$200,000 from Kickstarter = 1 year of runway for Diaspora  - <AUTHOR> http://dl.dropbox.com/u/345057/DIASPORA%207312011%20Profit%20and%20Loss%20Statement%20B.pdf <comment><USER2> Wikipedia lists close to 40(!) distributed social networks. [1] None have achieved a meaningful amount of adoption.

About a year ago I became interested in why this is the case. I'm an academic computer scientist with a strong interest in the startup/web tech scene (see profile for info). My colleagues and I have been studying not just decentralized social networks, but the more general concept of decentralized architectures for personal data. This includes "personal data store" efforts which are popping up all over the place, with similarly dismal adoption, "infomediaries" which were the rage in the late 90s (before the dot com bust ate them up), etc. Overall, we've looked at around 80 companies, projects, and proposals.

If the amount of reinvention in this space is surprising, the almost wanton refusal to learn from others' past mistakes is shocking. These projects seem to do the same things wrong and fail for very similar reasons, chief among them building more technology when it's not really technology that's holding things back.

There is the widespread — but often unstated and always unexamined — belief among the participants that moving to a decentralized setting is a magic cure- all for the problems that ail today's status quo, such as privacy and interoperability. Sadly, this belief is simply wrong.

I certainly sympathize with the urge to pat these guys on the back for trying, but is it really courage or foolhardiness? If 10,000 amateurs have tried to solve P =? NP and failed, do we encourage the 10,001th guy to give it a shot as well, or do we tell him to learn some math and CS first, and gain an appreciation for why the problem is hard and probably not worth taking on unless you really really know what you're doing?

[Our study is not out yet, but feel free to contact me if you're interested in discussing this.]

[1] <http://en.wikipedia.org/wiki/Distributed_social_network>

<comment><USER3> I have a bet with random_walker that a distributed social network will gain significant traction by 2014.

<http://twitter.com/#!/flipzagging/status/16766878672228352>

Diaspora is a sad story: a team with great intentions but little systems experience, becoming the standard-bearer for distributed social networking. They gained attention from some random factors (frustration with Facebook at a peak, NYtimes story, Kickstarter).

I think the odds of there being a single winner-take-all provider of social networking services (SNS), forever and ever, are slight. The idea that kids are going to stick with the SNS their mom uses to play Farmville seems ridiculous to me. So we should see some amount of fragmentation, eventually.

It also seems absurd to me that Facebook will remain agile enough to shut out competitors while also supporting 500M+ users. At some point, a situation should arise where competitor SNS services will find it to their advantage to be interoperable. That could end in an oligopoly, but that still counts as a more distributed social network.

Larry Page often likes to say "don't bet against the internet". And I am old enough to remember when people thought that Microsoft's Project Blackbird was going to kill the web. I am confident that SNS, like almost all internet services, will be commodified at some point, and probably sooner than we expect.

Caveat: this hasn't quite worked out for instant messaging, so I could be wrong.

<comment><USER4> I'd bet against you, but I don't think your definition of "gain significant traction" is reasonable.

It's pretty _easy_ for a network to get 1 million sign-ups, and then it's pretty easy to get 1 million people to pipe their Twitter status's into it. See Identica etc.

That doesn't mean is has significant adoption as a social network - it's really just a Twitter client.

I agree that there will be many social networks, but I don't think there is much reason for them to interoperate.

Take a listen to Eric Ries talk about his experience building an interoperable IM client[1].

He built the whole thing, then showed it to heavy IM users and they were (paraphrasing) "err.. why would I want that? I already run 6 IM clients, running another isn't a problem. And I don't want the same people to see me on each one"

We already have an interoperable, distributed social network for messaging purposes. It's called email. I doubt another one is needed. (OTOH, I did build a Pubsubhub powered demo of one back in the FriendFeed days. The technology was cool...)

[1] <http://ecorner.stanford.edu/authorMaterialInfo.html?mid=2273>

<comment><USER5> Trillian <http://www.trillian.im/> have been selling their cross-platform and interoperable IM client for over a decade.

If people didn't want Eric's interoperable IM client, it wasn't for lack of a market.

<comment><USER6> Trillian is either a good or bad example, depending on your perspective. I don't want to have N IM accounts; I want to have one account/identity that can reach everyone. That has not happened with IM and I am skeptical that it will happen with social networking.

</comment></comment></comment></comment></comment><comment><USER7> My initial reaction was to feel bad about these kids. Then I remembered about Theodore Roosevelt's speech about the man in the arena, and I congratulate them for giving it their best shot. Whether they continue or not, it was worth trying and they've had an amazing experience in the process.

"It is not the critic who counts; not the man who points out how the strong man stumbles, or where the doer of deeds could have done them better. The credit belongs to the man who is actually in the arena, whose face is marred by dust and sweat and blood; who strives valiantly; who errs, who comes short again and again, because there is no effort without error and shortcoming; but who does actually strive to do the deeds; who knows great enthusiasms, the great devotions; who spends himself in a worthy cause; who at the best knows in the end the triumph of high achievement, and who at the worst, if he fails, at least fails while daring greatly, so that his place shall never be with those cold and timid souls who neither know victory nor defeat."

<comment><USER8> Frankly, I think you're stretching the applicability of this speech (which by itself is one of the greatest ones ever) by lumping the Diaspora guys in there.

Look at it this way: should the guy who sells his house and jeopardizes his family's future to buy a plot of land in Alaska to mine it for gold with a pick axe and a sieve be lauded as 'the hero in the arena'? Or is he just an idiot with poor judgement?

<comment><USER9> I get your point, but I think that's actually well within the scope of the quote. Someone tried to do something and failed, while onlookers point out why it was a bad idea to even try.

The quote isn't meant to absolve those who try of responsibility or even to nullify criticism; it's meant to help counter-balance the steady stream of nay-saying one is subjected to when trying just about anything with any visibility at all.

</comment></comment></comment><comment><USER10> Nothing _too_ crazy in here.

Surprised by:

* The 25k in what appears to be merch. Inclination: that's silly. Is this some crazy Kickstarter thing someone can explain?

* The ~8k in fees to LUXr, a "1 day a week for 10 weeks design residency for early-state startups". "Radically cheap", eh.

* The 1k trademark filing fee.

* That they actually spent $6k in a year at Rackspace. How many uses did they have? And ~$100/mo at Sendgrid?

On the other hand, these people paid themselves less than 1/3rd market salary, even after you account for the housing allowance.

And what do I know? I've never tried to start a social network (there's a reason for that, but...). Maybe 25k in merch is what it takes.

<comment><USER11> As far as the $25k for merch go, I believe that they had to spend quite a lot to fulfill their Kickstarter promises. Somebody had made the calculation that it would end up being fairly significant.

<comment><USER12> T-shirts for 3.5k people. Stickers and CDs for 4.5k people.

I'm estimating $15k for the T-Shirts, $1.5k for the stickers and $3.5k for the CDs. Maybe I underestimated one or several of those. $26k certainly doesn't seem unrealistic for the merch and they had to ship it. It was part of the deal.

That's actually one of negative things about Kickstarter: It can't be good that someone who should and most certainly is busy pushing out a product suddenly also has to be this expert in getting merch made and shipping it to people.

I would assume becoming that expert is not easy and being good at dealing with merch doesn't seem like a valuable skill the rest of the time – you know, when you are busy building a social network or doing whatever.

All this merch crap sadly seems to have become a staple of Kickstarter projects. Maybe it's necessary to get people to pay?

<comment><USER13> Sounds like an easy value-add for them or someone else to provide design/manufacture/drop-shipping for all the merch if you give them your logos and brief, or whatever.

They save on effort, and you take a few percent yourself. Scale means you can make better arrangements with suppliers, and quite possibly everyone comes out ahead.

Edit: to address the "is it even necessary?" question, I'd personally guess at 'yes'. Having some sort of tangible reward for your contribution, even if it's just a sticker, helps people justify the cost. Then they can wear your hat or t-shirt and get maximum indie "I funded them even _before_ they were underground" credit. Also, free(ish) advertising for you.

</comment></comment></comment></comment><comment><USER14> Although I agreed with most of Jason Fried thoughts on dispora, I thought the jury was still out. It turns out his prediction was right.

 _...That's an impressive start if victory was measured in press coverage, cash, and cool. Here's the problem: Diaspora has all the wrong things at the wrong time. Competition that kills isn't pre-announced — it catches an unsuspecting incumbent by surprise.... love the underdog, but I fear for the product-less underdog that has all the wrong things at the wrong time._

<http://37signals.com/svn/posts/2330-diasporas-curse>

</comment><comment><USER15> I've noticed a sudden, sharp rise in Diaspora's outreach efforts in recent days, ranging from activity on Facebook, to direct emails. It looks like they're trying to get things moving again, from a PR perspective.

Unfortunately, they've probably squandered a lot of that initial publicity. They had a lot of doubters from the very beginning, and now that the project has dragged on this long, I'm sure that many are dismissing the entire thing as vapourware.

<comment><USER9> >Unfortunately, they've probably squandered a lot of that initial publicity.

