Ask HN: What's the best advice you've ever received? - <AUTHOR>

It could be on life, programming or even startups; what's the best advice that you've received and acted on? How did it make your life better? <comment><USER2> 1\. That the world isn't what people _say_ it is.

2\. Nobody who has ever lived has ever invented or created anything. Human beings are just collage artists that rearrange "stuff" (matter,energy,etc) .Those who do it in a manner that certain people find convincing or fascinating are labeled innovators, the less convincing ones are labeled plagiarists.

So there's nothing wrong with stealing bits and pieces of others work as long as the end result is convincingly "original". _Because that's all anyone else has ever done._

</comment><comment><USER3> Believe it or not, pg's 'do what you love'. It caused me a lot of pain (giving up a perfectly good career and a business I had co-created) but discovering work I'm passionate about (software engineering) has made a world of difference in my life.

</comment><comment><USER4> "Stop looking for advice, and learn on your own."</comment>


The Minifree Libreboot T400 is free as in freedom - <AUTHOR> https://techcrunch.com/2017/08/11/the-minifree-libreboot-t400-is-free-as-in-freedom <comment><USER2> "No-OS is also possible, besides Trisquel. Mention "no OS" in the textbox on checkout, and we will ship it with Libreboot but without an OS installed."

Source: [https://minifree.org/product/libreboot-t400/](https://minifree.org/product/libreboot-t400/)

Been waiting a long time for some PC/laptop vendor to finally have enough faith in their own pre-installed OS^1 or hardware to sell computers with the _option_ of no pre-installed OS.

IMHO, this shows respect for the user, e.g., one who uses an OS that no manufacturer will ever pre-install (c'est moi).

And IMHO it shows that the product being purchased is in fact _hardware_ , nothing more; the OS I use is _free_ so this makes perfect sense.

To whomever decided to offer this option: great job!

^1. "faith in their own pre-installed OS" because IMHO a no-OS option means there is always the risk a user will choose it over a pre-installed OS. Assuming the pre-installed OS comes with pre-installed crapware, collects user data, tracks user location, serves ads, restricts software that can run to an "app store", or some other tactic to generate ongoing revenue, then any user opting out is a lost opportunity for the seller. Of course if the pre- installed OS is _truly_ superior to any free alternative that the user could herself install, then there should be no risk in offering a no-OS option. No user would ever choose it.

<comment><USER3> I can't ever recall using the pre-installed OS on any computer I've ever purchased (not counting smartphones).

<comment><USER4> I do, to verify the machine is as requested/ordered and works as expected. I have returned/replaced a machine before that had issues. Because of the OS was as expected, the manufacturer had no difficulty determining the machine was faulty.

</comment></comment></comment><comment><USER5> It is very cool to see TechCrunch give some publicity to a product and project like this.

A few thoughts though. When I buy products like this, it's not to "stick it to the man". I would love major companies to provide freedom respecting hardware and software, and I would say most of the hackers I know feel that way. We just don't have many options. We'd have no problems supporting "corporate interests" that cared about free software and didn't mistreat their customers. Free software isn't about being anti-corporate, it's about being pro-freedom.

</comment><comment><USER6> I built something like this: [https://rwmj.wordpress.com/2016/04/10/libreboot- on-my-x60s/](https://rwmj.wordpress.com/2016/04/10/libreboot-on-my-x60s/)

I'm glad that a company is stepping up to build these because the situation with libreboot/coreboot is very confusing. I think the projects forked, plus the documentation is terrible.

As an 11 year old, 32 bit laptop it's not for everyone, but the X60s is small, light and rugged — a real classic — the last version that IBM designed before the Thinkpad brand was acquired by Lenovo. The main problem is sourcing batteries.

<comment><USER7> The main problem is that it runs hot as f*ck on the right palm rest, making it basically unusable.

</comment></comment><comment><USER8> I don't say this to be mean, but what about things like hard disk firmware?

</comment><comment><USER9> I mean... the sentiment is fantastic, and we need more hardware like this. Desperately. But...these just aren't really usable for its target audience. The biggest sticking point is the screen resolution. Come on, it's 2017, and 1280x800 just isn't enough.

The other sticking point is the processor. It's unfortunately necessary to use an ancient one to avoid Intel ME. This comes with a massive performance bottleneck and increased power consumption.

To build a properly _useful_ free laptop requires a non-x86 processor, as it stands.

The P8400 is _9 years old._ We cannot rely on decade-old technology for our computing.

On a side note, did anyone ever buy the KDE Slimbook?

<comment> amiga-workbench I'm still using an X201 tablet, 1280x800 is largely okay for me. A lot of the problems come from modern, over designed software UI's with padding out the wazoo and a shitty information density.

</comment></comment><comment><USER10> Never thought I would see something like this from TechCrunch. I would never buy one of these but I'm just glad that word is spreading about these machines.

</comment><comment><USER11> What are the other machines that are close to free? I know about Librem Purism, but I seem to remember another thing is being funded that might be based off of Risc or something.

<comment><USER12> I don't know about Risc, but you might want to check out the FSF's Respects Your Freedom certification[0]. The article doesn't mention it, but the Minifree T400 is itself RYF-certified.

You might also want to check out h-node[1] (also by the FSF). I haven't looked into it much, but it seems to be a site dedicated to finding hardware that can be used with completely free software.

[0] [https://fsf.org/ryf](https://fsf.org/ryf)

[1] [https://h-node.org/](https://h-node.org/)

<comment><USER13> There's also the EOMA68 project:

[https://www.crowdsupply.com/eoma68/micro- desktop](https://www.crowdsupply.com/eoma68/micro-desktop)

And somebody else who appears to be building a shader compiler for the Mali 400 GPU here:

[https://github.com/yuq/mesa-lima](https://github.com/yuq/mesa-lima)

If both these projects succeed that would be a fully free arm laptop with a fully free GPU driver. Apparently it will also be possible to print out the laptop itself using a 3d printer apparently being designed and built by that same EOMA68 guy to deliver the boxes people already ordered.

Also it looks like the touchpad is just a little square of lcd touchscreen. If that part of the design is kept theoretically you could play quake inside the touchpad.

</comment></comment></comment><comment><USER14> Better hope that Intel Core 2 Duo P8400 doesn't run the Intel Management Engine

<comment><USER15> > Better hope that Intel Core 2 Duo P8400 doesn't run the Intel Management > Engine

This is clearly stated on the product website ([https://minifree.org/product/libreboot-t400/](https://minifree.org/product/libreboot-t400/)):

 _The Libreboot T400 comes without the Intel Management Engine or AMD PSP!_

<comment><USER16> It's a 7-year-old CPU, which predates ME but should still be quite usable for a lot of things.

<comment><USER17> 9 years old: Q3 2008

[http://ark.intel.com/products/35569/Intel-Core2-Duo- Processo...](http://ark.intel.com/products/35569/Intel-Core2-Duo- Processor-P8400-3M-Cache-2_26-GHz-1066-MHz-FSB)</comment></comment></comment></comment>


MTProto, the symmetric encryption scheme used in Telegram, is not IND-CCA secure - <AUTHOR> https://eprint.iacr.org/2015/1177 <comment><USER2> For those wondering:

IND refers to "indistinguishability"; it is the property of not being able to pick a matching plaintext/ciphertext pair out of a lineup of ciphertexts.

CCA stands for Chosen Ciphertext Attacks, and refers to the class of attacks where the cryptanalyst alters ("chooses") the ciphertext before it's decrypted by the victim, and is then able to learn things from the victim's behavior. (There's also CCA2, in which the attacker gets feedback from the victim on a single piece of ciphertext, over and over again.)

TLS's Mac-then-encrypt CBC was known not to be IND-CCA secure, and a few years later Thai Duong and Juliano Rizzo turned that property into BEAST. Then there was CRIME, then Lucky13, and finally TLS MtE CBC had to be put to sleep.

The easiest way to lose IND-CCA security is to fail to MAC your ciphertext. This is such a common flaw that Moxie Marlinspike, a co-author of TextSecure/Signal, which you should use in preference to Telegram, named it "the cryptographic doom principle".

This paper is a building block for a much more significant attack, which is the author's masters thesis:

[https://news.ycombinator.com/item?id=10713064](https://news.ycombinator.com/item?id=10713064)

<comment><USER3> BEAST and CRIME are both chosen-plaintext attacks. They don't rely on the improper MAC composition in TLS CBC.

Lucky13 and POODLE are the chosen-ciphertext attacks.

EDIT: Some more details:

BEAST takes advantage of predictable IVs in SSLv3 and TLS 1.0. In these protocols, the IV for each new record is simply the last block of the previous record. An attacker monitoring traffic on the wire can use this predictability to build an encryption oracle and guess-and-check the contents of ciphertext blocks.

CRIME uses plaintext compression to its advantage. A message with longer common substrings will compress slightly better than one without, and this is reflected in the ciphertext length. An attacker can make adaptively chosen guesses at substrings included in the message to recover, e.g., session cookies.

<comment><USER4> Great takeaways from BEAST and CRIME.

For BEAST, my takeaway was to never introduce a dependency into a cryptosystem of any kind without thinking _very_ carefully about the implications-- and if in doubt, don't do it. I also took away "don't be creative" \-- boring crypto is best. Generating random IVs from a CSPRNG is boring. Reusing the last block is interesting, but there be dragons. Crypto should be boring, straightforward, and directly based upon the current state of the art best practices without introducing anything that hasn't been subjected to rigorous analysis. Complexity equals bugs, etc.

