Secret Service Interrogation of Wozniak (2002) - <AUTHOR> http://archive.woz.org/letters/general/78.html <comment><USER2> Here's a video of Woz showing his pad of $2 bills and talking about this story: [https://www.youtube.com/watch?v=LJ1TIYxm1vM](https://www.youtube.com/watch?v=LJ1TIYxm1vM)

<comment><USER3> In this video, Woz never states that his pads assembled from sheets of legitimate, uncut 2 dollar bills. He implies that he pays a local printer to create the pads from scratch. The reactions from the host and the audience seem to reflect that, as well. What's going on here?

<comment><USER4> He is having fun making literally true, but intentionally misleading, statements. Just like he did with the Secret Service agent.

<comment><USER5> Trolling an LE agent doesn't seem to be a good thing to do.

<comment><USER6> It is a very good thing to do in that it restores a balance of power.

<comment><USER7> I can't help but think restores the balance of power in much the same way that sticking your thumb in the eye of a grizzly bear restores the balance.

<comment><USER6> Actually that might be a good way to fight off a grizzly bear, so I'll take it.

<comment><USER7> Grizzlies would often come down out of the mountains where I grew up. Trust me, I advise you not to.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER8> While not obvious, this is the $2 bill Secret Service interview from around 2002. The page says the last modification was February 19, 2002 6:09:39 PM. His Wikipedia page suggests that his youngest was born ~1988, the story takes place "About 3 years ago", and refers to a 12 year old daughter.

Thus, a (2002) addition to the headline would not be remiss. I thought it was a new interview, and wondered if it was somehow related to his Australian citizenship process.

</comment><comment><USER9> You can buy your own uncut currency sheets here [http://www.moneyfactorystore.gov/2currencysheetsbeptestsheet...](http://www.moneyfactorystore.gov/2currencysheetsbeptestsheet.aspx)

<comment><USER10> Wow, that's expensive. $8 worth of bills is $22.50! Seems like it shouldn't be _more_ expensive to get a set of bills that are _less_ processed.

</comment></comment><comment><USER11> That is awesome. He has a lot more guts than I do. It's one thing to play a clever prank on a friend. It's quite another to play a clever prank on a casino security manager. And the secret service? Wow.

<comment><USER12> Having so much money helps a lot.

<comment><USER13> He did stuff like this long before he was wealthy. Calling the Pope with a blue box, and so forth.

If anything, most people _stop_ kicking legal hornets' nests once they have something to lose.

</comment></comment></comment><comment><USER14> The real travesty is the last paragraph:

> Well, as we were eating I glanced up at the Keno board and Sara had won > $7500.

> The downside of this is that Sara gained $7500, I lost $7500, the government > gained $7500 and the casino lost $7500. You see, I had to fork out the $7500 > to my daughter and collect the winnings myself. But about half the winnings > would be paid by me on my taxes as income, and other half of $7500 would be > paid as gift tax for giving the winnings to my daughter (I'd already > transferred the maximum yearly tax free gift of $10,000 to each of my kids).

<comment><USER15> Could you please explain why?

<comment><USER16> It's already explaind by Woz.

He collected the money into his account. So that $7500 is taxable as income. He lost nearly half of it now.

(Balance=savings + 7500 - 7500/2 tax)

Then he transfered $7500 to his daughters account. Up to here, He lost ~7500/2 to taxes.

(Balance=savings - 7500/2 tax)

And this transfer process is also taxable as a inheritance/gift payment. Another tax paid by his savings.

(Balance=savings - 7500/2 tax - 7500/2 gift tax)

Happy government, Happy daughter, neutral Woz :)

<comment><USER15> So where's the travesty then? Is the complaint that enabling underage gambling is tax inefficient?

<comment><USER16> His problem is not with underage gambling restrictions. It's about how expensive it's to transfer funds to family. Also he's paying income taxes on behalf of his daughter. That's unavoidable. But the gift tax? that's really insane.

<comment><USER8> The gift tax exists to prevent estate tax avoidance. Is your view that on principle estate and gift taxes shouldn't exist? I am philosophically against inherited capital accumulation, so think it should exist.

FWIW, only those who have given over $5.43 million of gifts in their lifetime pay the gift tax in the first place. Woz is by all accounts a generous person. While generous, this also reduced the size of his taxable estate by quite a bit.

In addition, each parent can give a child up to $14K tax free (now; $10K then). Spouses can give gifts to each other tax free. If I read it right, each of Woz's children probably received up to $20K in a year without paying gift taxes, though he only mentions the $10K from him personally. This gambling win would have been on top of that $20K.

It's hard for me to be concerned about 12 year olds making 20K/year tax-free.

<comment><USER16> I do not understand the rational after estate tax. It may be rational to prevent "depth escaping" in many cases but in death? I think most of the time some illegal activities or workarounds are used as subtext by government to take some more cut.

<comment><USER8> I don't know what you mean by "death escaping." I don't know what illegal activities you are referring to in this matter. The Wikipedia page [http://en.wikipedia.org/wiki/Estate_tax_in_the_United_States](http://en.wikipedia.org/wiki/Estate_tax_in_the_United_States) has a pretty complete coverage of the points both for and against the estate tax.

While the gift tax is, in the US, closely coupled to the estate tax, they are distinct things. I made an error in not mentioning income tax as well was the estate tax.

Gifts could be used to get around income tax. If I pay my children to work in my store, then they pay income tax. If however I give them gifts, and they just happen, out of generousness and familial good will, happen to do the same amount of work as an employee, then that's an illegal scheme to avoid paying income tax.

Estate taxes are a reflection of a philosophical viewpoint, which is that inherited wealth is not as good for the country's well-being as wealth from labor. Consider if I were to own 1/5th of the land of Manhattan, and make money from leasing out the properties.

If there were no wealth tax, then I could pass that land to one of my children, who then passes it on to one of my grandchildren, etc. Wealth like that tends to accumulate, and lead to increased economic inequality. The philosophical viewpoint is that a humane society does not have drastic differences between the richest and poorest people. In addition, this would tend to create de facto nobility, or landed gentry, which is something the US has traditionally opposed. If Picketty is right, and r > g, then the death tax or a wealth tax or some other means is needed to limit wealth inequality.

<comment><USER16> I meant "debt escaping". Being a foreigner I made a bad typo. I don't know really the term used in English, that's a way to evade debt by transferring funds to someone else.

<comment><USER8> Unless you regard all taxes as debt, this meant to keep people from escaping from paying taxes, not paying debts.

Here's a variation of the earlier scenario. I have a company. I give people gifts of US $40,000, with no strings attached. It happens to be that, in their free time, they volunteer at my company to help me out with my business, and spend about 35 hours a week in volunteer labor.

Is this really a "gift" that shouldn't be taxed at all? If so, it's a way to avoid employment and income taxes.