You know, I'm not sure if they have. People wanted to believe in this to the tune of $200k. Even two years from now, if they have arrived at something truly viable, it will be trivially easy to spin the PR wheel again. At this point, their main obstacle is demonstrating competency on the relevant technical problems and processes. If they learn to crack that nut over the course of, say, another year, then they'll be the come-back kid -- every bit as appealing an angle as their initial appeal as improbable underdogs with starry eyes.

</comment></comment><comment><USER16> So, with no money left and no business model in sight and (most important) no enthusiasm about Facebook killer and with G+ in the wild, is that the end of Diaspora?

<comment><USER17> Apparently Zuckerberg donated to Diaspora, so they must not be quite out of money yet.

<http://www.wired.com/epicenter/2010/05/zuckerberg-interview/>

<comment><USER18> I assume his donation is included in the kickstarter fund.

</comment></comment></comment><comment><USER19> is it a coincidence that this coincides with their announcement about continuing the project? I got an email an hour ago, <http://pastie.org/private/5xrgn6cmuyrylbwngvv5a>

on the topic of that email, taking credit for changing things? ha ha ha.

</comment><comment><USER20> Now, what would they have done had they only gotten the $10,000 they asked for?

<comment><USER21> Probably go around & ask for funding. The $10k is a reasonable display of consumer interest.

<comment><USER20> That brings up an interesting hypothetical. In an alternate universe, maybe the Diaspora founders applied to YC and got $20,000 (4 founders), which is double what they asked for on Diaspora. With 3 months, seed money, a lot of mentorship and advice about solving a problem and finding a market, and exposure to other startups going through the same process, where would they be now?

<comment><USER21> Probably better off. The thing is, it's a lot easier to set up a Kickstarter post than apply to YC -- at least, imho, in emotional risk.

<comment><USER22> _"... it's a lot easier to set up a Kickstarter post than apply to YC..."_

Perhaps. But let's not shortchange what an achievement having a blockbuster Kickstarter round really is. To get to $200,000 on Kickstarter, you have to work for it. You have to promote the hell out of yourself. You have to guerilla-market like a pro. The most successful Kickstarter projects -- the ones with the giant rounds of funding, well beyond their own targets -- have been the ones who got out there and drummed up interest, then brought the interest back _to_ Kickstarter. (In contrast to the folks who simply sat back and expected interest to generate _on_ Kickstarter).

It is a total myth that you can "set it and forget it" on Kickstarter, and that having a cool premise will rake in the donations on its own accord. It takes legitimate hustle.

<comment><USER21> I don't think we disagree. The partial failure mode of Kickstarter, say $5800 of the $10k you wanted; which is easier to accept than a flat "no" from YC.

Let's remember that these are pretty young kids. It's pretty easy to be intimidated.

<comment><USER22> _"The partial failure mode of Kickstarter, say $5800 of the $10k you wanted; which is easier to accept than a flat "no" from YC."_

True, although we should keep in mind that partial failure on Kickstarter = total failure. You don't receive any money from the round if you don't meet your target. If I set $10,000 as my bar, and I raise anything south of $10,000 (even $9,999), I don't see a penny.

I agree with you that this is probably not as emotionally devastating as being told "no" by some of the preeminent experts in the field of startups. (And I agree with you by and large, btw; I'm just spelling this out for others reading the thread who might not know how KS works).

</comment></comment></comment></comment></comment></comment></comment><comment><USER23> I'm not worried for them. If they're entrepreneurs they'll either work hard and make it work, pivot or if they want they'll get hired by someone.

I think they should forget about fighting Facebook and be the Wordpress of Social Networking. Ning was trying to the Wordpress.com of the space.

They could then offer the ability to create social networks like Ning did with premium features. But look at where Ning went wrong and iterate.

</comment><comment><USER24> I love the nerdiness of their salaries:

>Salaries (Four FTE @ $28.8k annually)

That's pretty awesome. Never thought about expressing it like that.

<comment><USER25> What is FTE?

<comment><USER26> Either 'Full Time Equivalent' or 'Full Time Employee'.

See <http://en.wikipedia.org/wiki/Full-time_equivalent> and/or <http://en.wikipedia.org/wiki/Full-time>

<comment><USER24> I believe Full Time Equivalent, but I was referring to the modem rating (i.e. 14.4k, 28.8k, 36.6k, 56k, etc.).

</comment></comment></comment></comment><comment><USER27> Just goes to show how much pushing a real idea out the door can actually cost - there are plenty of people out there burning this kind of cash and going broke, and never even getting the sort of media coverage these guys got.

edit: and I'm not saying they should have/could have done any better with the money they received. I donated to their kickstarter, and I don't feel like it was wasted.

</comment><comment><USER28> Serious question

Are there any people who code on this website that would work for under $30,000 a year?

<comment><USER29> They're founders, and I bet there are no shortage of founders around here who've worked for under $30k on their startups.

</comment></comment><comment><USER30> The one thing which struck me is how expensive a year's worth of cloud hosting is. No wonder there has been such a kerfuffle about "the cloud". The other costs - including rewards - are pretty much to be expected.

From my perspective decentralized social network systems seem to be succeeding, with people running them upgrading their servers to cope with the influx of Facebook and G+ exiles. However, I think that Diaspora made a few mistakes which meant that they didn't get as far as they could have in the first year. One was poor communication about what they were doing and their state of progress. Another was a poor initial choice of software which made it hard to install.

</comment><comment><USER31> The Duke Nukem Forever of social networks?

<comment><USER32> Closer to the Hurd of social networks I'd say.

<comment><USER33> Only if Hurd had giant security holes.

<comment><USER34> It probably does, but doubt anyone has bothered to check.

</comment></comment></comment></comment><comment><USER35> Super interesting. The take-home of this seems to me to be that the most expensive part is paying yourself. 100k for salaries for four people is the bulk of the expenses.

</comment><comment><USER36> Luxr Training?? Really? 28k on rewards/fulfillment??!

$6.4k Rackspace cloud hosting and there isn't even an alpha version out- WTF!

Come on -you've got to get creative and work deals. Bootstrap!!

<comment><USER37> There _is_ an alpha version out, and lots of people are using it.

<comment><USER38> are there any girls?

</comment></comment></comment><comment><USER39> Am I the only one that laughed at tge $26k spent on t-shirts and stickers?

<comment><USER40> It was part of their kickstart deal.

</comment></comment><comment><USER41> strange that Pivotal labs help to diaspora [1] doesn't figure in this PL statement. Was it all free?

[1] <http://blog.joindiaspora.com/2010/07/01/one-month-in.html>

<comment><USER42> I believe it was just free desks at Pivotal SF, and the advice that comes along with sitting next to really smart people. My guess is that yeah it was likely free.

</comment></comment><comment><USER43> I could have done a lot better with that $200k :(

<comment><USER44> Don't armchair, go do. Start a project, get funded/self fund, and prove you can do better.

<comment><USER43> I've started lots of projects... no one wants to fund and I'm a college student without funds to self-fund

<comment><USER45> These guys were in the same position...</comment></comment></comment></comment>


Ask HN: How do you organize links? - <AUTHOR> <comment><AUTHOR> I found myself with using raindrop.io, getpocket.com, Chrome sometimes place links directly to Evernote, Trello or notion.so. It's hard to keep them organize and find something when I need it. I'm wondering how people here are solving this issue

</comment><comment><USER2> I tweet the links and have them auto logged searchable at [http://www.tweetd.com](http://www.tweetd.com).

</comment><comment><USER3> I move all my organized links (bookmarks) into a folder called 'old' and make a new, better, system. Rinse and repeat every two years.

</comment><comment><USER4> I use Pocket (getpocket.com) most frequently, but often throw a link into OneNote when it's directly related to a task and for immediate use.

</comment><comment><USER5> when delicious originally shut down, I moved to google bookmarks, but I really have a hard time finding stuff in there. I would prefer to have stuff organized like a mind map

</comment><comment><USER6> Personal wiki on VPS.</comment>


Prime Minister of Singapore Coded Sudoku Solver in C++ - <AUTHOR> http://www.pmo.gov.sg/mediacentre/transcript-speech-prime-minister-lee-hsien-loong-founders-forum-smart-nation-singapore <comment><USER2> The relevant excerpt from the speech:

        40 years ago, after doing a math degree, I went on to study computer
        science, on my father's advice.  He said there is a future in that, and he
        was right.  So for the Smart Nation Programme Office, I have put Minister
        Vivian Balakrishnan in charge, reporting to me.  Vivian is both a hacker
        and a dabbler – He used to be an eye surgeon but since he does not get to
        operate on eyes nowadays, he dabbles in building simple robots, assembling
        watches, wireless devices and programming apps.  His day job is to be the
        Minister for the Environment and Water Resources, and so when he builds
        apps, he uses the real time APIs generated by the Ministry.  That's called
        user-testing.  I used to enjoy this; it is a long time since I've done
        anything.  The last programme I wrote was a Sudoku solver in C++ several
        years ago, so I'm out of date.  My children are in IT, two of them – both
        graduated from MIT.  One of them browsed a book and said, "Here, read
        this".  It said "Haskell – learn you a Haskell for great good", and one day
        that will be my retirement reading.

What's amazing is not just the bit about having written C++ code but the fact that he used the term hacker propely and knows what Haskell is. Interesting.