For CRIME the takeaway is the concise "never _compress_ somethings secret together with something attacker-influenced." It means one must be careful in using compression together with encryption, and that if one is very highly paranoid it is probably best to leave compression out to err on the side of caution.

<comment><USER2> Nit: chaining IVs was the norm, used in a bunch of protocols, until the mid-2000s. It's obvious why you'd want to do it (saves space, and, conceptually, the IV is the negative-oneth ciphertext block anyways).

</comment></comment></comment></comment><comment><USER5> What a surprise, not. Many respected experts have criticised Telegram for implementing their own cryptography and using meaningless buzzwords, while also making encryption opt in. Telegram is clearly not a privacy-motivated platform and anyone who thinks so is deluding themselves.

Even the closed source WhatsApp (uses ETE from the Signal guys) and iMessage are arguably less likely to contain cryptographic flaws than Telegram.

<comment><USER6> > Even the closed source WhatsApp (uses ETE from the Signal guys) and iMessage > are arguably less likely to contain cryptographic flaws than Telegram

Even though you used the words "arguably less likely" to soften your statement, there's no way to check what WhatsApp or iMessage are doing because they're not open source. So even if security researchers want to look at the code or build their own clients, it's not possible. Reverse engineering is possible, but is tedious compared to having the source code. At least the Telegram client code is open source to support examining it.

That said, the criticism of Telegram for using home brewed encryption is appropriate and needs to be mentioned often (hopefully Telegram will change the protocol). Even the authors of this paper state:

> The take-home message (once again) is that well-studied, provably secure > encryption schemes that achieve strong definitions of security (e.g., > authenticated-encryption) are to be preferred to home-brewed encryption > schemes.

<comment><USER7> > no way to check what WhatsApp or iMessage are doing because they're not open > source

> Reverse engineering is possible, but is tedious

I think for a security-related application, trusting that the code you have is the one being built and distributed as binary is a huge oversight. I'd argue that sniffing packets and stepping through code is the proper way (of course having code /does/ help with this) Consider: what idiot would put a backdoor in plain sight?

<comment><USER8> The original commenter specifically mentioned the use-case of building clients from the source. Your comment doesn't counter anything that was said. Btw, most backdoors are disguised as 0-days for corner cases for deniability. They are primarily errors breaking memory safety or side channels. One can also exploit compiler properties but I've never seen that in the wild. Would be easier on iOS, though, due to standardized tools & platform details.

So, no, sniffing packets or stepping through code isn't the best way to do it. Best way is combining docs, source code, covert channel analysis, execution traces, and looking at them all for issues. That's still not even minimum requirement for high assurance security but how many problems are caught that exist in low-assurance source & binary distributed software.

<comment><USER7> The point I'm trying to make is that you can audit some copy of the Telegram source code all you want, you have no idea if that's what's deployed in the app store and thus what's on everyone's phone. So it makes sense to audit what's actually being distributed to end users.

<comment><USER8> That should definitely be audited on top of the source code. You have no disagreement from me, there.

</comment></comment></comment></comment></comment></comment><comment><USER9> Someone is going to write a book about how backwards and stupid person to person communications were from the year 1990 to the year 2020 at the earliest.

We have all these proprietary awful protocols meant to lock you into an app or a platform, and threw away standards years ago. We "trust" proprietary services with security while ignoring the existence of decades old proven open secure communications like OTR, mainly because the proprietary vendors want to shove their crap down everyones throat to be able to read all their communications, or in telegrams case profit off buzzword security rather than real security. And the joke is it is working fantastically. Someone wrote a non-fiction novel on doublethink and were the setting.

<comment><USER10> > proven open secure communications like OTR

Axolotl has significant advantages over OTR, such as forward secrecy and deniability while operating in an asynchronous context.

It is necessary that the global standard for secure messaging be decided by rough consensus and running code and not by standards committee.

</comment></comment><comment><USER11> This article is based on Jakobsen's master's thesis: [https://news.ycombinator.com/item?id=10713064](https://news.ycombinator.com/item?id=10713064)

</comment><comment><USER12> _According to the official description of MTProto the padding length is between 0 and 120 bits, which means that in the best case scenario the above attack succeeds with probability 2⁻⁸. However experimental validation shows that this is not the case and the length of the padding is in fact between 0 and 96 bits (this is due to the way the objects are serialized in Java). So we conclude that in the best case this attack succeeds with probability 2⁻³²..._

With a bit more knowledge about Java object serialization, could one be a bit more clever about picking the random block?

</comment><comment><USER13> Full disclosure: Worked at Telegram

That's why, we after quitting Telegram and starting to build Actor we decided not to implement theirs encryption because it always looks like spagetti- encryption.

</comment><comment><USER14> It's fair to say that this is still a theoretical attack. As authors of this paper mentioned, they don't see a way of turning the "flaw" into a real exploit.

<comment><USER2> It's not a theoretical attack.

[https://news.ycombinator.com/item?id=10713064](https://news.ycombinator.com/item?id=10713064)

<comment><USER15> The article says:

"We stress that this is a theoretical attack on the definition of security and we do not see any way of turning the attack into a full plaintext-recovery attack."

... which appears wrong, and even published after the other paper?

<comment><USER16> And the article linked by tptacek (by the same authors) builds on this and shows practical attacks.

</comment></comment></comment></comment><comment><USER17> Despite the severity of this finding, it still doesn't qualify for the empty "break our crypto" contest that Telegram put out.

STOP USING TELEGRAM!

</comment><comment><USER18> Good, MTProto is a giant PITA anyway. Why they felt the need to roll their own crypto is beyond me, and I really wish people would stop doing so because inevitably it ends up broken.

</comment><comment><USER19> I still don't really understand this all discussion around Telegram. MTProto is used just with the regular chats and they decided to use a custom protocol "In order to achieve reliability on weak mobile connections as well as speed when dealing with large files (such as photos, large videos and files up to 1,5 GB)" (from the FAQ). There is also a pretty long discussion here [http://unhandledexpression.com/2013/12/17/telegram-stand- bac...](http://unhandledexpression.com/2013/12/17/telegram-stand-back-we-know- maths/) between Telegram developers and another "security expert", where the practical reasons for their choices are explained (might be outdated, but it's still interesting to see why certain more secure algorithms might not be always the best solution). Providing cloud services, robustness and reliability can come at a cost unfortunately.

If you care about having a really private conversation, just instantiate the Secret Chat. It's state of the art in terms of security. Just one of the many benchmarks [https://www.eff.org/secure-messaging- scorecard](https://www.eff.org/secure-messaging-scorecard).

<comment><USER2> I don't think it's true that the "secret chats" don't use MTE IGE; I think the "secret chats" are the same construction, but keyed with a separate DH handshake.

<comment><USER20> But it still asks the server to pick the group in which to do DH. This has to be exploitable somehow...

<comment><USER2> I agree that's a _very_ dumb design decision, but supposedly the clients are expected to validate the DH parameters.

<comment><USER20> True, it needs to be a safe prime, but not all 2048-bit safe primes are equally good. At the very least there are those for which the Special Number Field Sieve applies, though that's likely still infeasible.

There might be very rare 2048-bit DH groups using safe primes for which the DLP problem is easily solvable, I wasn't able to find any research into whether or not those can exist.

<comment><USER2> You also have to validate the generator, which is trickier than the prime.</comment></comment></comment></comment></comment></comment>


Android could finally be getting back à la carte app permissions – Pocketnow - <AUTHOR> http://pocketnow.com/2015/05/07/android-app-permissions <comment><USER2> "getting back" ? Seriously, people should stop fantasying about app ops.

This was an internal debug tool and I really hope that if we get better permissions, it will look nothing like that.

AppOpps only allows you to block permissions after the fact. This won't prevent many apps like facebook to fetch all your contacts as soon as it is installed. An obscure entry in the settings menu will also be left unused by 99.9 % of the users.

What we need are granular permission popups 'app x wants to access your calendar/contacts/..., do you agree ?'.

-> You can display it right when the app needs it, so the user has a context for this permission and can decide whether he wants to let it access this data or not.

-> It is displayed the first time the app tries to access to the private data, so no more mass fetch just after the app is installed.

-> You can let the app know that the user refused that permission. That way, instead of displaying no data with no way to know that it is because it has been blocked (and no way to show it to the user), the app can react accordingly.</comment>


World's oldest undeciphered writing - <AUTHOR> http://www.bbc.co.uk/news/business-19964786

<comment><USER2> the "oldest undeciphered writing" is controversial. 5000 BC is closer to us than 5300 BC which Tartaria tables have. See <http://en.wikipedia.org/wiki/Tărtăria_tablets></comment>


Ask HN: So why is it that usernames are always 5 characters or more? - <AUTHOR>

I've never really understood why usernames are always 5 characters or more. Why not 3 or 4? Is it because it's more relevant to searches in a user database? What's the reasoning? <comment><USER2> I've been thinking about this for my site and I've decided to set a minimum number of characters for a username so that it stands out as being a username rather than a random set of characters.