To prevent that from happening, the gift taxes are going to have to be at least as high as employment-related taxes would be.

Since the gift tax doesn't kick in until $14,000/year, which is under minimum wage, the gift tax for higher valued gifts must be much higher than employment taxes. Otherwise it will still be used to avoid employment and income taxes.

</comment></comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER17> I really like this phrase: "It's hard to separate rights from reality"

</comment><comment><USER18> _It probably amounted to a real crime. I had my driver 's license as well. But you only live once and only a few of us even get a chance like this once in our lives._

<comment><USER19> I've always admired Woz but it's lines like this that make me love him.

</comment></comment><comment><USER20> >We covered each of my friends' names and phone numbers because I couldn't remember which one had gotten the $2 bills gummed and perforated for me.

That's not cool.

</comment><comment><USER21> My grandmother did the same thing with bound "pads" of $2 bills for years, gave them (in a checkbook-style holder) as Christmas gifts. I don't think the serial numbers were in order, though, as she got the $2 bills from a local bank.

</comment><comment><USER22> The idea of legal tender not being recognised reminds me of a situation here in the UK.

The Bank of Scotland prints its own notes, but are rarely in circulation in the rest of the UK. Somehow it's mildly amusing passing over a Scottish fiver to an unsuspecting checkout assistant in London, and the ensuing suspicion.

<comment><USER23> A minor point: that's not what legal tender means.

[http://www.royalmint.com/aboutus/policies-and- guidelines/leg...](http://www.royalmint.com/aboutus/policies-and- guidelines/legal-tender-guidelines)

The shops are free to reject the note, and possibly to lose your custom.

<comment><USER22> Thanks for the correction, interesting.

</comment></comment></comment><comment><USER24> Why does the US govt sell uncut sheets of bills? Are they just for fun or is there a legitimate use for them?

<comment><USER25> Just for fun.

</comment></comment><comment><USER26> People use those dollar-bill sheets as wrapping paper: [http://www.luxuo.com/super-rich/uncut-sheets-of-real- dollar-...](http://www.luxuo.com/super-rich/uncut-sheets-of-real-dollar- bills.html) .

<comment><USER27> There's something weird about paying $55.00 for 32 $1.00 bills, though. I mean, I can understand shipping and handling, but a 71% markup seems a bit much.

<comment><USER28> Buy the uncut sheets straight from the U.S. Department of the Treasury, Bureau of Engraving and Printing at [http://www.moneyfactorystore.gov/](http://www.moneyfactorystore.gov/)

The $100 Currency Sheets are _beautiful_ because it is so colorful. [http://www.moneyfactorystore.gov/100currencysheets.aspx](http://www.moneyfactorystore.gov/100currencysheets.aspx)

The markup is much lower on the $100 4-Sheet since it costs $480 for $400 of spending power. Or reduce the markup further by buying 16-Sheet for $1,800. Then cut them up into smaller sheets of 4 each. Markup then is only $50 (or 12.5% over face value) per final 4-sheet.

<comment><USER29> Ive never heard anyone describe any US currency as colourful before! (I looked and they do have a bit more colour).

</comment></comment></comment></comment><comment><USER30> So because Woz failed to give straight answers to the Casino man and joked around, he got a visit from the Secret Service. Because Woz failed to give straight answers to the SS man, he spent 40 minutes under interrogation.

Moral of the story: don't joke about if someone asks you about whether you are committing a crime?

<comment><USER31> Or, do if you're out of fucks to give.

</comment></comment><comment><USER32> I don't understand how he didn't get into trouble for what he did. Why wasn't Secret Service able to prosecute him?

<comment><USER33> What he did is not illegal but perhaps not very smart as the uncut sheets of currency that are for sale by the BEP cost (significantly) more than the face value of the actual money that you're getting.

The only reason USSS got involved to begin with is because the casino security officer was (rightly) suspicious of some guy in the casino ripping bills off a pad and feeding them into a slot machine...

<comment><USER34> I had to look up the Secret Service because I thought it was strange that the President's bodyguards would be interested in a suspected counterfeiter. Apparently their protection role was introduced after their primary mission, which is fighting financial crime. Weird.

<comment><USER35> Not really.

Currency protection is one of the absolute most critical functions of a government, if people lose faith in your currency it causes a ridiculous number of problems.

When the US was young it's presidents didn't require the level of protection they require now (in fact a few of those presidents would have been as likely to shoot an attacker as not).

Eventually they realised that presidents _do_ require protection but deciding who to use for that protection is quite a nuanced task, there are risks involved in having military protection or police protection (remember the political climate at the time was one of ongoing revolutions around the world and in Europe) so they needed an agency that existed, was extremely professional and likely wouldn't ruffle too many feathers.

The US Secret Service fit the bill ideally.

</comment></comment></comment></comment><comment><USER36> $7500 pays for at least two more interviews with the Secret Service.

</comment><comment><USER37> holy crap I just have a renewed respect for Wozniak. He is a true thug.

</comment><comment><USER38> So, "because it's funny, huh!?"

People should know that there's a time for serious business and a time for jokes.

Talking to LE or even a Casino Security is not one of them.

How would you feel if you went to a doctor and he acted humorously and dismissively of your complaint (and it looks serious)?

<comment><USER39> How is the example of the doctor even relevant? Woz didn't seek out these people to prank them, they came to him with unwarranted suspicions.

I don't want to live in a world where talking to "Casino Security", not sure why they get capital letters in you world, about a matter where you have done nothing wrong "is serious business".

They wasted his time, he wasted theirs. It all balanced out.

<comment><USER38> The example of the doctor is relevant because the doctor is downplaying someone who has a legitimate query.

While you've done nothing wrong they have a job to do, and I didn't write it with capital letters because I overestimate them.

Woz just needed to answer "I buy the sheets from US Mint and glue them together", not go on a diatribe that although technically correct might be not so obvious

Of course a sense of humour is important, it's more important to know when to use and what are its limits.

Or feel free to call fire in a crowded theater and tell it's a joke.

<comment><USER40> Unlike your doctor and theater examples, Woz's behavior here wasn't harming anybody. What's the problem?

<comment><USER38> I might as well stand in front of someone's house and begin taking pictures in a suspicious manner. I'm not harming anybody and it's perfectly legal.

And then when the owner asks me about it I answer "this is legal, I'm not doing anything wrong, I have nothing to say, now go away", then be surprised when the owner calls the cops.

<comment><USER40> Calling the cops makes sense, but you seem to be arguing that he shouldn't have done this stuff, not merely that he shouldn't have been surprised.

<comment><USER41> I think the point is not that you shouldn't use $2 bills, but that when someone asks about them, you don't reply with "a little BS about buying them from a guy that hawked basketball tickets."

<comment><USER40> Yes, that seems to be the point, but my question is: why not?