<comment><USER3> As a Singaporean, I'm pretty proud of the direction of my government, and I'm pretty surprised by the Haskell/LYAHFGG & C++ namedrops. How did Minister Balakrishnan even find the time to dabble with hardware and programming? These top civil servants are very, very busy!

Great quote about Singapore citizens trusting the government to do their taxes:

 _"...we introduced electronic tax-filing back in 1998, since ages ago, before anyone else did it, and today, 97% of tax payers file their taxes online. Because we have kept our tax code simple, you do not need to buy Quicken, Intuit or any of such things. Also, because we have automate the collection of information and populate the table for you, you do not need to work quite so hard – it is a little harder to cheat and so 3 in 5 taxpayers do not even bother about filing taxes. They just take in on trust that our Inland Revenue Authority of Singapore has done their sums right. So e-Government works in Singapore."_

That said, the 3 verticals of the whole Smart Nation programme (the elderly, transport & data) seem somewhat orthogonal to much of the SV-style explosive- growth consumer apps. Yet those consumer-app areas are where many SV-style fortunes are made and where young tech entrepreneurs want to go - so there's a disconnect between the two directions.

For example, I don't see massive adoption of a new app/device by the elderly happening very easily - they largely (1) don't know English, (2) aren't used to relying on tech so heavily, and (3) won't be able or willing to pay much for it. It tends to be younger people who try new things - and in fact Singaporeans are relatively less adventurous than Americans or other Asian cultures in adopting new apps/services. Things might be different if Singapore were as big as the US, but it isn't. So I wonder how the Smart Nation thing will play out - maybe the biggest customer will be the Singapore government instead of end-users.

(Tangentially, it's personally been a bit frustrating that the VCs that draw on government money seem to prefer e-commerce/B2C apps instead of industry- specific B2B software. The government puts its money where its mouth is, but still relies on VCs to make the picks...and those guys go for hot, mainline trends. So fundraising has been difficult.)

<comment><USER4> Wonder if you have FoxNews or a similar variant in Singapore? Do they characterize the Prime Minister as a professorial egg-head elitist out of touch with the common man?

If not you have something to look forward to, in the early days of our republic, we generally appreciated educated statesmen. Now we prefer our elected officials to be fun-loving guys next door who see the internet as a system of tubes.

<comment><USER5> Singapore is a one party state with a terrible human rights record. If anyone criticized the government, they would be thrown in prison and/or fined.

<comment><USER6> Singaporean here, have criticized the govt multiple times, protested govt policy, am doing perfectly fine, thanks!

</comment></comment></comment></comment></comment><comment><USER7> Cambridge professor about Lee Hsien Loong:

"No, he was truly outstanding: he was head and shoulders above the rest of the students. He was not only the first, but the gap. I think that he did computer science (after mathematics) mostly because his father didn't want him to stay in pure mathematics. Loong was not only hardworking, conscientious and professional, but he was also very inventive. All the signs indicated that he would have been a world-class research mathematician."

"I'm sure his father never realized how exceptional Loong was. He thought Loong was very good. No, Loong was much better than that. When I tried to tell Lee Kuan Yew, "Look, your son is phenomenally good: you should encourage him to do mathematics," then he implied that that was impossible, since as a top- flight professional mathematician Loong would leave Singapore for Princeton, Harvard or Cambridge, and that would send the wrong signal to the people in Singapore. And I have to agree that this was a very good point indeed."

[http://therealsingapore.com/content/cambridge-professor- lee-...](http://therealsingapore.com/content/cambridge-professor-lee-hsien- loong-could-have-been-outstanding-mathematician)

<comment><USER8> Just one nitpick: his family name is Lee. Loong is just a half of his given name. So calling him Loong is a bit weird.

<comment><USER7> His father also called him Loong (not Hsien Loong), at least sometimes:

"He was still young and it was better that someone else succeed me as prime minister. Then, were _Loong_ to make the grade later, it would be clear that he made it on his own merit."

[http://www.singapore-window.org/sw04/040531a1.htm](http://www.singapore- window.org/sw04/040531a1.htm)

(They use English in the family, although Lee Hsien Loong can speak Chinese fairly well.)

<comment><USER9> His father called him by his first name, that sounds expected.

<comment><USER10> Hsien Loong is his first name. Chinese usually don't have middle names. Calling him "Loong" is the equivalent of calling Tommy Tom. But it's more intimate, usually only used by someone closer to the person.

</comment></comment></comment></comment></comment><comment><USER11> Singapore is a great place. Very meritocratic, high-tech, modern and forward- looking but it _is_ a sort of benevolent dictatorship.

This is Lee Hsien Loong, the son of Lee Kuan Yew who built up Singapore (obviously a brilliant leader but also, with little oversight, worryingly quick to jail his critics). The People's Action Party (PAP) has been in power since Singapore's formation and opposition party leaders have found themselves in jail or sued into bankruptcy. Benevolent dictators and dynasties work great until they don't.

It will be interesting to see how Singapore fares a few leaders down the line. Hopefully pretty well and more politically tolerant; as it's a nice place with great, talented people!

<comment><USER12> I was in Singapore this year and it's a fantastic place, but it is very artificial. Citizens have a hard time communicating with each other through the 4 very different official languages.

People are also on edge about immigration and the peaceful multicultural facade hides a darker side of racism in Singapore.

<comment><USER13> This is an interesting comment, thank you for the perspective.

I think you mean 'facade' where you wrote 'fasard'? I don't want to assume, though -- it might be a word I don't recognize, or transliteration -- honestly asking.

<comment><USER12> You're right. Written in haste and not proof read.

</comment></comment></comment></comment><comment><USER14> This isn't that surprising. Lee Hsien Loong studied at Trinity College, Cambridge, where he was Senior Wrangler, and graduated with a first class honours in mathematics and a Diploma in Computer Science (with distinction).

He's mentioned in the past that he briefly considered a career in academia (Mathematics). That didn't happen, of course. (source: [http://www.moe.gov.sg/media/speeches/2003/sp20030603.htm](http://www.moe.gov.sg/media/speeches/2003/sp20030603.htm))

<comment><USER15> > where he was Senior Wrangler

For those unfamiliar with the term, this is a _huge_ achievement.

[http://en.wikipedia.org/wiki/Senior_Wrangler_(University_of_...](http://en.wikipedia.org/wiki/Senior_Wrangler_\(University_of_Cambridge\))

<comment><USER16> I edited the wikipedia entry to include that even a prime minister was Senior Wrangler not only leading mathematicians and physicists. Good career prospects. I can only think of recently killed Russian opposition politician Boris Nemtsov with similar mathematical achievements.

Angela Merkel (Kasner) also won a mathematics price during her physics doctorate studies, before she elected to work in agitprop and most likely as master stasi spy under the codenames ANITA and Black Widow. Which brings me to the theory that being a spy will help you more getting to a prime minister job (Putin, Merkel), than being an excellent mathematician.

</comment></comment></comment><comment><USER17> Well, I know that this may sound unpopular, but Singapore is one of key examples why technocracy may be better than democracy.

In democracy, it's popularity contest. It may be influenced by politicians' technical skills; though, much more often it's influenced by their ideologies. (If you think that popularity is the same as merit, then look at which current songs are the most popular.)

And a large group of people have tendency to be biased towards short-term goals rather than long-term progress.

<comment><USER2> Being an Indian (ie: coming from the largest democracy in the world), I have formed the opinion that democracy is a form of government where in theory everybody is happy most of the time but unfortunately what it instead does is keeps everybody equally unhappy, all the time.

Now, whether this is necessarily a bad thing considering the alternatives is debatable but coming to your point, yeah, something like Singapore just cannot happen in a democracy although it is not due to the short-sightedness of the 'large group of people'.

In a proper democracy the minority opinion (note, I said minority opinion, not minorities' opinion) no matter how flawed and unreasonable would still have to be considered. Again, this is not necessarily a bad thing, it just slows things down (in either direction !)

<comment><USER18> I don't see any particular reason why a democracy cannot have tech-savvy leaders. As often pointed out Angela Merkel was a chemist before becoming the German Chancellor. Margaret Thatcher was also a chemist, I believe. Germany is by all accounts very well run and is indeed a very tech-savvy and productive economy.

I don't know anywhere else that has a computer scientist as a leader, but then again, I suspect that's because most people who have a passion for mathematics or computer science end up going into that field. Virtually nobody it seems decides to leave the CS world for politics. This guy did only because of the whole dynastic element - his father told him what he'd do in life, so he was never able to pursue his skills in this field.

Sometimes I wonder if some of the political problems we often debate here on HN and elsewhere are our own fault. So few people enter politics from the tech and science industries, it should perhaps not surprise us much when technically illiterate leaders pass nonsensical laws .

<comment><USER19> Not exactly a computer scientist, but I am hoping Sheryl Sandberg runs for the office of President in the next decade.

</comment></comment></comment></comment><comment><USER20> Like many people in tech, I've come to the conclusion that managers need to have done at least one component of whatever they're managing. Hopefully the critical component, if there is one.

This is just as true for politicians, and I think this guy is a great example. All this talk about advancing STEM education in the West, but which country is leading? The one where the leader is a top STEM graduate.