I think if you allow 3 character username people are more likely to use things like 'asd' and 'qaz'. Then on a site such as HN where you have comments labeled by username it can become confusing if all comments are labeled with garbage. Whereas if you set a minimum of 5 characters then people are more likely to user human readable words rather than garbage.

<comment><AUTHOR> That's true, but at the same time it would make a world of difference depending on your service. I asked the question because our app Persona is like an about me Page, in pictures. Most of the requests I'm getting is because people like Paul or Bob, Tim etc want to have their personalized URL linked with our app. Imagine if you were a Paul and you were sending your friends a link: <http://www.prsna.me/paul> . The appeal there for a less than 5 character username would then be justified as I see it.

<comment><USER2> But that only helps the first person called John or Paul who signs up with you. I guess you have to weigh up helping the odd few first people who join your site, or disallowing names that don't look like usernames.

</comment></comment></comment><comment><USER3> I think that is because that under 5 chars, there is not that many usernames.

It would also be odd with a username on only 1 char?

<comment><AUTHOR> I think there would be a lot of personalized usernames, which is what I'm going for. Imagine having having a personalized link like domain.com/jon or domain.com/tim. There's definitely a lot of demand for such personalized usernames.</comment></comment>


Marriott Hotels Charged with Blocking Wi-Fi - <AUTHOR> http://www.dumb-out.net/marriott-hotels-charged-blocking-wi-fi/8176

<comment><AUTHOR> I didn't know this technology existed.

<comment><USER2> There was a long thread about this yesterday: [https://news.ycombinator.com/item?id=8406022](https://news.ycombinator.com/item?id=8406022)

Also, dumb-out is a terrible site. Per the guidelines, it's usually worth a couple of extra minutes to chase down the original article rather than use a news aggregator.</comment></comment>


Show HN: Revolut Emergency – An Electron PC App to Access Your Revolut Account - <AUTHOR> https://github.com/Annihil/revolut-emergency <comment><USER2> This would have been useful when I had to download an Android emulator to contact customer support :)

<comment><USER3> This is also why no one should use or trust this company with your money.

</comment></comment><comment><USER4> Very nice idea!

</comment><comment><USER5> Good choice using typescript :)

<comment><AUTHOR> Thanks! We want type safety for a banking app, don't we? :)

</comment></comment><comment><USER6> I was waiting for this!

<comment><AUTHOR> So was I, but I couldn't wait for Revo to do it

</comment></comment><comment><USER7> Good idea.

<comment><AUTHOR> Thank you for the kind words I really appreciate man :)</comment></comment>


Sexual Assault in a PhD Program - <AUTHOR> https://medium.com/@sgocity/sexual-assault-in-a-phd-program-my-metoo-story-11788285afd6 <comment><USER2> What a difficult and horrible story. Facing things like this is yet another thing making it harder for women in academia.

</comment><comment><USER3> Such a throwaway account has never been made.

Pretty much I was Liam in college. Now that I am an adult with a wife and toddler and have done extensive reading and self improvement - I came to realize what I have is aspergers. I recognize Liam immediately from the fingerprint of the descriptions being given of him, I was and still am that guy.

Aspergers is a catastrophe for relationships. You are weird, can't read social cues, make the wrong remarks and facial expressions, everyone detects there is something wrong with you and avoids you (as the author felt a strong urge to do in this story and as she mentions her peers did likewise).

As a result, people with aspergers are rapidly isolated by their peer group (and they don't even know it is happening). They tend to make inappropriate and overly blunt remarks that get them into trouble (Liam sharing about his unhappiness with parking when everyone else was relating a personal story).

Because your peers detect there is something wrong and avoid you, your social skills remain bad and only get worse. There isn't a chance to fix them and frankly no one feels like owning that project, nor are they qualified to do so. Look what the author's reward was for being nice to this guy, he interpreted it as a romantic overture. Not a great motivation to help.

To make matters worse, the general populations understand of aspergers and even that of trained professionals such as therapists is shockingly low. They just think you are weird.

Her advisor calling him a sociopath isn't inaccurate. Both people with aspergers and sociopaths don't really do empathy. Aspergers is associated with egocentrism. It would certainly seem that way to normal people.

By the time I had gotten to college with aspergers I had been severely bullied for over a decade due to my lack of social skills and weirdness. It makes you a target for lifelong harassment.

When I encountered women who I felt were attractive and tried to date them it was a complete failure because I had zero concept nor the tools to progress a relationship normally. Despite being a robot, I can assure you that I still have normal desire for human connection, just no way to achieve it.

Normal people have at least a degree of understanding about how to build rapport and common sense about how to progress a relationship or evaluate a member of the opposite sex and whether they are reciprocating or not. Aspergers people have nothing except some very rudimentary mental templates of what is supposed to happen, I only understood relationships through depictions in porn and popular movies, neither of which are helpful, realistic or accurate.

The consequences of having someone with aspergers walking around with intense human needs and no way to get them fulfilled combined with no social skills is catastrophic for everyone involved.

Look at the damage this did to the author.

One thing that is incredibly unhelpful is the politicization of things like "white / male privilege." This isn't male privilege, it is a severely damaging untreated mental condition.

There is nothing privileged about me being bullied to the point of suicide and stumbling around trying to form normal human relationships with an untreated mental disorder and the damage caused by my doing that.

College was not good, I became suicidally depressed based on a lifetime of everyone around me communicating that I am unwanted and being unable to form normal relationships. I am quite amazed I did not commit suicide.

I had similar incidents like what happened to the author. I met a girl I really liked and we dated and it didn't work out. I couldn't figure out why and became intensely obsessed with her and spiraled into suicidal depression. Fortunately I kept it entirely to myself and after she asked me for space, I managed to leave her completely alone (unlike Liam here).

I suspect even if I had gone for help they might not have been able to understand what was wrong with me.

<comment><AUTHOR> Author of the article here.

Thanks for this comment. I'm only nominally familiar with Asperger syndrome, but from what you say here it does sound consistent with Liam's behavior.

As time has progressed since this incident occurred, I have adopted various opinions about Liam's psychological profile. As I said in my article, at first it was necessary for me to believe he had some sort of disorder in order to forgive him. At other times, I needed to completely ignore it. Giving any thought to it felt like an attempt to excuse or justify his actions, and I needed someone to say "It doesn't matter. What he did is still wrong." Now I have enough emotional distance from it where I'm interested in what happened from an academic point of view. If Liam is suffering from an undiagnosed and untreated medical condition that could provide even a partial explanation for why he behaved as he did, I'm interested in that.

In Liam's specific case I do feel like male privilege, entitlement, and outright chauvinism played a role (I say this because of the blog post he wrote and other chauvinistic behaviors I witnessed). It may be possible that these character traits were born out of male privilege + Aspergers.

I am sorry that you went undiagnosed and treated for so long, and that you were bullied. Craving and needing human connections but largely being unable to attain them sounds like hell on earth to me. Especially when you don't know how to acquire those skills on your own and you aren't getting the help you need because no one understands the problem. I am quite sure I cannot begin to fathom the misery and despair you must have felt.

I'm very glad to hear you're doing better now.</comment></comment>


Linux 3.15 Can Resume From Suspend Faster - <AUTHOR> https://01.org/suspendresume/blogs/tebrandt/2013/hard-disk-resume-optimization-simpler-approach <comment><USER2> This seems to be a similar approach to the one taken by Windows[0]

 _There were a causes for the poor resume time, but a large contributor was device resume time. Since the OS serialized S0 IRPs to all devices in the PnP tree, the time for each device to resume added sequentially to the system 's resume time.

The OS serialization of the S0 IRPs could not change for Windows XP, so the problem was attacked at the other end...each driver would complete the S0 IRP as fast as it could so the OS could resume quickly and then asynchronously power up the device.

This way each device could power up in parallel and the total time to power up was not sequential (nor was it only the longest of any device to power up since there is still ordering between parent and child devices) and resume time could be dramatically slower._

[0][http://blogs.msdn.com/b/doronh/archive/2007/10/15/fast- resum...](http://blogs.msdn.com/b/doronh/archive/2007/10/15/fast-resume-and- how-if-affects-your-driver.aspx)

<comment><USER3> And that was for Windows XP, 13 years ago...

<comment><USER4> I switched from XP to Ubuntu about 6 years ago. At the time I was running an old dell laptop that had been shipped with XP. Perhaps their concept is similar, but my resume time in Ubuntu was a lot faster than that of XP.

Perhaps they had the right idea but didn't execute it perfectly, hopefully the Linux devs will get it right. I'm impressed by the resume times in windows 7 on faster computers but on more budget systems Linux still seems to be the king of resume times and performance (at least in my experience). I've only used windows 8 on an employees laptop and from what I can tell, it wasn't made to perform well on his Toshiba to say the least. I've seen both windows 7 and windows 8 running very well, much better than linux, on the right hardware though. The performance of windows on budget hardware (75% of consumer) is mediocre at best, which is unfortunate, but what's even more unfortunate is that because a select few can get Windows performing amazingly on great hardware, the consumer market seems to think it runs amazingly everywhere. Hopefully soon it will, or people will come to their senses and realize installing windows on a low budget (average consumer grade) system is more trouble than it's worth.

</comment></comment></comment><comment><USER5> Interestingly, OS X has the fastest resume from suspend I've ever seen. I'll see if this beats it.