<comment><USER41> To address your earlier point that woz wasn't harming anybody, insinuating to casino security that you're passing counterfeit money is essentially saying "I am doing you harm." We generally frown upon people saying that, even when there's no real harm to accompany the statement.

<comment><USER42> Considering that the casino security person admitted the 2 dollar bills were legit currency, the fact that he intruded on someone doing nothing wrong and proceeded to basically interrogate him, it would be more accurate to say that the casino security person was the one essentially saying he intends to do harm.

Hopefully in the future he decided to not waste other people's time on his idle curiosity.

<comment><USER38> " casino security person admitted the 2 dollar bills were legit currency"

I think he said "it works with the pen", now this is a test but it's not very reliable

"Using such pens is not a foolproof method of checking that a banknote is genuine"

[http://www.bankofengland.co.uk/banknotes/Pages/retailers/hin...](http://www.bankofengland.co.uk/banknotes/Pages/retailers/hintstips.aspx)

(they probably checked other security features, but the older notes have less features)</comment></comment></comment></comment></comment></comment></comment></comment></comment></comment></comment>


Apply HN: Kohapp – Helping friends hangout without the hassle - <AUTHOR> We are trying to make it easy for friends to hangout with each other and have fun. There are various instances where we decide to hangout with our friends but face the following problems in doing so:
- Long calls/texts/chats to decide on a place to meet and even after all that there is no surety that a decision is made. This is the biggest problem while planning a hangout. - No easy way of checking which all friends are coming and which are not. - Deciding on a date/time that suits everyone.
Even if going through all the above problems was not enough while planning, there is one other major problem at the actual hangout place. We all have those friends who never reach on time and we end up calling/texting/chat (again) to enquire about there ETA (everyone hates to wait :))
All these issues are not only painstaking but a waste of time as well. Kohapp helps to solve all of them under one roof through the help of technology. Its an app to plan/organize hangouts in 3 simple steps without need of calling/text/chat.
We are currently in development and hope to launch in the coming months.
http://facebook.com/kohapp <comment><AUTHOR> Here are the details about the solution: The app will ask users to select 1) Friends they want to go out with 2) Choose a datetime that they like to suggest 3) Select a place from list of places shown by the app based on interest(food, entertainment, activities etc). The app then notifies selected friends via notification(if they already are a user) or sms(first time invite). The others in the hangout can suggest their own place/datetime and also say yes/no for the invite.

Due to the decisive nature of the app(yes or no) and no chat will result in much faster and decisive planning. Also the app will broadcast location updates to the users of the hangout along with ETA for a certain period of time at the decided time of hangout.

</comment><comment><USER2> Hi, seems interesting, but I was thinking what separates you from the default Facebook events or when a user needs to post an update about the time he is coming?

<comment><AUTHOR> I think facebook events is more catered towards events i.e weddings, parties etc and not the weekly casual hangouts we do with our friends. Moreover I haven't met a lot of users who actually use it despite it being around for a long time.

About your question, the user doesn't have to enter any information for ETA. The app calculates that based on the hangout destination and your current location.

<comment><USER2> well in that case have you considered the battery usage? I mean doing even the simplest mapping in the background could drain so much of battery life.

<comment><AUTHOR> We have worked on making the tracking part as efficient as possible(code optimizations). Also the tracking will be on for a very limited time 45 mins to 1 hour(around decided time to meet) and the interval for location updates will not be very small hence helping in battery preservation.

</comment></comment></comment></comment><comment><USER3> This is more of a pitching tip than a question/feedback, but you talk a lot about what the problem is without really going into what your app does/solution entails. Getting friends together is a pretty obvious problem, and I'd like to know how you're addressing it.

<comment><AUTHOR> Hi.. I just posted about our solution in the comments section.</comment></comment>


Pri-matrix Factorization: Use deep learning to find chimps videos (€20k prize) - <AUTHOR> https://www.drivendata.org/competitions/49/deep-learning-camera-trap-animals/ <comment><AUTHOR> Excited to launch this with a great, new dataset for machine learning with videos! It has over 200,000 videos labeled with different species that appear in the camera trap footage.</comment>


Essential performance best practices for jQuery - <AUTHOR> http://www.artzstudio.com/2009/04/jquery-performance-rules/

<comment><USER2> I was under the impression that jQuery cached selectors, so the advice "Cache jQuery Objects", while smart for many reasons, would not actually affect performance much at all.

Was I wrong?

<comment><USER3> It depends on the selector and the browser. Something like $(".myclass") is worth caching on IE7 because it requires a pass through the entire document; there's no `querySelectorAll` or `getElementsByClassName`.

I wouldn't start by caching selectors all over the place unless you profile and see that it's slow. Doing a lot of selecting in a `scroll` or `mousemove` handler would be a bad idea though: <http://ejohn.org/blog/learning-from- twitter/>

</comment></comment><comment><USER4> So is it generally agreed that $(window).load() should be used over $(document).ready() in most cases?

<comment><USER3> I think the point there was that if you have a lot of setup to do, try to defer as much as possible past `.ready()` so that the user will have something to look at.

However, if you wait until the `load` event happens, the page is visible and the user can start interacting with it. If you're still messing with the HTML at that point it can be pretty confusing for the user. That's really common with pages that decide for example to AJAX back for saved settings; they can yank the defaults out from under you while you're typing! The southwest.com site does that and it drives me crazy.

None of the recommendations should be seen as absolutes, and some conflict with each other. For example, if you're using event delegation you've got to be careful in caching selectors to content that may go away.

</comment></comment><comment><AUTHOR> Oldie but goodie. Point #7, "Leverage Event Delegation", was particularly helpful for me.

<comment><USER5> Just don't forget that you can use .delegate() now, instead of the solution offered in the article (which is more than two years old).

</comment></comment><comment><USER6> A lot of this is outdated.

<comment><USER7> Yeah, the article is from April 2009. I realized that when he mentioned jQuery 1.3.</comment></comment>


Hyperloop - <AUTHOR> http://en.m.wikipedia.org/wiki/Hyperloop <comment><USER2> There was a large thread about this yesterday, speculating about what it is:

<https://news.ycombinator.com/item?id=5796880>

I think a "launch loop" is consistent with all of Musk's statements (and nothing else is):

<https://news.ycombinator.com/item?id=5797212>

<comment><USER3> Many people seem to be comparing Musk's statements with the current California HSR plans, but the wikipedia page makes launch loops sound quite unsuitable as an HSR alternative, e.g.:

\+ "provides a relatively low 3g acceleration"

\+ "for safety and astrodynamic reasons, launch loops are intended to be installed over an ocean near the equator, well away from habitation"

etc.

Some of the enormous advantages of HSR are the ease with which it can be seamlessly be integrated into urban infrastructure, its ability to directly serve city cores, the low trip overhead for passengers (30s from local subway train to HSR seat!, no advance reservations necessary), the ease with which it can serve multiple markets with a single trip (because the cost/overhead of an intermediate stop is quite low), and its high energy efficiency.