Anecdata: I've been to Singapore several times, have loads of friends there. They really are better educated than your average western adult.

<comment><USER21> The following thought amused me:

The USSR had control over everything back in the day, though the hard sciences and their people had great latitude and somehow enjoyed more freedom compared to those in other domains. They were like little precious princesses.

That's because hard sciences are, well, too hard for your average Soviet dictator to understand, control, and screw up. Not hard enough, apparently, for the average Western politician in 2015.

<comment><USER22> > The USSR had control over everything back in the day, though the hard > sciences and their people had great latitude and somehow enjoyed more > freedom compared to those in other domains.

This was born out of necessity: the hard sciences were the weapons program, first and foremost. Then, there's usually not much to argue in material world from Communist POV. Unlike the soft/social sciences where there's much bigger potential for subversive.

That said, they never had more "latitude" than their Western colleagues. There were waves of crackdowns on supporters of relativist physics, on computer science, on genetics. Korolev, the champion behind the Soviet space programme, died from kidney condition resulting from his prison camp labor.

</comment></comment></comment><comment><USER23> He also published a paper on economics quite a while back ([http://www.jstor.org/discover/10.2307/1882634](http://www.jstor.org/discover/10.2307/1882634)) on externalities. Not surprising, given the proactive Singapore government.

</comment><comment><USER24> Woohoo Singapore represent! Ok serious question though: is he the only world leader that can code?

<comment><USER25> Merkel was a physicist, so one would assume she has written at least some code.

<comment><USER26> Merkel wrote Fortran code for her PhD thesis. [1]

Afaik she approximated the Schrödinger equation to compute the rate of decay of molecules with up to 6 atoms.

This [2] is the last physics paper of her (from 1990). After the wall fell, her interests changed quite a bit... Only political papers from then on.

[1] [http://www.file-upload.net/download-9106454/AM- Diss.pdf.html](http://www.file-upload.net/download-9106454/AM-Diss.pdf.html)

[2] [http://dx.doi.org/10.1002%2Fqua.560380214](http://dx.doi.org/10.1002%2Fqua.560380214)

</comment></comment></comment><comment><USER27> He got Cambridge Diploma in Computer Science.

[1][http://en.wikipedia.org/wiki/Lee_Hsien_Loong#Background_and_...](http://en.wikipedia.org/wiki/Lee_Hsien_Loong#Background_and_education)

</comment><comment><USER28> Jump to the sudoku solver section: [https://www.youtube.com/watch?v=49YeHvJ6yZg&t=9m33s](https://www.youtube.com/watch?v=49YeHvJ6yZg&t=9m33s)

</comment><comment><USER29> Charlemagne didn't know how to read for most of his life, and was studying assiduously in order to become literate at the time of his death; nowadays that would be unthinkable. But today we're in the same situation with most of our political leaders and programming: Obama was able to remember at least that bubble sort was the wrong way to sort a million integers, but didn't even come close to the constant-time radix sort you'd want to use (if we're talking about fixnums, not bignums). A lot of people will use this situation to argue that dictatorship is better than democracy, since Singapore has dictatorship and smart leaders, while the democratic world generally has programming- illiterate leaders (except Merkel, apparently), but that seems to be more a coincidence than anything else — Lee's level of competence is as much an anomaly among dictators as it would be among democratic leaders.

Political leadership (whether in a democracy or in a dictatorship) is about persuading people to cooperate with each other, not about reading and writing, except perhaps as a means to that persuasion, and not about programming, either. But the extent to which you can rightly aim your cooperative efforts depends crucially on your understanding of the world in which they will play out, and when it comes to that, political leaders lacking basic informatics competence are as mentally crippled in the 21st century as an illiterate political leader like Charlemagne would have been in the 19th. Nobody really occupies the role of "history's actors" that Karl Rove believed he was in. We are all constrained to be in the reality-based community, or fail as he did.

<comment><USER30> It's just culture. The U.S., maybe the Anglosphere in general, lacks the same esteem for engineers and technologists that much of the rest of the world has. So you're less likely to see such people rise in American politics. I don't think it's a matter about democracy vs. technocratic dictatorships. Ahmadinejad was a civil engineer, Angela Merkel was a research scientist, and who's the only presidential candidate with a CS degree in the 2012 elections? Herman Cain.

</comment></comment><comment><USER31> And please don't forget, at an annual salary of $1.7 million USD [1], Mr. Lee Hsien Loong is also the world's HIGHEST PAID prime minister.

So I am not surprised that he should have some additional chops to be amongst the highest paid world political leaders.

[1]: [http://en.wikipedia.org/wiki/Lee_Hsien_Loong#Salary](http://en.wikipedia.org/wiki/Lee_Hsien_Loong#Salary)

</comment><comment><USER32> This guy is such an inspiration. Perhaps a different side of Politics. Well at least from where I come from originally.

He wants to build a data marketplace, invest in tech R&D )since 2010). OH and he also programs in Haskell.

I mean this is amazing how he have dedicated so much for this topic.

</comment><comment><USER33> Meanwhile, Obama has a child teach him how to open the Processing.org IDE. Meh, maybe the future is brighter though considering Hiliary knows how to setup her own mail server.

<comment><USER34> Maybe we should require the same of each congressman and senator, then come back to this question.

</comment></comment><comment><USER35> What about Stephen Harper. Haha. Computer science should be part of all prime minister's knowledge. It brings rationality and analytic thinking.

</comment><comment><USER16> But he calls his sysadmins a "Cyber Security Agency". Looks like typical government overreach to me.

</comment><comment><USER36> My father, a machine engineer, built a wooden chair out of oak last week

</comment><comment><USER37> LoL, amazing!

</comment><comment><USER38> Singapore keeps impressing me.

<comment><USER39> How so?</comment></comment>


ComcastifyJS – Sometimes images just load too damned fast - <AUTHOR> https://theonion.github.io/comcastifyjs/

<comment><USER2> Love that the onion uses humor to recruit. Too bad it's not something that's actually useful somehow as well!

<comment><USER3> It could be useful for people campaigning for net neutrality if they want a "This is what downloads may become like:" with an image on their site.

</comment></comment><comment><USER4> I posted this yesterday. [https://news.ycombinator.com/item?id=8305709](https://news.ycombinator.com/item?id=8305709)

</comment><comment><USER5> It needs a whitelist of giant corporations like Netflix that acquiesce to Comcast's fees. Images should only load slowly on poor websites.

<comment><USER6> Here: [https://github.com/theonion/comcastifyjs/pull/5](https://github.com/theonion/comcastifyjs/pull/5)

</comment></comment><comment><USER7> It's friday, just one last push to add comcastifyjs.fixMyImagesLoadingSoFast() to the build process before the weekend...

</comment><comment><USER8> This appears to be the code behind "These Koalas Are Refusing To Load In Support Of Net Neutrality": [http://www.clickhole.com/article/these-koalas- are-refusing-l...](http://www.clickhole.com/article/these-koalas-are-refusing- load-support-net-neutral-967)

</comment><comment><USER9> Yeah if developers could keep their protests within US - that would be great.

<comment><USER10> Because net neutrality is an issue only faced in the US, right?

<comment><USER9> Factually - yes?

</comment></comment></comment><comment><USER11> Comcast is a trademark. Perhaps it could be exempted as a parody, but if this got popular I would expect a DMCA takedown.

<comment><USER8> DMCA covers copyrights, not trademarks.

Anyway, I'm sure The Onion would love to get a C&D from Comcast. They'd have a field day with that.

</comment></comment><comment><USER12> This just took me back deep into memories of looking at porn in the 90s.</comment>


Flexible, secure SSH with DNSSEC - <AUTHOR> https://blog.cloudflare.com/flexible-secure-ssh-with-dnssec/ <comment><USER2> The whole tower of Hanoi in pubkeygrab.sh script, complete with two greps and a sed could be replaced with just sed:

      unbound-host -v -D -t TXT ${USER}_pubkey.example.com \
       | sed 's/.*has TXT record "\(ssh-.*\)" (secure)/\1/p;d'

Or, even without sed, reducing to one-liner:

      dig +short +dnssec +sigchase txt $1_pubkey.example.com

EDIT: to address "wtf" concern by ryanlol, we can use a custom trust anchor:

      dig +short +dnssec +sigchase +trusted-key=/etc/my.key txt $1_pubkey.example.com

</comment><comment><USER3> Wait, what the fuck? Is this for real?

Here's the sample code cloudflare posted:

      foo:~$ cat /usr/local/bin/pubkeygrab.sh
      #!/bin/sh

      USER=$1

      /usr/sbin/unbound-host -v -D -t TXT ${USER}_pubkey.example.com \\
           | /usr/bin/grep -v "no TXT record" \\
           | /usr/bin/grep ' (secure)' \\
           | /usr/bin/sed 's/.* "\(.*\)" (secure)/\1/'

They aren't actually doing any authentication besides DNSSEC , giving the people managing the TLD and your registrar root access to your server doesn't seem like such a good idea.

I seriously hope I'm missing something here, but with cloudflares security track record that seems pretty unlikely.