<comment><USER6> One thing I hate with my Mac is the window dressing they do, they show the screen as it was before it's actually usable to give an impression of faster resume than it really has.

<comment><USER7> It's good as an interface, I think, because the human also requires some startup time -- if you can see what the screen looks like before it is interactive, you can orient yourself while the machine finishes reactivating.

<comment><USER8> Indeed it's a very good thing, especially if the actual resume can happen in that time span.

Sometimes it's frustrating since it looks like frozen.

Sometimes it's misleading, e.g. when you see that you _didn 't_ get an email or a IM notification, and then you realize it's because your e-mail/IM app is not really running yet.

Or when you take a quick glance to the wifi indicator and see that there are many bars and then you go away assuming there is connectivity but when it actually awakes you are not really online.

</comment></comment></comment></comment><comment><USER9> Here's an archived version, while the site is down: [http://web.archive.org/web/20140331181833/https://01.org/sus...](http://web.archive.org/web/20140331181833/https://01.org/suspendresume/blogs/tebrandt/2013/hard- disk-resume-optimization-simpler-approach) I don't see any mention of version 3.15, just a patch and some tests with 3.11?

SEJeff: don't use link shorteners.

<comment><USER10> It got merge in 3.15 you can see it in linus tree at [http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.g...](http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=b7e70ca9c7d7f049bba8047d7ab49966fd5e9e9d)

</comment></comment><comment><USER11> Offtopic, but they've got real cool domain (01.org), and I don't see no sites at 02.org etc; even for 01.org the InterNIC tells nothing! (whois limit exceeded) [http://reports.internic.net/cgi/whois?whois_nic=01.org&type=...](http://reports.internic.net/cgi/whois?whois_nic=01.org&type=domain)

Could somebody please comment on this?

<comment><USER11> I'm sorry, for some weird reason my browser didn't load from the first try all those 0\d.org sites that apparently do exist.

</comment></comment><comment><USER12> This looks like it is from back in January 24, 2014. Has it now been accepted into 3.15?

Regardless, is this what OSX does? From my experience, it is drastically faster at resuming.

<comment><USER13> Yes it has been merged, however given that the merge window only opened recently the 3.15 release will be 3-4 months away. Given that time frame its not likely that 3.15 will make it into the autumns Linux distribution releases. Probably be a year before this gets into the hands of users.

(unless someone backports it or you build your own kernel)

<comment><USER14> Or if one is using a distribution with rolling-releases, or just one that puts kernel updates into its repositories.

<comment><USER15> It sounds like you're using a distro that does just this, but is too modest to go name-dropping.

May I ask what distro(s) you had in mind?

<comment><USER16> Suse tumbleweed, the Kernel Developers PPA, Debian Experimental / Unstable, Arch, Fedora Rawhide, and Gentoo all deliver new kernels usually within a month of release, most within days (albeit more buggy).

</comment></comment></comment></comment></comment><comment><USER17> Might be interesting, but the site is down already

<comment><USER18> Oddly the Google Cache link also doesn't load.

<comment><USER19> I did for me once I switched to the text-only version: [http://webcache.googleusercontent.com/search?q=cache:https:/...](http://webcache.googleusercontent.com/search?q=cache:https://01.org/suspendresume/blogs/tebrandt/2013/hard- disk-resume-optimization-simpler- approach&rlz=1C1CHFX_enUS519US519&es_sm=93&strip=1)</comment></comment></comment>


The World's Largest Submarine: The Soviet Union's Pr. 941 Typhoon SSBN (2014) - <AUTHOR> http://imgur.com/a/xi3P3 <comment><USER2> It's interesting that part of the rationale for building huge submarines is that the Soviets couldn't afford American-style aircraft carriers. Then they proceeded to bankrupt themselves making huge submarines.

<comment><USER3> An aircraft carrier is expensive because it requires an entire fleet to support it. The carrier isn't the expensive part - the dozen screening vessels that protect it are.

That fleet can be taken out with a single tactical nuclear weapon.

A nuclear submarine can operate on its own, and carries more firepower (If we count by number of capitalists/communists/unaligned people it can kill) than an entire carrier group.

An aircraft carrier is useful for force projection on the other side of the world, if you are trying to bomb some stone-age savages, or to carry out some gunboat diplomacy to an uppity developing nation. It can't surprise-surface 30 miles off the coast of New York, and launch three dozen half-megaton nuclear weapons at six different metro areas in the span of forty minutes.

The Soviet Union was much more concerned about it's security than it was about power projection. It didn't need carrier groups - it needed a way to guarantee it's safety from nuclear attack, by holding the threat of initially Cuba, and later, it's submarines over the head of the US.

The former USSR's, and today's Russia's foreign policy become a lot clearer when you understand their primary goal - security of the homeland from attack. The country was absolutely traumatized by the Great War, the Russian Civil War, and the Great Patriotic War. All Soviet, and now Russian military planning focuses on preventing such disasters.

The US's primary goal, in contrast, is not homeland security (it is a secondary goal). The US's primary goal is making sure the world's oceans remain open to marine trade. That is why the USSR didn't invest in aircraft carriers, but the US did.

<comment><USER4> > than it was about power projection

That part came from people singing "The Internationale" all over the world, but it started to come apart in the 1960s, and by the 1980s it had disintegrated, and so did the Soviet Union.

Ah, well, interesting times.

<comment><USER5> It's just an industrial revolution too early and did not manage to avoid an imbred political class.

The AI and (insert unknown political change) might enabled a very different version of Internationale, that might arise in our lifetime.

</comment></comment></comment></comment><comment><USER6> Reddit discussion FWIW: [https://old.reddit.com/r/WarshipPorn/comments/2dchpf/everyth...](https://old.reddit.com/r/WarshipPorn/comments/2dchpf/everything_you_ever_wanted_to_know_and_more_about/) (2014).

</comment><comment><USER7> The power numbers are a bit confusing. It is stated that the sub is powered by two 380MW nuclear reactors. It almost doesn't make sense that a submarine can output as much power as a large power station. Though, the reactors power appears to be thermal and not electrical.

At 746 watts to a horsepower 760MW is pretty much 1,000,000 horsepower. But the stated shaft horsepower (shp) driving the props is given at 80,000 shp which is a 1/10th the output of each reactor. Granted there are losses and the rest of the ship needs power but not 90%.

<comment><USER8> Reactors are often quoted in MW-thermal vs. MWe (electric). They also mention there are 2 steam turbines. Here's my analysis. 2x 380MWt. They have two for redundancy. Then 1x 380MWt, assume 33% conversion efficiency => 125MWe. 80k SHP implies after losses, guess 85% conversion efficiency, 80k/0.85 HP to MWe ~= 70MWe. Which leaves 55MWe left over. That's still a lot of power, but it puts this closer to realistic I think.

</comment></comment><comment><USER9> What a wonderful historical piece that deals with both the engineering and geopolitical implications of a historic vessel. Glad I saw this, despite it being five years down the road.

</comment><comment><USER10> A separate detailed analysis of the 941 boats by, H.I. Sutton - his "Covert Shores" blog and publications are my favorite Naval tech OSINT and historical data sources:

[http://www.hisutton.com/The%20REAL%20Red%20October%20-%20Typ...](http://www.hisutton.com/The%20REAL%20Red%20October%20-%20Typhoon%20SSBN.html)

.. I really enjoy his material for the original artwork and diagrams.

</comment><comment><USER11> The article is very good. Having been a nuke on both US fast attack and ballistic missile subs, I would say any assessment of current US or Russian sub capabilities listed in these comments are not accurate unless that person is currently in the sub service. If they are, they are not going to say anything, anyway. i.e. The Silent Service.

</comment><comment><USER12> When I was in Portland a few weeks ago, my kids and I went on the submarine tour at OMSI. Fascinating look at something you normally only see in movies. I would highly recommend it.

[https://en.wikipedia.org/wiki/USS_Blueback_(SS-581)](https://en.wikipedia.org/wiki/USS_Blueback_\(SS-581\))

<comment><USER13> As long as we're on the topic of submarines you can enter; anyone looking to visit a Soviet/Russian submarine can do so in Germany. The Tango-class submarine B-515 (now known as U-434, launched in 1976) can be visited year- round in Hamburg:

[https://www.u-434.de](https://www.u-434.de)

I can recommend the guided tour. At 200cm standing room was limited for me, but the sub is quite accessible as long as you're not overweight.

</comment></comment><comment><USER4> One thing leads to another, and one ends up listening to the Hunt for Red October movie theme ...

Basil Poledouris - Hymn to Red October: [https://www.youtube.com/watch?v=MRG1UixHvos](https://www.youtube.com/watch?v=MRG1UixHvos)

<comment><USER14> Had this playing in the car the first time I drove to Montana.

<comment><USER15> I would would have liked to see Montana...</comment></comment></comment>


New Linux rootkit leverages GPUs for stealth - <AUTHOR> http://www.itworld.com/article/2920615/security/new-linux-rootkit-leverages-gpus-for-stealth.html

<comment><AUTHOR> their github page is [https://github.com/x0r1/jellyfish](https://github.com/x0r1/jellyfish)</comment>


Day Traders 2.0: Wired, Angry and Loving It - <AUTHOR> http://www.nytimes.com/2010/03/28/business/28trader.html?ref=business&src=me&pagewanted=print

<comment><USER2> I'd bet good money that they make most of their money selling subscriptions to their stock tips platform rather than actually trading.