This make it quite different from air travel, and launch loops are more like extreme versions of air-travel in many ways (though without the flexible routing of airplanes, apparently).

</comment></comment><comment><USER4> Non-mobile link: <http://en.wikipedia.org/wiki/Hyperloop>

</comment><comment><USER5> The only realistic thing would be a ground effect vehicle. Pushing the envelope on that idea would be using a magnetohydrodynamic ionization shield around the vehicle for propulsion, but it would require putting a submarine's nuclear reactor inside. Feasible for a billionaire. But everybody's brains around that thing would fry... [http://www.savoir-sans- frontieres.com/download/eng/aspirisou...](http://www.savoir-sans- frontieres.com/download/eng/aspirisouffle.htm)

</comment><comment><USER6> There are far more significant problems to solve in transportation than this. The most significant of which, in my opinion, is working to move container transportation onto next generation land-based alternatives.

The fleet of container ships traversing the globe is huge. If I remember correctly it is in the hundreds of thousands of ships. These ships burn the most horrible fuel known to mankind: bunker fuel. This stuff pollutes like nothing else. The pollution created by these ships nearly dwarfs that produced by all automobiles in the world combined. On top of that, the ships also contribute to species pollution by accidentally relocating marine fauna through their ballast tanks. It is a horribly inefficient mode of transport screaming for a land-based solution.

This is where high speed rail could make a huge difference in the US. Huge cargo only trains reaching average speeds in the 200 to 300 mph range could move all cargo from coast to coast and keep tens of thousands of container ships from going through the Panama Canal. Power could come from nuclear, wind and solar. Beyond that, such a project could also be leveraged to install the massive power distribution network needed to support millions of electric cars in the future.

<comment><USER2> _These ships burn the most horrible fuel known to mankind: bunker fuel. This stuff pollutes like nothing else. The pollution created by these ships nearly dwarfs that produced by all automobiles in the world combined._

If you source this statistic [1], you find it's contrived to compare one pollutant (sulfur) which auto fuels _in particular_ contain extremely little of. Coal power emits two orders of magnitude more sulfur than gasoline/diesel [2], and is the largest SO2 source worldwide (not bunker fuel). It's very polluting, but far from the worst.

[1] <http://www.gizmag.com/shipping-pollution/11526/>

[2] [http://www.eea.europa.eu/highlights/data-and- maps/indicators...](http://www.eea.europa.eu/highlights/data-and- maps/indicators/eea-32-sulphur-dioxide-so2-emissions-1/assessment-2)

 _It is a horribly inefficient mode of transport screaming for a land-based solution._

It's by far the _most_ efficient method of transport. In what sense do you think it's not?

[https://en.wikipedia.org/wiki/Environmental_impact_of_transp...](https://en.wikipedia.org/wiki/Environmental_impact_of_transport#Shipping)

<comment><USER6> > It's by far the most efficient method of transport. In what sense do you > think it's not?

It's called "hydrodynamics", google it.

A purpose built high speed electric train pushes around air, not water, and can move the same cargo with far less power and definitely less pollution. Instead of doing 20 knots it would travel at 200 to 300 miles per hour. It could also plot a more direct route between, say, Los Angeles and New York than going through the Panama Canal.

A typical container ship doing that route burns over a MILLION gallons of bunker fuel. And there are tens of thousands of ships making that trip per year. When I checked, fuel costs for the trip were in the order of USD $1.5 million plus approximately $300K canal crossing fees.

Between fuel, fees, crew, bonding, and other operating costs each trip probably costs well beyond two million dollars. That's the competition. The high speed cargo train I envision should be able to make the coast-to-coast trip for far less money, pollute less and make a nice profit in the process.

The part that is equally important is that such a train system would have vast ramifications across industry segments. I could see it creating hundreds of thousands of jobs, if not millions. I would feed the industrial base with much-needed cash. It would provide a unique opportunity to build a massive power and data backbone to service the next hundred years of growth, including a transition to electric cars and trucks. It would also provide a solid business advantage to the North American continent for the next 100+ years. The advantages only multiply as oil price increases.

Looking at this as just an idea to get containers on a new-fangled high-speed cargo train would be to miss what lives below the tip of the huge iceberg such a national project would represent.

BTW, the idea isn't to eliminate all container ships. The only way to make that happen would be to create a project of unprecedented international cooperation that would, effectively, connect the continents with high speed cargo rail.

An setup connecting US and Canadian Pacific ports to the Gulf of Mexico and US and Canadian Atlantic ports would cut cargo travel times from Pacific to Atlantic from about two weeks to a day or two at the most.

If you can get cargo from US Pacific to US Atlantic in two days you can now compete with the Suez Canal in getting goods from Asia to Europe (about 30 days).

Container ships could now travel from China to the US Pacific coast. They'd transition cargo to land-based high-speed trains for a trip to the Atlantic. Once on the other coast container ships would take the cargo to Europe and other destinations. It would be cheaper, faster and pollute a hell of a lot less.

Strategically speaking, this would also place the US in a very unique position as the preferred cargo travel route between major world-wide sources and destinations. This has to be good. And it would be an advantage easily good for a century or more.

Going further, I could see a new generation of container ships developed to service the new routes. The idea being to maximize performance at every level.

Yes, I put a effort into researching this a nearly every level. It's hard to post references and links here because the information is spread all over the place and you really need to do a bunch of math to see the logic. It was very easy to conclude that high speed passenger rail in the US is nothing more than highly refined political horse shit. It has nearly no value and it will be a constant drain of resources as we keep them running for the few people who will use them. You would have to both massively modify American cities, roads and culture for them to begin to make sense.

Don't get me wrong, I also understand it would be easier to prove the existence of god than to build a new true high speed transcontinental cargo rail system. We are at an age where we are incapable of approaching large projects due to, well, a million reasons. So, yeah, this, to some extent, is nothing more than a somewhat pointless spreadsheet exercise.</comment></comment></comment>


Inside the Nondescript Building Where Trillions Trade Each Day - <AUTHOR> http://www.bloomberg.com/news/articles/2016-04-13/inside-equinix-s-ny4-data-center-where-wall-street-trades <comment><USER2> A little off topic but seeing all of this reminds me of threats to our cyber infrastructure. I wonder what their attack rate is from cyber and physical threats. We hear of the global threat of terrorism attacking our infrastructure all the time, but what if it successfully hit the rich? What if a group successfully penetrated one of these center and disrupted trading for the 1%, I think we'd see a lot more attention to cyber threats. Might be an interesting dumpster fire to watch...

</comment><comment><USER3> I think Secaucus is a Latin word meaning "swamp". Just kidding, but Google Earth shows a ground level elevation of about 8 ft on a street near NY4.