Edit: Made the mistake of assuming that grep was actually supposed to do something here, it doesn't actually do anything at all.

<comment><USER4> The registrar only has your public key and Cloudflare handles the private one for you. If you distribute the public key to your servers as part of the validation this means that your largest risk is actually a breach in Cloudflare.

I really really trust them, they have an impressive history of contributions to the web and commitment to security. If your servers are behind another access control layer, like a corporate VPN, this shouldn't be a big concern, since they would have to disclose breaches anyway.

Finally, I think this interesting because basically DNSSEC gives you an easy way to distribute data globally in a secure way with a TTL. This is the best benefit compared to using certificates for access control where revocation is usually very painful.

Consider this an initial look on how to use those benefits of DNS. I agree another layer of security would be great. Think something like asymmetric signature of the actual TXT record so that DNSSEC helps control expiration and then the other key validates origin. You are using DNSSEC only for the benefits of TTL validation.

<comment><USER4> I'd like to clarify that there's a _major_ issue to consider. Here's my comment on the article explaining:

Cloudflare delivers signatures for records that last more than the TTL of the record. This has the problem of replay attacks. If one employee that had access at some points configures a machines DNS to return an old DNS response it will be valid until the expiration of the signature, hence having access for more time than the actual TTL.

I just checked and Cloudflare generates signatures expiring +2 days in the future. This means that I have a TTL of 5 minutes on my record but the client is receiving old queries, authentication would pass without a problem for as long as the RRSIG is valid.

Ideally Cloudflare should sign every record with the same frequency as the records TTL, that would solve the issue.

After finding this out I think you should _not_ use Cloudflare's DNSSEC because revoking access to a user wouldn't be 100% effective until the RRSIG expiration date given the replay attack scenario.</comment></comment></comment>


The 7 years of lies about Assange won't stop now - <AUTHOR> https://www.jonathan-cook.net/blog/2019-04-11/julian-assange-lies-arrest/ <comment><USER2> Ecuador also received 4.2 billion from the IMF this week. What timing.

[https://www.imf.org/en/News/Articles/2019/03/11/ecuador- pr19...](https://www.imf.org/en/News/Articles/2019/03/11/ecuador-pr1972-imf- executive-board-approves-eff-for-ecuador)

</comment><comment><USER3> Well spoken. God it's going to be a dark world if assange isn't a free man in a year.</comment>


Nope, China's economy hasn't yet surpassed USA - <AUTHOR> http://qz.com/278012/nope-chinas-economy-hasnt-yet-surpassed-americas/

<comment><USER2> That is pretty much in line with what the CIA believes

[https://www.cia.gov/library/publications/the-world- factbook/...](https://www.cia.gov/library/publications/the-world- factbook/rankorder/2001rank.html)

<comment><AUTHOR> Good point! The original article compared by PPP not GDP, but both would be a reasonable way to make a broad comparison.

Here is a link on the same subject with GDP

[http://www.bloomberg.com/news/2014-04-30/china-set-to- overta...](http://www.bloomberg.com/news/2014-04-30/china-set-to-overtake-u-s- as-biggest-economy-using-ppp-measure.html)

Either way it paints a picture.</comment></comment>


Facebook, Axios and NBC Paid to Whitewash Wikipedia Pages - <AUTHOR> https://www.huffpost.com/entry/wikipedia-paid-editing-pr-facebook-nbc-axios_n_5c63321be4b03de942967225 <comment><USER2> _A few people, however, have figured out how to manipulate Wikipedia's supposedly neutral system to turn a profit._

Neutral system? A few?

Let's not kid ourselves here. Wikipedia is filled with bias. Yes, there are some informative articles and it's great that some people have spent a sizable chunk of time tending to the garden. But there's a lot of stuff missing, and the problems of new contributors being shut out or shut down is well- documented ([https://www.technologyreview.com/s/520446/the-decline-of- wik...](https://www.technologyreview.com/s/520446/the-decline-of-wikipedia/)).

As for paid/planted content, it's easy to spot certain types (fawning celebrity or corporate profiles) but others are far more subtle. And sometimes when I'm reading an apparently well-researched article on a technical, historical, or scientific topic, I wonder if some contributor way down the line had an axe to grind or is outright messing with audiences by inserting bogus information.

<comment><USER3> Basically every history article is heavily biased, just compare the different language versions.

<comment><USER4> Pretty much every political or corporate sensitive topic has heavy bias. Even biology related topics are subject to external pressure from journalists, politicians and activists. There have been huge fights over how fetus, gender, sex, etc are defined on wikipedia.

And it isn't just wikipedia, it's all of social media and pretty much all of the internet. From silly nonsense like movie reviews to serious matter like war footage, if it has political or financial impact, it is subject to heavy censorship and bias.

<comment><USER5> Reminds me of when Bradley Manning's wiki page turned to Chelsea Manning within seconds of the announcement. It was unreal. It was like there were an army of activists ready to pounce as soon as the announcement was made and the article was quickly locked.

I've seen other, more important, news take much longer to update (hours) on their main pages.

<comment><USER6> The way Wikipedia works you don't need an army of activists - just one enthusiast to edit it. The important news probably took longer because no one was very interested. That's how it works with volunteers.

</comment></comment></comment></comment></comment><comment><USER7> Wikipedia reflects what people believe to be the Truth, so historical or news are often filled with mistakes and half-truths. My favorite wikipedia deletion was an armchair historian who would correct common myths, such as Canada did not have Troops in the Vietnam war. He would even link to the Canadian military site that listed medals to soldiers station in Vietnam.

He kept getting all his updates reversed, as the perceived fact was the only one allowed. His proof was discarded.

He finally gave up, and only updated his personal comment page. And then the wikipedia did a personal page purge to stop searches from showing personal pages. Coincidence? I doubt it.

Those who control the history books they say.

</comment><comment><USER8> If people are this open and brazen about it then ultimately we have passed the point of usefulness. This can be seen in social media vote farms where you pay for exposure. Once they start appearing en masse then it is the death knell of the platform.

This also has a chilling effect on free speech and what an individual is allowed to know about an organization, person, company etc. As any 'trusted' source of information is now spoiled.

The way we get ahead of this is do what the internet forefathers wanted to do to any problem... re-route. There are wiki clones and methinks their popularity will only grow now.

This should be the chief concern for Jimmy Whales and the Wikimedia foundation if they actually cared about providing 'an encyclopedia for all' because they are no longer providing a platform for learning but rather just another corporate blog.

<comment><USER9> > The way we get ahead of this is do what the internet forefathers wanted to > do to any problem... re-route. There are wiki clones and methinks their > popularity will only grow now.

It's wishful thinking. In the software and internet world, once something is entrenched, it's rarely removed from first position unless it no longer serves its primary purpose to its main audience. Which Wikipedia does.

It's a bit like Facebook vs Mastodon. Ask your non-techie friends about Mastodon and they'll probably go: that was a sort of elephant or dinosaur, wasn't it?

<comment><USER10> I'm amazed of how many people share this "once stablished things never change" mentality in this forum.

Most of the people reading here are either thinking of or trying or actually becoming living proof that this way of thinking is wrong.

Maybe instead of asking non-techie friends about mastodon we should be asking kids about myspace..

<comment><USER9> Myspace popped up before the market was mature and it definitely didn't have 80% market share all across the globe.

Facebook might fall on its own due to user fatigue. But it will still have 1 billion users 20 year's from now :)

</comment></comment></comment></comment><comment><USER11> Can someone link to a particularly egregious example of an untrue/non-POV/non- verifiable Sussman edit, or an in-bad-faith comment? So far the ones I see are basically reasonable.

<comment><USER12> Yeah that's kindof a weak argument.

That's like saying "Did the judge who took a bribe say anything unreasonable in their ruling?" or like saying "Did the academic study that was paid for a big corporation without disclosing make any logical leaps?"

Any paid, undisclosed influence is wrong, period. And almost certainly against TOS.

<comment><USER11> > That's like saying "Did the judge who took a bribe say anything unreasonable > in their ruling?

In fact, it's much more like the _attorney_ is paid, which is considered fine in courts. Indeed, having contributors who are potentially biased, but who each argue their point and agree to a method of conflict resolution, is considered one of the most powerful methods of seeking truth. It's also used in academics, where each researcher bring their own biases to the table.

> Any paid, undisclosed influence is wrong, period.

I guess you didn't read the article? The paid influence was disclosed.

<comment><USER13> >In fact, it's much more like the attorney is paid, which is considered fine in courts.

In theory (though tbf not in reality) everyone has the right to an attorney. AFAIK there is no corresponding right to a paid Wikipedia editor.

>> Any paid, undisclosed influence is wrong, period.

>I guess you didn't read the article? The paid influence was disclosed.

"But the plans were on display…" "On display? I eventually had to go down to the cellar to find them." "That's the display department." "With a flashlight." "Ah, well, the lights had probably gone." "So had the stairs." "But look, you found the notice, didn't you?" "Yes," said Arthur, "yes I did. It was on display in the bottom of a locked filing cabinet stuck in a disused lavatory with a sign on the door saying 'Beware of the Leopard."

Wikipedia articles with significant edits from paid PR hacks need a big red warning sticker.