<comment><USER3> Bingo! The way to be a successful day trader is to:

1) Make other believe you are a succesfull trader (just use lots of technical mumbo jumpo and a trading platform with a black background with lot and lots of bright colored graphs, lines and abbreviations that nobody, including you understands)

2) Sell subscription for others to "virtually" look over you shoulder.

3) Profit

Maybe I should sell subscription for others to "virtually" look over my shoulder while I program. I use emacs with a dark colored background and bright text, so there'll be plenty colorful "technical" looking crap to look at.

Besides, I talk out loud to myself, so subscribers get to listen my grunts, exclamations of excitement and swearing ($10/hour more for audio streaming?)

Or maybe not, they'll just make fun of my segfaults and how untidy my APIs are...

</comment></comment><comment><USER4> These guys are obviously charlatans. He claims to reliably make >$100K/yr trading his $100K account. If he could really generate 100% return on capital, he would be the richest person in the world. (Or... at least he would have more than $100K to manage.)

The author isn't totally uncritical, but it's annoying that he gave these guys so much space in the Times to advertise.

<comment><USER5> Assuming he compounded all of his returns he'd be the richest person in the world. Making 100% on 100k is demonstratively easier than making 100% on 100m and is not unheard of. So why doesn't this guy manage other people's money? No where in this article does it mention his account volatility or average draw down. This guy might be making 100% return with a peak to valley draw down of 75%.

Don't assume they are charlatans just because you don't understand what they're doing.

<comment><USER6> The reason I find it dubious is because $100k is not very much. You need to make very large trades--risking thousands of dollars at a time--or else you'll be eaten by fees and commissions.

I don't know anything about day trading, but I used to play poker (profitably), and know sports betters. $100k is simply not enough to be risking thousands of dollars on single bets, unless the bets have an enormous edge--an edge that is economically impossible in the algo-dominated, limited- information world of day trading. You will go bust.

I could produce math for you, but I'm lazy. But I've seen so many poker players go bust taking risks like this, and poker is a game where it's unbelievable how many morons are willing to throw money at you. Not like day trading.

<comment><USER5> There are a lot of subtleties with trading. To make money you need positive expectancy and you need 'inventory', or tradeable markets. They don't have to make large trades to make money. You have to consider transaction costs, rebates, avg win size, avg lose size, holding period, and a number of other criteria before you can judge these traders.

I don't claim they won't go bust, but I do take issue that simply because they make out-sized returns they are labeled charlatans.

</comment></comment></comment></comment><comment><USER7> _"He starts off poorly, losing about $500. But a timely bet on a company called Rackspace Hosting ("I don't know what they do," he says), as well as quick investments in Applied Materials, Eagle Bulk Shipping and a few others, have turned things around."_

 _"Asked about the Today Trader method of buying and selling, both men seem momentarily stumped, as if they never saw the question coming. Then they talk about the search for "set-ups," which seems to translate roughly as "golden opportunities," but they struggle to put a finger on what set-ups are, or how to spot them."_

There's not a lot of detail about their trading strategies, but it sounds like they're just pushing buttons.

</comment><comment><USER8> "'Up $210,' he says, removing his headset. Factoring in commissions, he's made $60."

Who wouldn't want to try to make a living at a game with a 70% rake? Oh, plus taxes.

</comment><comment><USER9> It's easy to be a profitable day trader when the market is melting up. Even the most incompetent traders would have been making money in the late nineties. The problem occurs once the market stops going up. At that point even the best day traders are at a disadvantage, being on the bottom of the food chain for information and transaction cost/speed.</comment>


Proving Euclid's Theorem using just the notion of "proportion" - <AUTHOR> http://fermatslibrary.com/s/a-note-on-euclids-theorem-concerning-the-infinitude-of-the-primes <comment><USER2> Really interesting to see how the idea of the paper came to life and how the author wrote it down on a box of Kinder chocolate :)</comment>


Scientists Just Figured Out How to Use Graphene to Make Seawater Drinkable - <AUTHOR> https://futurism.com/scientists-just-figured-out-how-to-use-graphene-to-make-seawater-drinkable/ <comment><USER2> Discussed extensively here:

[https://news.ycombinator.com/item?id=14027546](https://news.ycombinator.com/item?id=14027546)

</comment><comment><USER3> I heard a bit about this on NPR the other day. They had a desalination expert on to discuss it. He seemed mildly optimistic about this technology for certain niche applications, but did not seem blown away by it.

More graphene hype?</comment>


A new class of Internet start-ups is trying to turn data into money  - <AUTHOR> http://www.economist.com/node/18396166?story_id=18396166&fsrc=rss

<comment><USER2> Using data as a competitive advantage isn't a new thing, Tesco and Amazon largely built their success on their operational data analysis and eBay didn't fall to fraud like their competitors because they had better fraud detection algorithms.

However I think it's becoming much more common, most non-competitive industries often have ignored data analysis as a method for competing, hence it creates an opportunity for startups to disrupt stagnant industries.

<comment><USER3> It's interesting to note that Tesco's CEO was formerly their CTO.

</comment></comment><comment><USER4> Not TFA, but....there are a few companies like this one (<http://www.reveredata.com/about.html>) who do tremendous work gathering and organizing data into something useful for consumer customers and sell off the labors of their work for a nice bit of money...a very interesting model to follow.

</comment><comment><USER5> Every now and then you see a company do something and you go "damn that's smart". Trada was the last one for me. I had the same reaction with Klarna. That type of lending basically makes you a micro credit-card company... "issuing" you credit on a per-purchase basis.

Smart.

</comment><comment><USER6> The problem with business models like readyforzero's 'sell our users information for money' is that it relies on users not realising that this will happen.

Users let sites like readyforzero access their personal information; if they, say, put on their front page 'It's free because we sell information on your credit card transactions so businesses can decide not to offer you credit if they look too bad', most users probably wouldn't sign up - they want to make their credit rating better, not risk making it worse.

Relying on consumers not knowing about business practices is not a sustainable business plan for a model that needs high numbers of users to be profitable.

<comment><USER7> That's a serious concern, and I'd like to help address it (I am the director of UX at ReadyForZero).

A core tenet of our business is that we always act in the interest of the user. So far, our monetization works as follows:

\- Someone is on our site getting out of debt, and we have a good picture of where they stand financially (their data).

\- We know what Lending Club looks for in approving folks to get debt consolidation loans.

\- We can run this user's data against what we know about Lending Club's model, and see if (A) they would be likely to qualify and (B) it would save them time or money. If these things turn up true, we recommend to the user that they go apply, showing them the data that led us to this recommendation.

\- If they apply for and get a loan from Lending Club, we get a referral fee.

Up until the user decides to go apply for a loan, we have sent no data at all to Lending Club.

This kind of model is how we plan to approach the whole business. It's about giving people control over their financial situation and data, not taking it away. There are plenty of opportunities for us to profit with this model in an open, ethical, and transparent way, all the while keeping people in the driver's seat.

</comment></comment><comment><USER8> In the realm of software, which is diffuclt to defend, I like how much of a barrier to entry these companies create just by virtue of collecting data no one else does. Even google can't really compete here right away, because in each vertical space data has its own dimensions and requires different methods. I imagine this is one of the areas of software still really attractive to big VC money. (Not that it ever wasn't, it's just a lot easier to build now)

</comment><comment><USER9> I'm wondering if proprietary data startups kill the "open" internet. Do any of these companies allow users to collect all of the data that they generated and export it?

<comment><USER10> I keep hearing proprietary data killing the Internet. But before these businesses (and Google, Facebook, etc) came about, the data wasn't on the web.

The 'open' Internet is not dying, it never existed.

<comment><USER11> I never even considered that. Perhaps many of the projects that attempted to build open semantic containers for blog data, forum data, etc. were looking for a solution to a non-existant problem. (FOAF, RDFa, etc.)

</comment></comment></comment><comment><USER12> TFA, shortened: internet startups focus on processing user data.

This is news?

<comment><USER13> It seems like the major newspapers source their stories from the HN front page. It's great that they're listening - but, if they are just relying on HN and the signal and noise around it, they should also step out of this field of myopia and deliver original insights and breaking news, as well - you know, add to the conversation.

(edit: Major newspapers, like the Economist, are usually more thorough in their analysis than an HN commentator or a blog post. So, they definitely have plenty of value in the information stream, but rather than recycling and refining stories and ideas, they should also be encouraging new insights.</comment></comment>


Forget Cygwin or VMware, run coLinux - <AUTHOR> http://www.techanodyne.com/2007/03/forget-vmware-run-colinux.html <comment><USER2> Tried coLinux. Had to go back to VirtualBox. I'm not sure what the problem was, but running network-heavy apps in coLinux caused my wireless connection to drop out in the Windows host. Never had that problem before or since with other VM products.

Otherwise, there were no problems and I felt it was right answer to the problem. Why bother running a full-on emulator, when the kernel is open-source and can be modified to run as a process within another OS?

</comment><comment><USER3> The headline is clearly over the top designed to get a few clicks. You don't get the stability or performance of products that have been around for a while overnight. If trying out new stuff is all you do then this might be the thing for you.