Isn't this a problem? Does anyone know if there was any flooding in the area, e.g. because of Hurricane Sandy? The nearby New Jersey Meadowlands is, according to Wikipedia, "a general name for the large ecosystem of wetlands in northeastern New Jersey".

It seems weird that so much of the world's business is transacted a mere 8 ft above sea level.</comment>


Burning Man's Mathematical Underbelly - <AUTHOR> https://www.scientificamerican.com/article/burning-mans-mathematical-underbelly/ <comment><USER2> > you can get everybody onto the same page by talking about the complex plane > in terms of the layout of Black Rock City: the Man is at zero, Center Camp > (Esplanade and 6:00) is at i, the main entrance is around - 2i, the 3:00 and > 9:00 plazas are at ± 1, and the Temple (a nondenominational, pan-belief, > transient, and intentionally flammable structure) is at + i.

While this is accurate, after seven years of attending Burning Man this is the first time that I've heard anyone describe the city layout - even after spending a pretty significant amount of time at self-identifying geek camps like The Institute.

<comment><USER3> Hm, I think there's a typo in the article: center camp would be at -i, not i.

Anyway, it seems a bit strange to me to use the burning man map (a polar coordinate system) to describe a Cartesian-style grid like the complex plane.

</comment></comment><comment><USER4> A nice article for someone who knows nothing about Burning Man. If you've been, you will learn little that you don't already know. Burners choose to play in a difficult, often uncomfortable environment. They have a higher than average desire to be challenged - by everything from esoteric math and physics discussions to learning (as novices) moderately advanced contradancing (a radically inclusive danceform [1] that has been analyzed with matrices [2], disclaimer - my camp).

1 [http://www.burningmancontradance.com/home/contraintro](http://www.burningmancontradance.com/home/contraintro)

2 [https://ida.mtholyoke.edu/xmlui/bitstream/handle/10166/679/4...](https://ida.mtholyoke.edu/xmlui/bitstream/handle/10166/679/422.pdf?sequence=1)

<comment><USER5> >They have a higher than average desire to be challenged

A lot of them also take a lot of MDMA and drink a lot of alcoholic beverages. There's something for everyone at BM.

<comment><USER6> Hangovers are hell in that environment. If you got to burning man for the free drinks you're an idiot and won't come back. MDMA is fun to make a night of but not the drug of choice out there.

<comment><USER7> What's the drug of choice out there?

<comment><USER6> Sleep deprivation, bicycling, lots of water and downtempo electronica.

</comment></comment></comment></comment></comment><comment><USER8> _We weren't always so lucky. One year, before we'd even finished setting up the booth, a cadre of MIT undergraduate physicists stumped us with 'Soap bubbles physically solve minimal surface problems. Are there any other physical phenomena that quickly solve NP-type problems?'_

Anyone have more resources on this? I could only find a brief overview by Scott Aaronson [1].

[1]. [https://www.scottaaronson.com/papers/npcomplete.pdf](https://www.scottaaronson.com/papers/npcomplete.pdf)

<comment><USER9> The main thing I wonder about this is whether it's misleading to say the soap bubble is 'solving' a problem of high computational complexity.

If we were to form a description of its state evolving, framed as a computation, then that computation would be in such and such a complexity class—sure. But if you want to go ahead and say that soap bubble is literally computing in the same sense, you're making a number of implicit philosophical commitments that I have yet to see a justification for when this subject is brought up.

Edit: to clarify, what I'm getting at is whether we're _using it_ to solve what is a problem for us, or whether it literally has to 'find a solution' in order to get into the state it gets into, so that principles of computational complexity etc. would be somehow applicable to what it's doing.

<comment><USER10> My grad school professor was at a bar with a consultant friend who was trying to find the optimal wiring paths for routing expensive electric cables.

My professor asked for the change in his pocket: they went to the hardware store and got plexiglass, dowel and drill. In the hotel room, the put together a model of the points to connect between the plexiglass sides and dunked it in the soapy hotel tub.

the pattern the soap bubbles formed was the shortest path between the electrical tower model.

<comment><USER9> Okay, that makes sense to me—we can set up the physical system's initial conditions to mirror some problem we want solved, then let it do its thing and grab the solution back afterward.

That definitely feels better justified than the view I had of it, though it still has some weakness, I think.

From my understanding the justification for calling it computation comes down to: we can use the physical system to solve a problem that we would ordinarily approach computationally, therefore it must be computing too. Right?

<comment><USER11> > From my understanding the justification for calling it computation comes > down to: we can use the physical system to solve a problem that we would > ordinarily approach computationally, therefore it must be computing too. > Right?

To me, it feels like the intention of "computation" as used here is to give us a convenient way to describe what the physical system _appears_ to be doing (solving something the only way we know how--computationally) as opposed to saying: the rules of our universe influenced these particles to act in such a way that manifested in something interesting to us (an efficient solution to some problem).

Very interesting to think then if we can leverage physical systems (specifically non-quantum, to make that more interesting) to solve NP problems.

</comment></comment></comment></comment></comment><comment><USER12> I had to read the headline three times before it would parse correctly. Guess I should have just clicked on the link. I read "Man's Mathematical Underbelly" as the object of "Burning".

</comment><comment><USER13> Wow, what a great read. Thanks for sharing!

</comment><comment><USER14> I met Spencer in NY. Super cool guy, does really interesting research outside of BM.

</comment><comment><USER15> 1 drug + 2 drugs = 3 drugs

<comment><USER16> I encourage you to think constructively how your commentary can further a discussion which, by both the article and other comments, has proceeded well beyond infantile jokes and worn-out stereotypes.</comment></comment>


Show HN: ARKit Dev – A collection of ARKit development resources - <AUTHOR> https://arkitdev.co/ <comment><AUTHOR> Hey guys, I made a new site (arkitdev.co) to collect all the tutorials, articles and code repos about ARKit, since I know many of us are super excited about playing with this new tech and seeing what we can come up with. :)

Feel free to submit your own links, although the form can be bit buggy at times. Currently I'll have to manually review and add a "maker" to each of the posts, but that will hopefully change in future versions.</comment>


Stored Procedures are EVIL - <AUTHOR> http://www.tonymarston.co.uk/php-mysql/stored-procedures-are-evil.html This an old article but the guy seems to have a point. <comment><USER2> _I was weaned on file systems and databases which did not have any facilities for stored procedures and triggers, so I learned how to build applications without them_

There are many things wrong with that article (I actually doubt that he's ever written a stored proc on a real database) but that sentence sums it all up. It's the same stupid argument that compilers can't generate good code, use assembly language. Or dynamic languages are slow, stick to binaries.

Plus, "evil"? I'm watching Channel 4 News right now, they are reporting on brutality in the Nigerian security services. So when I see some spoilt little geek whining about having to step outside his comfort zone and learn a new skill, I can't take it very seriously.