</comment></comment></comment></comment><comment><USER14> >casual racism depository Nextdoor

I think Sussman is getting edits approved because (at first glance) they're substantially better written and still fall within the bounds of dispassionate writing.

Maybe Huffington Post could use some lessons in that, if their idea of journalism is to randomly drop not-dispassionate digs at Nextdoor with neither context nor justification.

<comment><USER15> Sussman isn't "getting edits approved". He is literally bribing other editors in open.

Ever wrote anything on Wikipedia talk pages? Unless you are commenting on article with hundred thousands of daily views, your comments will remain ignored for years. Nobody is going to "implement your suggestions" or "accept corrections", —at best you will be ignored, and at worst you will be told to f##k off in Wikipedia's politically correct newspeak.

Who are the people, implementing his changes to pages? A certain number are of course bots and sock puppets. But relying on those exclusively is risky, and he would eventually get discovered and singled out by mods and check-users. So _some_ of his editors got to be real people. Does he have an actual team of editors working on keeping articles updated full time through series of proxies? Probably not, — would be too expensive and also prone to ban.

Let's perform a mental experiment: you are a poor sod in Cambodia/North Korea/Thailand etc. who have recently discovering a beauty of Wikipedia. You look at the talk page of "Facebook" article and stumble upon comments of some guy, who says, that he is a representative of dedicated PR company. You make some quick calculations: your daily wage is several orders of magnitude smaller than average US wage, and the guy is probably getting paid A LOT of money by Facebook and the likes; going to darknet to regularly buy a new bunch of "proxies" (hacked computers in US residential areas) will costs you $XX per month; if you get him to pay you $YY, the rest of money will be your net profit...

You can guess the rest.

</comment></comment><comment><USER16> Sussman's Wikipedia contribution history is available here: [https://en.wikipedia.org/wiki/Special:Contributions/BC1278](https://en.wikipedia.org/wiki/Special:Contributions/BC1278)

<comment><USER8> That you know of. Who knows how many sock puppet accounts they may have.

Heck it could even be an additional fee 'well for an extra 10k I will create a new personality that isn't tied to anything'

<comment><USER17> That's what I would suspect. The main thrust is above board but why not tip the balance by corrupting Wikipedia editors or having a shadow stable of editors.

</comment></comment></comment><comment><USER18> The problem is that all sources of information are biased. And it's worse than that. People you meet on the street are biased. Your own friends are biased. I'm biased. People that claim they're unbiased are _definitely_ biased.

Everyone has an angle, everyone has their own personal and cultural historical baggage that's going to color their perception of everything from commercials to politics.

It's up to you to think critically, get information from multiple diverse sources, and form your own (biased) opinion, and always, always, be skeptical.

<comment><USER19> That requires a level of media and information literacy that is evidently uncommon in the general public.

</comment></comment><comment><USER20> For seven years, what I strongly suspect is paid astroturfing has been up on wikipedia for one of the largest hotel/casino conglomerates on the Las Vegas strip:

[https://en.wikipedia.org/wiki/Talk:Las_Vegas_Sands](https://en.wikipedia.org/wiki/Talk:Las_Vegas_Sands)

It surprised me that nobody had added the "reads like an advertisement" template in all that time, so I did. Get out there and be vigilant.

<comment><USER6> Wikipedia works quite well in spite of that though.

The Sands article looks like it was written by a company employee / PR which I'm not sure is quite astroturfing. Depends on your definitions I guess.

It reminds me of a page I put up on the company Algenol which I thought interesting as it was trying to make ethanol direct from algae and sunlight and saying it would be cheaper than regular fuel. Then the whole thing got rewritten by someone like Algenol's PR and someone flagged it but I couldn't be bothered to re-edit the whole thing - takes ages. Then Algenol kind of failed, fired the boss and went on to other things. Not sure how the page is now.

</comment></comment><comment><USER21> What a defence "I'm not the bad guy for robbing people's houses, the real bad guys rob _and_ assault the occupants..."

</comment><comment><USER22> I'm surprised Wikipedia doesn't simply ban any communication through the Wikipedia platform itself between a person awaiting edit approval and others who could approve it.

Similarly, why not put a strict word count limit on discussion on Talk pages. If you can't make a rebuttle succinctly, then the risk of Talk page filibustering is too high and mitigating that risk matters more than letting people write diatribes of objections to decisions about edits.

<comment><USER23> I disagree. I was surprised the conversations were public and visible on the website itself.

What would be more scary, and probably happens already in other cases, is if nefarious editors organized via private channels.

</comment></comment><comment><USER24> This has been going on a very long time. Just take a look at any politicians Wikipedia page.

<comment><USER25> If you really want to see history rewritten on Wikipedia look at articles on US wars. Especially those about WW2 japan or war crimes by US GIs.

</comment></comment><comment><USER26> Does anyone take Wikipedia seriously at this point?

Calling Wikipedia 'neutral' is comical, it's full of opinion, ideology, bias, misinformation, disinformation, astroturfing, and other nonsense noise and utter garbage.

<comment><USER27> I wouldn't bet my PhD on it, or get the entirety of my education on a complex subject from it. Though it has a TON of factually correct statements. It is a good starting point for a ton of stuff, and I would never wish it to be gone.

</comment></comment><comment><USER28> There's been a couple times that I've revisited a Wikipedia article and noticed that someone had erased a negative section about a person or organization. I've always wondered if it was organic or part of a larger for- pay effort

</comment><comment><USER29> My project, the news aggregater Cited News ([https://cited.news/](https://cited.news/)), uses Wikipedia references as source for news.

<comment><USER30> Cool project, but I don't see the link with the article apart from being related to Wikipedia. It might be better off as a Show HN.

<comment><USER29> I tried adding it: [https://en.wikipedia.org/w/index.php?title=Facebook&type=rev...](https://en.wikipedia.org/w/index.php?title=Facebook&type=revision&diff=887903150&oldid=887791830)

The article is dated on 14. of March though, so it should not appear on the front page but here: [https://cited.news/wikipedia_pages/date/2019-03-14](https://cited.news/wikipedia_pages/date/2019-03-14)

</comment></comment></comment><comment><USER31> Blindly trusting what you read on Wikipedia is like blindly trusting what you read on the media. And I don't think there's much we can do to avoid it. Because conventional wisdom says more education will fix it. But wasn't there a study that showed that even highly educated people believe anything that confirms their biases?

<comment><USER32> I'm currently reading _Manufacturing Consent_ which to me shows how dangerous blindly following the mass media can be in a rigorous manner without requiring one to become a conspiracy theorist.

There's certain ways to effectively critically read newspaper articles that I was taught at a young age and it's definitely a learned skill that I wish the US education system did better with.

<comment><USER33> > without requiring one to become a conspiracy theorist.

People conspire all the time, so shouldn't any sane person suspect some conspiracies?

Hijacking the word "conspiracy theorist" to mean nut job seems like exactly the twisting of reality you are advocating to avoid.

<comment><USER34> In this context, I interpret "conspiracy theorist" as someone who thinks there are relatively large groups of people conspiring, without the majority of people being aware of that. A small conspiracy when playing Diplomacy is believable, but e.g. one in which everyone behind mass media has agreed to put forward a certain message is not.

Thus (not having read it myself), Manufacturing Consent could show how emergent properties of mass media might lead to them pushing a certain incorrect world view, rather than proposing a theory that requires the teams behind them to all agree to conspire and none of them to make that public knowledge.

<comment><USER35> > Thus (not having read it myself), Manufacturing Consent could show how > emergent properties of mass media might lead to them pushing a certain > incorrect world view, rather than proposing a theory that requires the teams > behind them to all agree to conspire and none of them to make that public > knowledge.

That is right. Chomsky proposes 5 filters through which this process happens. These filters operate, according to Chomsky, not just in media, but in all of society. From kindergarten to our deadbeds.

I think this was best illustrated with Chomsky's 1996 interview in "The Big Idea" on BBC by Andrew Marr. Chomsky is outlining how the filters make sure certain viewpoints are popularized, and Andrew Marr asks "How can you know that I'm self-censoring?". To which Chomsky replies "I'm not saying you're self-censoring. I'm sure you believe everything you're saying. But what I'm saying is, if you believed something different, you wouldn't be sitting where you're sitting."

The 30 minute episode[1] is well worth a watch, but the three minute clip of the above exchange is also available[2].

[1]: [https://youtu.be/GjENnyQupow](https://youtu.be/GjENnyQupow) [2]: [https://youtu.be/lLcpcytUnWU](https://youtu.be/lLcpcytUnWU)

</comment></comment></comment></comment></comment><comment><USER36> Here's a suggestion: _Allow each user to do only a certain amount of editing within a time period._ Of course there are technical difficulties with this, but if done right this would pretty much guarantee that edit farms and paid actors are much less useful. Wikipedia as a whole would probably be much more useful in the long run, since there are an absolutely massive long tail of experts in every conceivable field.

<comment><USER37> There's a long tail, but my understanding is that there's a core wikipedia contributor community who contribute a staggering number of edits[1]. If wikipedia limited the number of edits that each user could do, they would anger their core community. It would be similar to youtube putting a limit on the number of views each video was allowed to get. It would be suicide via the destruction of their tribe.