</comment><comment><USER4> Why should I forget VMware or any other virtualization product? They also give you 95% of native performance and a full-screen X on top of that.

With 2GB RAM becoming the norm and stand-by mode having replaced power on/off cycles, I have no issues running two systems side-by-side on my laptop at all times.

</comment><comment><USER5> What is the difference between andLinux and coLinux?

<http://www.colinux.org/>

<http://www.andlinux.org/>

They seem to have similar logos and website...

<comment><USER6> "andLinux uses CoLinux as its core which is confusing for many people. CoLinux is a port of the Linux kernel to Windows.[...] Xming is used as X server and PulseAudio as sound server"

That seems to clarify things a bit. andLinux seems to take coLinux and add a couple of other utilities to give you a more seamless integration. last time I used coLinux I had to use VNC to connect from Windows to my running coLinux instance.

<comment><USER7> Yep - coLinux is the kernel plus a text console. Using coLinux is very much like having a headless Linux box on the network.

andLinux is coLinux and a Windows X server, all packaged up nicely so you can run GUI apps.

</comment></comment></comment><comment><USER8> This article mentions three products with overlapping, but not identical applications. Suggesting that users should "forget" one in favor of another is overly narrow at best.

</comment><comment><USER7> coLinux is great; have been using it for years, first on XP, now on Vista. The networking is a bit tricky to get going, but it's very convenient and feels "lighter" than VMWare. Have never tried VirtualBox though.

</comment><comment><USER9> I'll stick with cygwin, thanks.

<comment><USER7> Cygwin is all you need if you want to compile and run UNIX command-line apps on your Windows box.

The cool thing about coLinux is that it's actually Linux underneath, so you can have a complete Debian install, with apt-get etc. Postgres, MySQL, sshd etc all work as you would expect them to.

</comment></comment><comment><USER10> Buy a MacBook!</comment>


CISA is a surveillance bill - <AUTHOR> https://readplaintext.com/snowden-leaks-confirm-cisa-is-a-surveillance-bill-1e21a76abbab

<comment><USER2> My domain was on an Ubuntu LTS server that had reached the end of the LTS, so I had to move it a couple weeks ago. I created a new virtual server at Rackspace with a newer OS.

Within a very short time, there were several different IP addresses from Russia trying to guess the passwords for root and several other common accounts.

Not too long after, Chinese IP addresses joined the party.

Note that this was _before_ I had finished migrating my domain to the new server (the Russians showed up before I even _started_ the migration). None of my DNS entries pointed to the new server yet. They probably are scanning all Rackspace IP addresses looking for new servers. I would expect that the same happens at other major server providers.

I don't know if CISA is the right approach or not, but we need to do _something_ to defend against this stuff.

If CISA is not the right approach, the opponents need to start suggesting an alternative that addresses the problem better, because otherwise the pressure is going to mount to pass something, and if CISA is the only proposal available that will be the one that passes.

<comment><USER3> You had set a strong root password, correct? So in what sense had you not already "done something" that successfully defended against "this stuff" ?

You could ask Rackspace to implement a feature where newly setup servers have most incoming traffic dropped until the customer finishes setting up. You're also free to -j DROP all packets from outside the US if you think that would help.

But your wording makes it sound like you think there exists some collective action the government could take to prevent you even being scanned by "others". If you believe this is the case, the burden is on you _by far_ to propose a specific concrete solution and thoroughly convince others that it is necessary.

I, for one, don't see how it's possible for an ambient authority to "secure" a network based on peer to peer communication without destroying it in the process.

<comment><USER4> One of the best practices for SSH is to never use passwords, always use keys.

[http://lackof.org/taggart/hacking/ssh/](http://lackof.org/taggart/hacking/ssh/)

</comment></comment></comment><comment><USER5> It is truly fascinating (and of course, terrifying) to watch governments expect, demand and enforce complete transparency and blind trust from the people, while providing absolutely none of either.

</comment><comment><USER6> One of the reasons legal immunity is being offered is because corporations are suspicious that the data will get used to enforce regulations, bring lawsuits or otherwise be a tool of legal pressure.

The Government in this case is willing to make a promise (who knows how well it will be kept) not to use the information for parallel construction or explicit enforcement. In turn they get to protect the business and American industries from cyber attacks and give the data for analysis and processing for whatever national security purposes the DoD deems necessary.

There are industries that are already onboarded - financial and energy. CISA would expand these to other industries.</comment>


Ask HN: Review my startup - Smooth Bulletin - <AUTHOR>

I've been working on this project for the better part of 10 months.  Its to the point where I would love to get some feedback from HN.
http://www.smoothbulletin.com - Marketing Site
http://demo.smoothbulletin.com - Demo Front End
http://demo.smoothbulletin.com/admin/ - Demo Admin (u:email@example.com, p:demo)
What is Smooth Bulletin?
Smooth Bulletin takes the pain out of academic catalog management.  Our academic catalog management system(ACMS) is easy to use, easy to manage, and easy for students.  Academic catalogs are almost universally awful to use and their quality rarely reflects the quality of the institution that they represent. Smooth Bulletin helps schools put their academic catalog on the web in a way that they can be proud of.  If the school needs help, we're happy to provide customization and integration services.
What sort of feedback am I looking for?
- Pricing: I honestly have no idea how to price this.  I understand that colleges have LOTS of money, but are they willing to spend it on a product like this?
- Product: Is this a good product?  Valid niche?
- Marketing: I need ideas for where to go from here.  I have lots of feature ideas, but what I really need are marketing ideas.  Are there any higher education tech conferences that I could get a booth at? Are adwords a good way to go? Cold calls? Cold emails?
- Funding: I've bootstrapped up to this point and will continue to do so, however is it worth pursuing funding for this?
- Other forms of learning: I'm thinking of expanding into corporate learning catalog management.  Maybe government learning stuff too.  Essentially if there is a curriculum for learning, Smooth Bulletin could manage it.  Good idea? Bad idea?
Thanks! <comment><USER2> I think this definitely has potential, but there are a few issues:

Is this only for searching/displaying courses, or is this used for registration also? If it's the latter, this is mission critical software for big enterprises. Price accordingly.

Even if you're only searching/displaying courses, I think your pricing is way too low. Selling a solution to an entire university is going to be expensive. Probably more than a year of revenue at your top-line price.

Maybe you should target individual departments within a university for the service if you want to continue at these price points. However, I think you should ditch the High School offering price. Maybe a <1000 tier, a <5000 tier and a >5000 tier.

I think what you really need to figure out is who are you trying to sell this to, and more importantly, how much it's going to cost to sell to them. That should really influence your pricing strategy. I wouldn't write another line of code until you figure this out.

Good luck!

<comment><AUTHOR> Thanks for taking a look. Its mostly for searching for courses, majors, degrees, etc. Ideally we'll have tight integration with existing ERP systems, but I think prices we'll need to rise too (you're probably the 20th person to tell me that today!).

I agree with you about ditching the high school offering and then differentiating price a little bit more based on college size.

I know that I want to sell this to colleges, but the harder part is how much is going to cost to sell. I think smaller colleges are the lower hanging fruit, but it's still going to be a quite the courtship to make the first sale.

</comment></comment><comment><USER3> Great job on the site, it looks very well done.

As for your feedback goes, I'm concerned that you've spent 10 months on a project but don't seem to know the market at all. Have you talked to any schools about it? What made you start the project? Do you have prior experience working with ACMS?

I think your first goal should be to understand the administrative side of catalog management. How do they store/manage catalog information? Is this going to be easier to maintain than their current system? Can you make it easy to port from old systems? How do their systems connect with Bursar office, etc?

I think the biggest problem you will have is that catalog systems are probably integrated into larger ERP systems. Unless you can solve the integration problem you are probably going to have a very hard time selling this.

<comment><AUTHOR> I have talked with a few people that work in campus IT about their catalog management systems. The general feeling is that they wish there was something better out there. I have a little experience with ACMS from the admin side, but most of my experience comes from the student-facing side, which is generally pretty awful.

I completely agree that I need to understand the administrative side of this better. My only problem is that I can't get access to existing systems. I'll probably need to find people who deal with this on a daily basis to get that information.

I do plan on having a nice REST API for importing from old systems. I also intend to write middleware for importing from the current big players. I was inspired to add that to my to-do list by how easy BitBucket made it to transfer all of my private repos over from GitHub.

Good point about existing ERP systems. I'll have to look into how integration with the big players(SAP, etc) in that arena works.

Thanks for the feedback!

</comment></comment><comment><USER4> Wow this looks very well thought out. One small thing would be that the image of the browser in the mac at the top of the marketing site is very hard to see. I always like being able to see up close what the product looks like. I suspect you can increase engagement/conversions simply by blowing that image up or just zooming in on part of the browser window there.

Also, once you click demo, things get a bit confusing. If the demo users need to go to [http://demo.smoothbulletin.com/admin/](http://demo.smoothbulletin.com/admin/) to actually start testing things out, make that a clickable link and call attention to that so users know thats where they need to go right now.

<comment><AUTHOR> Good point about the mac image. I was worried that people would want to see the "10,000ft" view, but it turns out you can't see much from up there.

I will make it a lot more obvious how to start testing the admin.

Thanks for the feedback!