</comment><comment><USER3> I've never met the tenderfoot who has the attitude the article is based on. Its quite the opposite, I guess its the tenderfoots using oracle and postgres and the old dinosaurs using mysql ( or mSQL ). Silly me. I thought the kids like the mysql and no triggers, procedures etc.

\--

This is in total conflict with the attitude of today's wet-behind-the-ears tenderfoot greenhorn who seems to think:

Use stored procedures and triggers at every possible opportunity simply because you can.

</comment><comment><USER4> Wow, over-generalize much?

Remind me to keep an eye on the baby next time it's this guy's turn to throw out the bathwater.</comment>


What's New in Scratch 2.0 - <AUTHOR> http://scratch.mit.edu/overview/ <comment><USER2> My son is finally make his space shooter the way he envisioned because of the new clone sprite action. Exciting times ahead, here is a pic of him getting down last night:

<https://pbs.twimg.com/media/BJ3OudQCQAALZCc.jpg:large>

<comment><USER3> I had to implement some unsatisfying hacks to make my Scratch shooter work as well! If I remember correctly I was manually duplicating the master projectile and I had to register each projectile against each enemy.

<comment><USER4> Using Alice 2.2 (which also doesn't allow cloning/instantiation) my students had a similar issue, and solved it by using what they called "Megaman logic".

Megaman could apparently only shoot N bullets at once (3 or 5, I forget). Thus, they only ever had 5 bullet objects, iterated through a list to see if the bullet was shot or not, and only let you fire if there was a spare bullet.

I thought it was very clever. Sounds like you did much of the same thing.

<comment><USER3> Just so! I had three projectiles (rock1, rock2, rock3) and they shared a global "fire selector" that operated as a sort of mutex.

[https://www.evernote.com/shard/s4/sh/90b814fd- df52-4fcf-9127...](https://www.evernote.com/shard/s4/sh/90b814fd- df52-4fcf-9127-8d0e5ed4d448/29f131d569ece22e606957b4f7c946ea)

</comment></comment></comment></comment><comment><USER5> One important thing that's new in Scratch 2.0 under the hood is the transition from the .SB file format (a rather complex SmallTalk object store) to a ZIP based bundle containing all required media along with JSON encoded scripts. The upshot of this is that consuming Scratch files in other apps should be a lot easier.

That said, one _downside_ of Scratch 2.0 (at least in my view) is the migration to a Flash based editor/playback engine. And I don't entirely blame MIT for this, because Scratch 2.0 has been under development for quite a long time. Five years ago, Flash maybe seemed more appropriate than it is now.

<comment><USER6> Flash sucks, but I'll take it over the old Java applet any day.

<comment><USER7> I dunno, the latter is much more stable in my experience.

</comment></comment></comment><comment><USER8> I used Scratch to teach my son how to program at 9; and now, at 11, he's doing JS/HTML/CSS at a beginner level.

We used the scratch programming for teens [1] book.

\-----

[1]: <http://www.amazon.com/gp/aw/d/1598635360/>

</comment><comment><USER9> 2.0 may have been a long time in the making, but I just bought the Scratch Adventure book for my kids last week, which uses 1.4, unaware of the pending update. When I went to the site to download Scratch, it was down while preparing for the 2.0 release. I thought it was a pretty ironic introduction to programming, always new shiny objects.

<comment><USER10> Indeed! Don't let that stop them from having fun, though.

For the book, you can still download 1.4:

<http://info.scratch.mit.edu/scratch_1.4_download>

And all the games should still work in the new 2.0 interface too; it's an overhaul of the development environment, with backwards compatibility. (I'm updating the book now for 2.0, I edited it.)

<comment><USER11> I'm really glad to hear that! My 9 yr old daughter and I just finished going through this book on 1.4 and had a lot of fun. Do you happen to know if any of the projects will be different? I'd certainly buy a new copy again for additional projects.

<comment><USER10> We'll have some entirely new Scratch books with "harder" projects in the Fall, I hope. Physics simulations, geometry, math and science-oriented projects, not just games.

Some great new authors working on those, and not just Scratch too, but some "real languages".

But sadly, the 2nd edition of Super Scratch will probably just be an update to stay relevant, not an overhaul.

I hope that Edmond, the author of that first edition, will write a second book, but that depends on his time. You can check out some of his other Scratch projects here: <http://scratch.mit.edu/users/LEAD/>

<comment><USER11> That's great news! I appreciate it and I'll keep an eye out for those books.

</comment></comment></comment></comment></comment><comment><USER4> I'd love it if anyone could give a good head to head on Scratch 2.0 vs. Snap! 4.0[1] (the new name for BYOB, Berkley's Scratch spin-off). I realize that Snap is aimed more teaching high school/college CS, but they're seeming to converge a bit.

I don't have a CS class this year, so I haven't set aside enough time to dig into the latest versions of Snap or Scratch. If anyone has any insight to share, it'd be greatly appreciated.

[1] <http://snap.berkeley.edu>

<comment><USER5> From a purely technical perspective, the biggest difference is that the Berkeley team (Snap) re-implemented in JavaScript, and MIT (Scratch 2.0) in Flash. The former also uses XML as a format, the latter JSON (in 2.0).

Like you say, Snap's main difference is it makes some more advanced CS concepts more overt, primarily for use as a teaching tool for older students. To this end, it doesn't have the deep social integration that Scratch does: remixing and sharing are a big part of Scratch.

But that isn't to say that Scratch isn't suitable for high school or college level courses - Harvard's been using Scratch in the first week of it's intro CS class for several years now, with great success. The advantage of Snap is that transitioning from it to pure coding can be less of a leap, due to support for things like recursion, procedures, and continuations.

The Lifelong Kindergarten's remit at MIT means that they tend to place emphasis on a certain age range. In addition to Snap there's also an offshoot of Scratch targeted at very young children (Scratch Jr, which I think is developed by Tufts).

<comment><USER12> So Smalltalk is gone?! :(

</comment></comment></comment><comment><USER13> Requires an "always on" Internet connection.

Coupled with the Flash front end, that doesn't make me hugely happy.

</comment><comment><USER14> Anyone know more about how the social features are moderated? Thats my first thought these days, sad I know but...

<comment><USER15> I don't know how they do it. I have seen some pretty freaky games on their webpage, and I have seen a lot of games uploaded from game-programming events that I have hosted.

</comment></comment><comment><USER16> What does this mean for the Raspberry Pi? Will Raspbian's default browser be able to handle it?

</comment><comment> alok-g Does anyone have any recommendations on at what minimum age should this be introduced to kids? The website recommends 8-16 years, but then I was doing real programming at the age of ten, so eight may not be the best answer. My son is five right now.