And I don't even know if it would work that well. Per-IP edit limits would only stop PR companies with deep pockets for so long. They would do what the russians do, and just make account farms.

[1] Or so I've been told. I'd love to see actual stats on this. It probably follows a Pareto distribution; but with what power? [https://en.wikipedia.org/wiki/Pareto_distribution](https://en.wikipedia.org/wiki/Pareto_distribution)

<comment><USER25> >They would do what the russians do, and just make account farms.

I'm sure whitehatwiki.com would have been called exactly that if it were from Russia or China.</comment></comment></comment>


How to deploy an app to production with an actual button - <AUTHOR> https://blog.github.com/2018-08-16-how-to-deploy-to-production-with-an-actual-button <comment><USER2> Just make sure your build server's lava lamp is green.

</comment><comment><USER3> Hate to say it, but my first thought upon reading the headline was, "You mean, like, the return key on my keyboard??" But that's no fun at all – I actually love the spirit of this post.

<comment><USER4> _" You mean, like, the return key on my keyboard??"_

No.

The difference is that if you're using your keyboard you're very likely not to bother doing things like implementing defensive checks, reproducible and deterministic steps, good rollbacks that you've actually tested, etc. You're using your computer, so just tweaking a setting or adding in something you forgot is easy. If you're connecting your deploy process to a button then you need to automate _everything_ in the process, which makes the process much more robust.

...and that is the justification I used to get some of these buttons this morning.

<comment><USER3> I don't know why using my keyboard is any different. Where are your assumptions coming from? A button is a button. This is why we use CI at my company – it IS all automated. And the last button I press after I type `git push origin master` is...you guessed it...return on my keyboard. That commit never sees the light of day in production unless it makes it through all of our checks.

</comment></comment></comment><comment> onion-soup One of those things which sound so exciting. You make it, you play with it, tell to your coworkers about it then you forget about it after a week

<comment><USER5> But you probably learnt something in the process and had fun while doing so! Win-win imho

</comment></comment><comment><USER6> I don't want to push the button, instead give me a keylock i need to turn. Like the keylock on old PCs.

<comment> King-Aaron I'd rather a huge, Dr Frankenstein style throw switch that produces sparks and lightning when I pull it.

<comment><USER7> Or how about an aviation/racing type switch with a red safety cover?

e.g. [http://www.pilotautomotive.com/lighting/PL- SW26.html](http://www.pilotautomotive.com/lighting/PL-SW26.html)

<comment> King-Aaron Nah, I feel the switch needs to be big enough that two hands are required to pull it

</comment></comment></comment></comment><comment><USER8> More important is the big red mushroom switch you push to abort and roll back a mistaken deployment!

<comment><USER9> Trivial to implement if you use git for deployment.

git reset --hard HEAD^

Then redo build/post-receive hooks.

<comment><USER10> Spoken like someone who has recently learned git but doesn't have extensive experience using it in a production environment. Or perhaps I'm just becoming more cynical with age.

<comment><USER9> Is there something wrong with doing it that way? I'm a solo developer so don't have the benefit of learning from corporate best practices.

<comment><USER11> Should work fine for a solo developer however I believe his point was that you shouldn't be re-writing the history.

That is, what would be the next command you use? You have just done a hard reset and removed the last commit from the history. Now your remote and your local copy have diverged. You can do `--force` of course to rewrite the history on your remote but that wouldn't be acceptable in a corporate environment because many other people also have their local copies of that repository and they'll all have issues after you force your change in.

A more transparent approach would be to do `git revert HEAD` or even better `git revert <hash>` to explicitly have your change be reverted with another commit.

<comment><USER9> The deployment git shouldn't be making commits and should only ever be a slave to wherever it pulls from. Production git clone shouldn't be pushing commits upstream.

So while it's running the previous version, you just `git pull` again to get the latest fixes for whatever broke at a later time. No history is rewritten as it fasts forward to the latest commit. I hope that clears up how it's used. As far as I know this is a common pattern of usage for deployment scenarios.

<comment><USER11> For a deployment pipeline that takes the HEAD state on the git repo, you are right, that's perfectly fine. However if you have other developers or SRE that have that repo checked out, they'll have problems. Not problems that they can't take care of, but an additional step nonetheless.

<comment><USER9> Let me clarify the scenario I'm using, as far as I can see there should not be anyone else touching the repo except production services that depend on it.

1\. Push to somewhere (maybe a bare repo, or github/bitbucket). 2\. Production clone pulls from the master.

If any issues arise, you can do git reset --hard HEAD^ on the production repo to rollback any changes to an arbitrary prior version.

> However if you have other developers or SRE that have that repo checked out, > they'll have problems

What do you mean by this? The production repo should only be read from by production services serving from it (webserver, database, etc). Any engineers shouldn't be making commits to it and merging upstream. It should be purely be used for deployment.

I think maybe you're assuming the production repo is also the master repo? This is not something I recommend and if you use my deploy scenario, this is not how it would be setup. The production repo should just be a clone of the master, purely pulling updates from master just like everyone else, which can be on github or another bare repo that others work from. Except the production repo would also be a read-only repo. You obviously don't SSH in, make hot patches, and commit from there. Based on this, what I suggested (git reset --hard HEAD^) and having a repo deployed on the production server is a best practice for deployment. It allows for effortless roll back to arbitrary prior states, easy post-update hooks for build steps. And should upstream ever be updated, it's one command that just re-syncs (git pull) to any of the latest fixes for whatever went wrong.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER12> I like the idea, but I would prefer to see it accomplished with a Raspberry Pi and a Big Red Button. At least this is one part of your life that shouldn't need AWS

<comment><USER13> Me too, Easy Peasy with a PI and button can be made as scary as you want :) Check this out: [https://www.youtube.com/watch?v=VjgK-g3neTc](https://www.youtube.com/watch?v=VjgK-g3neTc)

<comment><USER14> Or how about a switch that implements the two-man rule?

[https://en.m.wikipedia.org/wiki/Two- man_rule](https://en.m.wikipedia.org/wiki/Two-man_rule)

Good for not having to spend the weekend at work alone.

</comment></comment></comment><comment><USER15> Gitlab CI/CD and docker compose. [https://youtu.be/RV0845KmsNI](https://youtu.be/RV0845KmsNI)

</comment><comment><USER16> I always get amazed that people want to "push the button" to deploy. So many times BA's and AE's wanted to hit the Release button on our iOS App.

<comment><USER17> What are BA's and Ae's?

<comment><USER18> Guessing business analyst and account executive

More to the point did they want to be the ones to push it? :-P

<comment><USER16> Yep, that's correct.

They did, they'd come sit at my desk and push the button. I always thought it was weird.

<comment><USER17> That's because they want to matter.

</comment></comment></comment></comment></comment><comment><USER19> That's one of the best marketing strategy, I really want to buy that button right now :X

</comment><comment><USER20> I'm bookmarking this right now!

<comment><USER21> You should have an actual button for that.

<comment><USER10> We're going to need a lot of buttons for all this functionality. Perhaps we could group them all together on some kind of hardware device that we could keep on our desk and use the interact with our computers. Maybe laptops could have them built in?

<comment><USER11> Laptops with buttonboards? Now that's insane. Should we also put a small touch screen right above it?

</comment></comment></comment></comment><comment><USER22> Perfect combination of a really useful mechanism to trigger an action when you're far from a computer, with an action that you never ever need to trigger when you're far from a computer.</comment>


Thousands of UK protestors demand Google censor anti-Islam video - <AUTHOR> http://arstechnica.com/tech-policy/2012/10/10000-uk-protestors-demand-google-censor-anti-islam-video/

<comment><USER2> Were they all yelling "shut up, and play nice - please limit free speech"?

Or where the comments and the signs more "threatening" - like using words "violence" and "terrorism", even in quite innocent looking phrases?

I wasn't there, but my bet is on #2

What's the rhetoric - free speech and hurting someone feelings is bad, but threatening violence, maiming and killing people is fine?

Hey - if you don't like the movies DONT WATCH IT. Nobody is forcing no-one to go to youtube. The movie is bad and didn't catch a lot of attention since its upload in JUNE. Yet suddenly everyone is in a frenzy about it. Coincidence?

Free speech is indeed in danger in Europe.

<comment><USER3> I love how they are bringing more attention to this video then it would have gotten if they had just left it alone.

I for one could careless about this video, but bc of this "protest" im im simi interested in it, still will not watch it.

With that said, I can only see them wanting to take this down to keep it from being viewed by their own(faith). As like i said no one else should even care. If this is true it breaks up a whole new set of questions which i will not ask...

<comment><USER2> Right - that's the Streisand effect perfectly illustrated.

Free speech is here to allow competing ideas to be judged on their own merits.

If one has a faith, what can a simple video do?

On the other hand, if there are some flaws in the faith, it might be worth pointing them out.</comment></comment></comment>


A Famed Hacker Is Grading Thousands of Programs - <AUTHOR> https://theintercept.com/2016/07/29/a-famed-hacker-is-grading-thousands-of-programs-and-may-revolutionize-software-in-the-process/ <comment><USER2> I like how they keep saying first of it's kind. It was actually DOD, via Roger Schell & Steve Walker, that established the first standards for certifying security of systems based on what stopped brilliant pentesters at that point. Also the people that helped invent INFOSEC so some credibility there. ;) Landwehr's "The Best Available Technologies for Computer Security in 1983" (link below) is an approachable text of background, example systems constructed, and requirements for secure systems as of that time.