</comment></comment><comment><USER5> Maybe this is there somewhere, but something I'd want to see are degree tracks/plans. That is, when I got my degree, there were 4 different ways to get it depending on whether I was going for BA, BS or whether I was going to declare a minor or not.

So for students, that would be a great tool to have, to help sort and plan which course would be required given what you wanted to do. Your site could have a nice visualizer for which classes to take for a given track (e.g., B.S. Physics Minor in Math, B.S. Physics no minor, etc). The key here would be to make it easy to swap in/out electives and to order the classes based on pre- requisites.

 __EDIT __The site does look nice, btw.

<comment><AUTHOR> I'm so happy that you mentioned that. I've been busy building out the infrastructure to do just what you're talking about. Unfortunately it's pretty complicated so it's taken me awhile. The first step was the ability to get majors/minors in the system. My next step is making the degree programs more useful by being able to add required core courses, etc. Once that is in place, I can move on (finally) to graphing out paths for students.

I already have linkage between pre/co requisite courses, so almost everything I need is in place. I'd also like to integrate with universities existing systems so that I can have what courses the student has already taken available and merge that into the graph automatically.

Additionally (rambling now), I'd like to get cost per credit hour info from the university, and allow students to say "I'd like to get a B.S. in Computer Science from University X. What is the cheapest way to do this?" and have the option of mapping things out from a start at a community college and transferring versus starting at the 4 years school.

Thanks for the feedback!

<comment><USER5> Sounds awesome. The $$$ per track and comparing to schools would be awesome too.

Seems like you've got a good handle on things and have some good ideas. The design is nice as well. Best of luck to you!

</comment></comment></comment><comment><USER6> clickables

[http://www.smoothbulletin.com](http://www.smoothbulletin.com) \- Marketing Site

[http://demo.smoothbulletin.com](http://demo.smoothbulletin.com) \- Demo Front End

[http://demo.smoothbulletin.com/admin/](http://demo.smoothbulletin.com/admin/) \- Demo Admin (u:email@example.com, p:demo)</comment>


The house Steve Jobs doesn't want to call home  - <AUTHOR> http://news.cnet.com/2300-13579_3-10000785-1.html?tag=mncol <comment><USER2> For some strange reason I love photos of abandoned buildings. There are a few more photos of the house from the photographer's flickr account: [http://www.flickr.com/photos/tunnelbug/sets/7215759415352040...](http://www.flickr.com/photos/tunnelbug/sets/72157594153520402/)

I didn't have time to look around it yet, but his website looks promising as well: <http://www.terrastories.com/bearings/>

<comment><USER3> You might also like Artificial Owl: <http://www.artificialowl.net/>

It has everything from shipwrecks to abandoned nuclear power plants.

</comment></comment><comment><USER4> Is the Silicon Valley real estate market so bad that not even Steve Jobs can buy another piece of property that would be easier to build on, or is there something particularly special about the location?

<comment><USER5> It's more like Steve Jobs is so rich he can afford to have his estate in Woodside, the most expensive place in all the land, sit empty and be absorbed back into nature.

<comment><USER4> Yeah, come to think of it, he has to be living _somewhere_ while Jacking House decays, so maybe he's just in love with the location.

<comment><USER5> My theory is that he is just stubborn and can afford to let the house rot while he battles with the Woodside historic registry people.

<comment><USER6> My theory is by letting the house rot, he is battling the historic registry people. The house will be demolished by nature, the point rendered moot.</comment></comment></comment></comment></comment>


Show HN: A device simulator that cycles through many mobile device simulations - <AUTHOR> https://github.com/magicmouse/beads-examples/tree/master/Example%20-%20cycler <comment><AUTHOR> This is an example of an open source program called cycler that you can customize to run a program inside a simulator that shows what your program would look like when running on desktop and mobile hardware such as Kindle Fire tablets, Apple IOS devices, etc. You can set the time per device (currently 0.8 seconds), and after it runs through the portrait orientation, it switches to landscape. The only "gotcha" in this product is that you have to write in the Beads language.</comment>


How I got tech support scammers infected with Locky - <AUTHOR> https://blog.kwiatkowski.fr/?q=en%2Fnode%2F30 <comment><USER2> Hey everyone, blog owner here. It's hosted in my cupboard and the HN/Reddit traffic is killing my bandwidth :) Here are some alternate links if the site is down:

[https://archive.is/NRcnQ](https://archive.is/NRcnQ) [https://i.imgur.com/NR6pvkn.png](https://i.imgur.com/NR6pvkn.png) [http://webcache.googleusercontent.com/search?q=cache:https:/...](http://webcache.googleusercontent.com/search?q=cache:https://blog.kwiatkowski.fr/%3Fq%3Den/node/30&num=1&strip=1&vwsrc=0)

<comment><USER3> I use "cupboard hosting" too, but behind cloudflare free tier with aggressive caching.

<comment><USER2> I do not condone of Cloudflare and their way of making life impossible for Tor users.

<comment><USER4> Consider running Varnish on a Digital Ocean node, pointing at your cupboard origin.

<comment><USER2> That's a great suggestion. I'll definitely set this up.

<comment><USER3> I suggested a free caching solution specifically because you are using "cupboard hosting". This usually means you're trying to keep costs as low as possible.

You can whitelist TOR users on cloudflare by setting up a rule for it, it's quite easy to do.

Of course, you're free to choose not to support them/use their product as the default behaviour is to aggressively shove captchas ato TOR users.

</comment></comment></comment></comment></comment></comment><comment><USER5> While I personally agree with your actions, I do wonder if it really is ethical to hack them back. Anyway, thanks, the more awareness of this BS, the better.

<comment><USER6> I am interested in what the ethical argument against hacking them back is, unless it is simply 'hacking someone is on the list of things that are bad.' My attitude is basically one of 'implicit consent' \- if you have done something bad, you have given implicit consent for something similar to be done to you. I like the symmetry, as it simplifies the argument, just as the Golden Rule does.

<comment><USER7> Ethical argument against it: these companies are deeply unethical actors. The necessary and sufficient condition for their existence is their ability to take advantage of the gullible. But there is not and never will be the ability to swamp the gullibles' time with the time of highly paid professionals volunteering to troll. So it's really just a petty attempt to score internet points while not improving anything and selling/promoting an assumed moral high ground. I'm pretty sure that a majority of these moral attempts at trollsling end up being posted as a blog post, which itself is indicative of the real motivation.

One might compare it to a school encouraging an environment where a heinous bully can do something really bad, and then an internet mob retaliates by making the bully's life a living hell. Yeah, you're hurting someone bad, but don't pretend it's motivated by trying to improve the world.

<comment><USER2> I think intent is irrelevant here. I did it in the spur of the moment, because it was funny and because in my eyes they deserve it - it's not like it was a premeditated attempt in the hopes of writing a blog post.

In any case, I think acts are best judged based on their impact of the world, and not on random people's understanding of why they were performed. Here, we have (possibly) one less scammer on the job today, and more importantly, maybe a dozen or so new people who thought this was a good idea and will in turn try to make scammers' lives harder.

So what if there'll never be enough people to totally wreck their business model? I think the world is a little bit better now, and that's good enough for me. Even if I had done it all just for a minute of fame, I don't think that would matter and/or change any of this.

</comment></comment></comment></comment><comment><USER8> mirror, anyone?

<comment><USER9> [http://archive.is/NRcnQ](http://archive.is/NRcnQ)</comment></comment>


Ask HN: Founders, now that Privacy Shield is invalid, how are you handling GDPR? - <AUTHOR> I run a small SaaS business and I am really struggling here. I previously utilized Privacy Shield, but now that it's invalid, I have customers asking what I'm going to do next. I invested a lot into Privacy Shield, and now that I am full-time on my business and have a family to support, I really don't want to continue putting so much money into becoming and staying GDPR compliant again. But a sizable portion of my revenue comes from EU businesses, so I need a solution.<p>Fellow founders, what are you using? <comment><USER2> I came across this

[https://incountry.com/lp/whitepaper/techinical-whitepaper- pr...](https://incountry.com/lp/whitepaper/techinical-whitepaper-privacy- shield)

Does this work for you?

There are also scanners that do an audit and check.

What is the exact scenario you have?</comment>


Ask HN: Do you feel lonely as entrepreneur? - <AUTHOR> Gave everything up, followed my heart, built the company of my dreams, and another one, then one more...
ended up alone, isolated, exempted from society, considered as "crazy"
everyone i knew before disappeared or is like super-busy with school/work
i feel like the only free person in enslaved world
i don't have to go school or college, i learn everything myself
i don't have to work to be able to afford anything
but you see folks, that's where the most people are, most of the time
that's not where i am
how do they learn more about me?
at this point, i'm considering putting a online ad
but i'm really worried it would look too needy and just scare everyone away
how do you, fellow entrepreneurs deal with loneliness?
how do you meet new people when nobody, especially your age, could relate to you?
thank you very much, i appreciate each and every of your feedback <comment><USER2> Entrepreneur here. I finished uni in 2009 and started an agency when I was 25. 10 years after, I have only my confounder who I call a 3am friend.

It gets lonely because if you are in service business you start losing faith and trust in people. People lie on resumes, lie about their abilities, clients don't pay, clients lie on what was promised, people quit because they got 5k more somewhere.