Introducing too early seems to have a downside that if my son does not like it (or cannot grasp it), he develops a negative feeling towards it like boredom or else, and then subconsciously does not want to return to it even at the right age.

<comment><USER17> During Coding Goûter sessions, kids as young as 5 have played and created things with Scratch 1.4 and loved the experience. They are begging to come back, and it becomes a very usual thing to do, which is exactly our goal.

(Note that we mix kids, with ages ranging from 5 to 14, and always a 50/50 ratio of girls/boys, not via quota but because of the way the events are planned. So we also have older kids. It's good for the younger ones.)

At this age, they (usually) don't read, so they generally are working with an adult and another kid, or in some instance with an older kid (my just 6 years old daughter for example worked one of the firs times with an older girl that knew Scratch.)

A very important thing to do is to let the creative direction to the kids. Don't force the programming of a shooter on them. They have lot of ideas, and they will be more motivated if the idea come from them. Also they will be proud to see it happen. They'll want to move things, animate, etc. They'll want to copy things they have seen. Letting them draw on paper, for example a character, then taking a picture and incorporating it in Scratch is a nice way to alternate between two different activities (solving the "will they focus for long?" question)

If you want to know more: <http://codinggouter.org> and my talk at FOSDEM: <https://fosdem.org/2013/schedule/event/coding_gouter/> may be helpful

</comment></comment><comment><USER6> This is huge! Vector graphics and cloning are things I've wanted for years. It's also great to see it alk in the browser.

</comment><comment><USER18> Did anyone really want an in-browser editor? It's the kind of thing that's cool in theory, but not productive.

</comment><comment><USER19> but but how it will work with the lego wedo now ? :(</comment>


Ask HN: Study a combination of computers and biology? - <AUTHOR>

I want to study a combination of computers and biology? is that possible help ??? <comment><USER2> Yes to both?</comment>


Climbing the wrong hill (2009) - <AUTHOR> http://cdixon.org/2009/09/19/climbing-the-wrong-hill/ <comment><USER3> Indeed, talented, and fully energetic young people should throw themselves immediately into the startup arena, before they've developed any real skills and particularly life skills, bargaining savvy, etc.

That way the financial system in the form of VCs can extract maximum benefit for minimum expenditure.

<comment><USER4> _How can smart, ambitious people stay working in an area where they have no long term ambitions?_

The answer, of course, is money.

But Dixon prefers to camp out on algorithms and behavioural science rather than providing the simple answer, and if you read between the lines (and you're familiar with the startup scene, VC, and suppressed developer wages by collusion + H-1B visas + "talent shortage") it's not hard to figure out why.

<comment><USER5> Yes, its not as clear cut because being in finance vs. joining or launching a startup has a very different risk profile.

If you stay in finance for some time, you have probably made a lot of money by the time you get out. The plan is to work yourself to death as an investment banker and hope you made enough to retire (or become a VC, like him) at 35.

Work years for a startup, and you might not have made anything beyond living expenses. The upside is that the working culture will probably suck less and winning the startup lottery will make even more money. Also, scamming people and being a sociopath is optional (but see Uber).

</comment></comment></comment><comment><USER6> > Over the years, I've run into many prospective employees in similar > situations. When I ask them a very obvious question: "What do you want to be > doing in 10 years?" The answer is invariably "working at or founding a tech > startup"...

It's great to ask _what_ questions, but they should almost always be followed by _why_ questions. _Why_ do you want to work at or found a tech startup?

Startups have been glamorized by the media for well over a decade, and the hype today is at a fever pitch, so it's really no surprise that startups are so appealing. That doesn't mean that most people have a realistic understanding of what it's like working at or starting one.

Frankly, "I want to do a tech startup" is as much a red flag as "I want to make a lot of money." It's so non-specific as to be effectively meaningless. A startup is just a vehicle, and if you don't have an interest in driving somewhere specific, you're driving for the sake of driving.

> There is a natural human tendency to make the next step an upward one.

There's also a natural human tendency to believe that the grass is always greener somewhere else.

The prototypical Silicon Valley startup can be as demanding as an investment bank, and a good number are chaotic and dysfunctional to boot. And you don't have folks like Sam Altman talking about "founder depression" because running a startup is the next best thing to heaven.

</comment><comment><USER7> There's a good reason near-term rewards are overvalued relative to long-term ones. Long term rewards might never happen.

</comment><comment><USER8> This is not a good analogy. Money is the obvious reason one stays at the "lower hill". Thus it is not a question of whether the person can stoop down from the "lower hill" and get to the "higher" one. It's a question of which hill is really higher (by that person's standards).

</comment><comment><USER9> That is difficult to have the resources banked sufficient to leap off the little hill and find yourself in the desert of despair, to then randomly leap back to the base of what turns out to be the big mountain, but not have the clout to climb it. I appreciate the comparison to an optimization search algorithm, but life is really complicated for most to have the stomach for that level of risk.

</comment><comment><USER10> There is an important difference between the algorithm and personal career: climbing the other hill has nothing to do with climbing the highest hill, but that's not the case regarding career development. Startups are creating new things and jobs, so how do you know that current jobs would not provide valuable assets in the future?

</comment><comment><USER11> Speaking from experience this process does have demerits. For example - <USER2> long before you decide that the hill you just climbed is not the highest. It's easier to figure out that a banking career is not for you but it's not that easy to figure out that a startup job is not for you.

</comment><comment><USER12> It makes me wonder - is there a good hill-climbing algorithm that takes account of uncertainty - where the hills can go up and down over time as you're climbing them? I suspect the naive algo might perform better in those conditions - maxima that are closer to you would be favored.

<comment><USER13> Simulated annealing was already mentioned. Also parallel tempering is very effective at finding the highest (or lowest) areas even faster.

I actually liked the analogy but applying algorithm analogies to one's life of course only goes so far. First, even if one decides to look at life as an optimisation problem, it is much more difficult than the hardest multiple objective optimisation problems. One of the reasons is that I'd equate the optimisation landscape not with static hills, but more similar to waves or sand dunes that keep shifting with time in a way that can at most give you short term predictions. We don't have the life span or processing power to use a computer algorithm to optimise a static "life" landscape, let alone a dynamic one.

</comment></comment><comment><USER14> Don't forget to count the number of steps! Reaching the top of a small hill might take 2 steps, and algorithms like simulated annealing (unlike actual annealing) keep track of the entropy change.

