - [https://www.youtube.com/watch?v=OWJCfOvochA](https://www.youtube.com/watch?v=OWJCfOvochA)

I found it easy to comprehend. It starts explaining to a child & works its way up to a doctorate level.</comment></comment>