My perspective about people changed significantly after having worked with and for people in the last 10 years. However, you build up resilience to a point where nothing can surprise you. You know exactly how to get the outcomes you want from every conversation. You get good at identifying good people and you get good at making money.

Yet, it is lonely. Yes, it is lonely. But it is all worth it.

</comment><comment><USER3> You didn't make enough contacts while building your businesses?

Most of the world is enslaved because thats the only way you can make them productive.

But there's a small subset of the population who have freed themselves from the burden of work, and we are the creative industrious. If you're as wealthy as you claim you would have come into contact with several of us already.

Who's managing your wealth? Which private clubs are you a member of?

If you're a coder I can give you a cryptographic shibboleth problem, if you solve it, then you are a candidate to join our members only club.

I know several other private clubs, depending on your interests, but again, you should have discovered these already, if you're awake.

By the way, your grammar and writing style is terrible. Fix your capitalisation and harmonize your thoughts so it's not just a steam of consciousness. Effective communication is important - it's NOT trivial and superficial, it's used as signalling!

<comment><AUTHOR> Hey, thanks for your reply

i made a lot of contacts through exhibitions, meet-ups and even some customers i became friends with. I have had many "internet friends" before, but once i disconnect, all of them disappear

i realised, i crave even more attention, because of the lack of

the fear of remaining alone made me needy, hopeless, miserable

i'm not a member of any offline private clubs, however i have my own community and we get together once a year in Moscow and St. Petersburg

even after we've met, i never feel happy afterwards, because i know i will be getting back home into loneliness... i feel very powerless about it

sorry to disappoint you with my grammar and writing style. I will take that into account. Can you suggest any books or articles to read?

thank you very much

</comment></comment><comment><USER4> I don't say lonely, but I do say alientated.

It's a path that doesn't make a lot of sense unless you've gone down it. So I have a harder time connecting about work to careerist friends. But there are other things to connect on.

It's also lonely because you can't tell staff everything. If you are planning to fire someone, or you actually do, you have a responsibility to keep the reasons to yourself. It feels dishonest every time.

For connection on the topic of work I'm in an entrepreneur's group. We meet about every two months, about 8 of us at each meeting.

What you learn from hearing other people's real problems is that your own shitty problems aren't unique. In fact they're probably the norm.

<comment><AUTHOR> > alientated

that's the word for it!

</comment></comment><comment><USER5> Yes, Entrepreneurship is lonely. Have felt the same.

In this online world sharing knowledge is so much easier. Blogging, Professional forums can be used to share knowledge. It is baby steps but eventually can lead to teaching, workshops which could be fulfilling.

Helping, mentoring budding Entrepreneurs is one area. They would be glad to use all the wisdom.

Spending time with family. Connecting with old friends do help. I found, reaching out just to say hello opens the door.

Also meeting people with similar hobby or interests also helps. People are glad to share their knowledge.

I think when we are stuck, looking at avenues where we can give provides us the opportunity to connect with like minded people.

</comment><comment><USER6> Maybe consider doing something else with/for those people that you'd like to meet? What about teaching or volunteering maybe?

Also people just don't like to talk about things that they don't find interesting - so if you like to talk exclusively about entrepreneurship with your friends, then it might be boring to them.

<comment><AUTHOR> I try really really hard to be discovered

i go gym, swimming, dog training

i even joined church

that's already more than i can handle, still no results, no people my age there, nobody wants to connect

that's why i've told about making an ad

if it is appealing enough i'd become famous

if not i'll just be LOLed everywhere i go

</comment></comment><comment><USER7> Loneliness is warranted on the entrepreneurial path. My DMs are open if you'd like to talk.

If you have made enough money, have you considered starting a non-profit? You seem good at starting new things and a non-profit just might give you the meaning that you are searching for.

Just thinking out loud here.

<comment><AUTHOR> I was thinking about donating just to get some attention in the local newspaper, but i think that is be very dishonest and people would see this

</comment></comment><comment><USER8> Meetups (or local events). I don't go much these days because I have friends that are also entrepreneurial but when you're just starting out, going to meetups to find like-minded folks locally is a great way to make new friends.

<comment><AUTHOR> most of the meet-ups find place outside of my small town :(

</comment></comment><comment><USER9> Volunteering and being part of a completely different group altogether is what helped me. Working with young people of tomorrow to help them polish their skills and share some thoughts along the way while being a friend has done me wonders.

</comment><comment><USER10> I picked up teaching. Institutions are bad but I love the students.

<comment><AUTHOR> Yeah, but can you teach without a degree?

<comment><USER10> I found that many (not all) colleges are willing to bend the rules a bit. Also often experience matters just as much as a degree for them.

</comment></comment></comment><comment><USER11> "nobody, especially your age, could relate to you!": How old are you?

<comment><AUTHOR> The storyline was like that: i was still in high-school, in the meanwhile instead of doing boring homework, i did my own thing

quickly, the business exploded, to the point i couldn't handle both

so i ditched school

it was pointless anyways, because i was making decent money as a teen already, it felt like a waste of time, that i could've used to improve myself and the business

i think my biggest mistake i recognise is, that i've told my mates about my entrepreneurial intentions, shared my successes and showed-off my financial well-being (u seen new iPhone yet? Look here)

¯\\_(ツ)_/¯

<comment><USER11> Yeah, that's when 99% socialises. So I can see now you are pretty much out of the loop.

</comment></comment></comment><comment><USER12> It is a lonely path. It's a bit frustrating because others just won't relate to you. People often talk up to you -- I've had classmates I used to hang around at the school ditch call me Sir. Or another large group assumes you don't have problems because you have money. I've tried hanging out with other entrepreneurs, but many are either wantepreneurs or sociopaths, and it's just incredibly frustrating. A lot of people in actual entrepreneur mode are focusing on their business, and keep cofounders as social anchors.

And a lot of the time, it's because they sort of want to be where you are, but they aren't. A big part of it is their fault. And so they justify it by building a kind of disgust for wealth and the people who hold it. They say, well, being wealthy requires sacrifices to family life, health, and so on, and are happy to see you lonely.

It's also a bit depressing that you can't really "free" anyone. A lot of people seem to think that all they need is money, so they can hire staff and hit financial freedom, but it doesn't work that way.

I'd say the wife and kids keep me rooted somewhere because the relationship is the same. The ideal is Melinda Gates or Sharon Osbourne. The one who straight up will tell you your idea is wrong when you're surrounded by yes-men, now take out the trash. But also support you when you're messed up. And a lot of rockstar kids keep their parents rooted - a two year old will throw a tantrum no matter what, and to paraphrase Liz Tyler, she doesn't know what's different about being a rockstar kid because she never had any other dads. Internet and multiplayer games are nice too because nobody knows who you are.

Spirituality also helps to deal with this. Buddha and Muhammad were already incredibly wealthy. Both found different paths.

</comment><comment><USER13> I maintain contact with my oldest brother on a daily basis that helps me a lot.

<comment><AUTHOR> I connect with my grandparents every day too, but they can't really support me as much. They come from a very different time and place...

</comment></comment><comment><USER14> Elon, is that you?</comment>


Show HN: A better way to share addresses - <AUTHOR> http://www.address.fyi <comment><AUTHOR> This is a work in progress, but I wanted to see if there was enough demand by releasing the MVP. I still need to do the google map output and social sharing links.

The problem all started when I was on the phone with some company that needed to ship me something. It was such a pain trying to tell them my address over a bad phone connection. So I thought it'd be great if we could simply recite a short code like a zip code or postal code in order to give our exact addresses.

<comment><USER2> But to remember 6 random characters is awful, why not 3 words like this one : [http://what3words.com/](http://what3words.com/) Same problem, similar idea, another solution.</comment></comment>


Ape in Space, Scott Kelly Chases Tim Peake in a Gorilla Suit - <AUTHOR> https://twitter.com/ShuttleCDRKelly/status/701927839344373760 <comment><AUTHOR> And posted the wrong URL. Here is the full video

[https://twitter.com/StationCDRKelly/status/70223987832337203...](https://twitter.com/StationCDRKelly/status/702239878323372032)

</comment><comment><AUTHOR> I thought this was cool, Mark Kelly's brother sends him a Gorilla suit as a birthday gift. What better way to celebrate a year in space and pay homage to Benny Hill than to chase British rocket man Tim Peake around the ISS to yakety sax. Tim has a huge following of UK school students for his work with the space 'Astro Pi' Raspberry PI.

On the other hand, lots of the internet lost it complaining about NASA wasting the money to ship the suit into space. I'll be the first to tell them that the US government has fobbed away more money on far less.</comment>


Tax dept. employee creates online game to vent his frustration with taxpayers  - <AUTHOR> http://www.thestar.com/news/gta/2013/01/29/tax_agency_employee_creates_online_game_to_vent_his_frustration_with_taxpayers.html

<comment><USER2> And gets fired: <http://news.ycombinator.com/item?id=5144419></comment>


Glide – Beautifully Simple, Professional App Creation - <AUTHOR> https://www.kickstarter.com/projects/1783091318/glide-beautifully-simple-professional-app-creation <comment><USER2> Interesting comments by Marco Arment on Glide which give me reason to evaluate it. [http://www.marco.org/2015/04/16/glide- kickstarter](http://www.marco.org/2015/04/16/glide-kickstarter)</comment>