[http://www.landwehr.org/1983-bats-ieee-computer- as.pdf](http://www.landwehr.org/1983-bats-ieee-computer-as.pdf)

Esp see Advice for Developer section. For bonus points, compare those recommendations to today's "secure" apps or systems to see how much today's are missing. Then realize that the requirements and techniques for knocking out all the known risks have only increased since then. :) Far as the criteria, it worked with the private sector producing one high-assurance, secure system after another until NSA policy-makers killed the ecosystem:

[http://lukemuehlhauser.com/wp-content/uploads/Bell- Looking-B...](http://lukemuehlhauser.com/wp-content/uploads/Bell-Looking-Back- Addendum.pdf)

Since then, assurance dropped greatly across the board with FOSS & non-high- assurance proprietary both forgetting about precise specs, verification, covert channels and SCM entirely. Some of that was gradually rediscovered (ex "side channels") by same people saying original criteria was useless, red tape. They keep showing an interesting ability to hold two, contradictory ideas in mind simultaneously that way. High-assurance field continues to move on with EAL7-style with demonstrators in hardware (Rockwell-Collin's AAMP7G), smartcards (MULTOS/Caernarvon), crypto (Galois' CRYPTOL), kernels (seL4), hypervisors (CertiKOS), parsers (LANGSEC), static verification (eg IRONSIDES DNS w/ SPARK), browsers (Illinois Browser OS by Tang), and so on. Definitely worth copying proven approaches in any new organization designed to certify security. Just eliminate what red-tape was there then up focus on evaluation of specific product and code. I expect Mudge to pull that off at least.

Far as how to redo evaluation process, I have a write-up below on that. Ignore the first link in the Schneier post as the Pastebin below is the cleaned-up version of it. Has the list of security problem areas and methods I used in evaluation. Originally a counterpoint to someone thinking secure coding was all that mattered.

[https://www.schneier.com/blog/archives/2014/04/friday_squid_...](https://www.schneier.com/blog/archives/2014/04/friday_squid_bl_419.html#c5457853)

[http://pastebin.com/9AwDLSTY](http://pastebin.com/9AwDLSTY)

</comment><comment><USER3> _Firefox, by contrast, "had turned off [ASLR], one of the fundamental safety features in their compilation."_

Firefox has had mandatory ASLR since 2012.

After more investigation, this appears to be about Mac OS X specifically (which isn't pointed out anywhere in the article) where the Firefox executable doesn't have the PIE bit set. But note that the Firefox executable does almost nothing, and all web rendering stuff is in a huge dynlib, which is loaded with ASLR.

<comment><USER4> If Dan Walsh says it's complicated to run a MAC system against browsers specifically and desktop software generally, you have to worry.

[http://danwalsh.livejournal.com/72697.html](http://danwalsh.livejournal.com/72697.html)

I know it is debunked lower in the thread (so long as you do not load suspicious extensions, as explained), but sandboxing browsers seems prudent, and sadly why I am afraid maybe even Qubes is not enough anymore! Haha.

<comment><USER3> ASLR and MAC are unrelated - I don't get your comment.

<comment><USER4> Securing an application that merges so many functions of a computer is conceptually a lot more complicated than it appears.

He starts with a CVE and is routinely asked but why no SELinux. Conversely, he does not get into the fun part, a JIT, which must make ASLR all kinds of fun.

I was aware it is an apple and oranges comparison, but it all kind of sucks with something as complicated as a browser.

</comment></comment></comment></comment><comment><USER5> I think that the most important outcome is the pressure that will be placed upon software engineering teams to improve their products and start paying attention to security. They've gotten away without doing it for _far too long_. We may finally see a radical abandonment of C and C++, where it makes sense to do so.

I'd be cautious when interpreting the results, since their analysis (as they themselves admit) is not geared towards negatives (absence of vulnerabilities).

The obvious example here is Google Chrome. It has received a very high score according to their methodology but it gets exploited, publically at pwn2own, _year after year_.

<comment><USER6> Don't all the browsers get exploited at pwn2own?

<comment><USER7> I think that armitron's point is that Chrome gets exploited, like everybody else, despite being named in the article as the browser with the highest score. High score != "no vulnerabilities"

<comment><USER8> If I am not mistake it usually takes significantly more effort to achieve these exploits compared to other browsers in the past.

<comment><USER5> That may be the case (and the scores from Mudge methodology may be interpreted in such a way), but it is still a grey area, qualitative rather than quantitive, and it is perilous I feel to use them in such fashion.

After all what does "significantly more effort" mean? Yes there is raising the bar but do we know if _in practice_ those countermeasures make any sort of meaningful difference especially considering that a lot of the countermeasures can be defeated (ASLR -> information leaks, sandboxing -> hitting the kernel). Taking into account that the vast majority of cutting-edge offensive security research happens behind closed doors, the public has almost no visibility in this area.

If a South Korean teenager can break Google Chrome at his leisure, what about more resourceful adversaries that do not even have to be nation states?

Of course corporations like to talk exactly this kind of talk, raising the bar, "significantly more effort", better-than-the-rest and so on, since it lets them harbor the illusion that they're doing something but another way of looking at the data is this:

Google Chrome was first released in 2008. 8 years later, and it is _still_ remotely exploitable by solo individuals or small teams that release their exploits for not-a-lot-of-money. I'm singling out Chrome here because apparently it's the browser with the highest score in the OP report, but of course every other browser has the same issues.

Collectively, since the inception of the web, we have not had a browser that wasn't remotely exploitable. Can we do better? Judging from other critical software, it appears that we can.

Why haven't we??

Partly because the necessary processes haven't been there and I hope that the Mudge project will change that.

Let's move beyond smoke & mirrors to actual security.

<comment><USER9> This is why I think Servo is particularly exciting - while it's still a few years off being a practical browser, it should be immeasurably more secure than the existing crop of crufty C++ codebases. I think it (along with Rust) is by far the most important thing that Mozilla is working on.

<comment><USER5> I do not share your optimism re: Servo, partly because everything that has ever come out of Mozilla has been a disaster and I can't shed my prejudice, partly because Rust allows "unsafe" code (some feel this is all it takes) and partly because they've repeatedly said they'll keep using Spidermonkey (which is a security clusterfuck).

I would like to be proven wrong however, if not by them, then by others.

</comment></comment></comment></comment></comment></comment></comment><comment><USER10> My only concern is that a rating system may leave people to have a false sense of security when using software. Some very exciting steps in the right direction though.

<comment><USER11> I would say, given the general behavior of most users, people already have a false sense of security.

Though maybe not. Maybe security isn't as big of a deal as we think. It's not like the world is ending. So many people are so incredibly insecure that you'd think more would come out of it and people would be incentivized to become more secure. There is a sense in which we are as secure as is cost effective.

<comment><USER12> The problem is the externalities of insecurity. The company who is insecure doesn't suffer all the consequences of a security breach, so they don't spend as much money to mitigate it.

If software security was similar to say building/fire safety or food safety where serious cost/legal consequences were attached to failures, we'd likely see more spending...

<comment><USER11> That's exactly what I said, "we are as secure as is cost-effective".

</comment></comment></comment></comment><comment><USER13> In a previous job we had to run our apps through Vericode to supposedly do this exact thing. I didn't think much of its advice at the time (4 years ago) but how is what Mudge is doing is any different?

<comment><USER14> Most of the metrics, etc. are not new [1]. The two new things are:

1\. Mudge has enough credibility that, at least for now, most security people trust his assessments.

2\. He's willing to publicly assign grades, and take all the backlash and legal heat that entails.

Really it's the second one that will probably make the most difference here. If his organization manages to survive the first couple years without being sued into the ground, I expect it will have a big impact on the software world.

[1] From what I can tell from reading the article. They could certainly be doing more behind the scenes that didn't get reported.

</comment></comment><comment><USER15> Sounds like a lot of marketing about a standard pen-testing business.

</comment><comment><USER16> I like the idea of using fuzzing "to show a direct correlation between programs that score low in their algorithmic code analysis and ones shown by fuzzing to have actual flaws".

I hope they'll use AFL, and publish the parameters / settings, so others will be able to repeat the experiments.

<comment><USER17> I think that would fall in the third type of report they are planning to sell: "The third report, which they plan to sell, will contain raw data from their assessments for anyone who wants to recreate them."

</comment></comment><comment><USER18> Something like this if done well would be a huge step forward. Maybe we can stop totally ruining the network with local isolation and fascist firewall defaults if we can get some sense of standards in place about the quality of code required to bind a network socket.

Please add routers, IoT, and other embedded software to the list. That's as much if not more of a rats nest than software on laptops and phones, especially given the lack of OS protection in those environments.

</comment><comment><USER19> It will be interesting to see it the public is willing to pay a premium for "certified" software.

</comment><comment><USER20> the photos of them in that article are pretty ridiculous</comment>