</comment><comment><USER15> there is probably a change of hills with the time. > Hills are dynamic > Hills are interconnected > Hills climber is not constant over time

</comment><comment> bra-ket tldr: Premature optimization is the root of all evil</comment>


Apple iTunes, at Long Last, Gets Rights to Beatles - <AUTHOR> http://online.wsj.com/article/SB10001424052748703326204575617004052395816.html?mod=e2tw#articleTabs%3Dcomments

<comment><USER2> Is this really their 'big announcement?'</comment>


Love in Plague Time - <AUTHOR> https://www.nybooks.com/articles/2020/01/16/historical-fiction-love-plague/ <comment><USER2> [https://archive.md/4f5CK](https://archive.md/4f5CK)

<comment><USER3> From that link[0] Firefox reports: "Warning: Potential Security Risk Ahead

Firefox detected a potential security threat and did not continue to archive.md. If you visit this site, attackers could try to steal information like your passwords, emails, or credit card details."

0 - archive.md/4f5CK

<comment><USER2> Firefox doesn't tell me that. This is a well-known archiving site, so such a warning makes little sense.

<comment><USER4> That site has an invalid SSL cert, that's why the warning is there. Chrome has it as well.

<comment><USER5> I think it was because Let's Encrypt had to revoke 3 million certs today: [https://community.letsencrypt.org/t/revoking-certain- certifi...](https://community.letsencrypt.org/t/revoking-certain-certificates- on-march-4/114864)</comment></comment></comment></comment></comment>


FTC sues D-Link over router and camera security flaws - <AUTHOR> https://www.consumer.ftc.gov/blog/ftc-sues-d-link-over-router-and-camera-security-flaws <comment><USER2> My boss installed 2 camera DVRs a year or so ago. All I did was provide 2 external IPs for the DVR and didn't worry much about it. The password was the default "123456" that comes with these things, but since we don't care much about who sees the footage. At worse people will change the password and we need to factory reset (never happened).

Last week the internet for the whole office was going down. Weirdly I could remote in, but the DNS was not working. I first thought our DNS server crapped out but it was working fine. After some investigation, the firewall was not responding. After rebooting the firewall, it would work fine for a while, but go down shortly after.

Long story short: the DVRs my boss got (unbranded) come with telnet access on some nonstandard port. A botnet got access to it and was making thousands of dns and telnet queries, overloading the firewall.

<comment><USER3> You mapped all ports from the external IPs to the DVR?

<comment><USER2> The firewall has a 1 to 1 NAT feature. It maps an external ip to an internal one. I had no firewall policies set. Rookie mistake, I've blocked all outgoing access and only allow port 80 and the video port incoming.

<comment><USER4> I wouldn't even allow port 80 incoming from the internet. Even if the web interface appears to have authentication on it, there may be vulnerable CGIs. They left a telnet interface wide open--do you trust them to write a secure website?

</comment></comment></comment></comment><comment><USER5> How long is the company that provides the product on the hook for for post- sale support and security updates? If I sell an internet-connected device which has a flaw discovered 5 years after the sale, am I still liable for patching that? Nowhere in this article nor in the complaint do I find any guidelines as to what they consider to be reasonable after-sale support. They list similar action taken against Asus and TRENDnet, which are all large international companies. I'm a dude in my workshop and placing an after-sale support and warranty requirement on anything I make for a period of n-years is onerous.

<comment><USER6> If I'm a dude in my workshop making children's toys, I'm on the hook for strict product liability the rest of my life in I made dangerous toys.

If I'm a one man contractor building a house, certain categories of mistakes I'm on the hook for for the rest of my life.

I don't think it would be unprecedented for IoT device makers to be on the hook forever for certain categories of security flaws. It is not like security flaws grow spontaneously like rust a car. They are all in there from the beginning, whether they are known or not. Most of the IOT security flaws that I have heard about could have been easily prevented with security conscious design and development practices. If we want to have secure IOT devices, then we need to hold people accountable for making insecure ones.

<comment><USER5> The trouble with your analogy is that state-sponsored teams of children aren't working day and night to find new ways to make your toy dangerous that you could never have thought of at the time.

I get that D-Link sucks, and their security practices right out of the box were "bad", but what is "bad"? In the eyes of the FTC and US law, what constitutes "good" and "bad" practice? How do I ensure that I am holding myself to those practices when a product ships? What is my responsibility for vulnerabilities found after the product shipped?

Let's say for example I ship a widget with an IP address and something like Heartbleed shows up 4 years later and my device is vulnerable. Am I on the hook for patching all the systems in the field? What are my obligations here?

<comment><USER7> No, they're not state-sponsored teams... they're _children_ , they're far more pernicious than black hat teams, and there's a ton more of them. ;)

The questions you're asking are good ones, and they're ones that we as a society need to start answering. 20 years ago, the idea of always-connected devices littering our homes would've seemed like sci-fi magic, but now it's actually coming commonplace.

But this isn't the first time we've had this sort of thing happen. Like, how did electronics gadgets become safe enough that we never think twice about the fire hazard of plugging in a mystery wall wart?

Or any kind of product. What we've come up with is, generally speaking, companies have to try to uphold a standard, they can be held liable, and can be put out of business for making unsafe products.

Why it should be any different just because it's a "now with Internet!" product, I don't really know.

<comment><USER8> But IMO this isn't a "safety" issue with the devices themselves that could hurt the users unintentionally, this is a 3rd party "weaponizing" the system for their own use.

I'm struggling think of a good analogy, but it seems more like suing Ford because thieves can easily steal their cars for use in robberies.

In essence, the device is being used by an unauthorized 3rd party to harm a 4th party. The device owner in some cases is never harmed or even inconvenienced, and neither is the manufacturer.

It's a shitty situation, and I don't personally know where the line should be drawn, but IMO it should be drawn clearly.

<comment><USER9> i'd compare it to freon and freon using devices which had to be properly utilized or the ozone layer got hurt, only now substitute freon for 'product with ability to connect to the internet that doesn't get security updates anymore'. such devices should be disconnected from any non-air-gapped network or they're a considerable risk for their environment (the internet).

<comment><USER8> The "EPA" is actually a perfect "analogy".

We need an IPA (perhaps a different name...). We need someone that will set "standards" for a minimum baseline of "security" to ensure the health of the internet, and dole out fines based on violations.

However they need to be VERY careful. With something like freon it's a physical "thing" that can be regulated. We don't want to regulate "ideas" or even code, that to me seems like a very dangerous thing.

But you are right, we need something that will protect the "health of the internet" like we protect the health of our environment.

<comment><USER10> How do you add any regulation without regulating the code? code is our environment.

<comment><USER8> I meant more that I don't want it to be a crime to write a TCP stream handler without SSL. Or to need a license to write crypto code.

To me it gets dangerously close to regulating ideas.

I'd want to it more based in consequences. If your product or code is used in an attack, you get fined. No need to dictate the code or software solutions allowed.

</comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER11> Last year I looked into how exposed D-Link devices on the Internet and created this overview page:

[https://dlink-report.shodan.io/](https://dlink-report.shodan.io/)

There are basically ~500,000 D-Link devices directly connected to the Internet and exposing a service that a person on the outside can connect to. Most of the devices I saw back then, and still do now, are their standalone webcams.

</comment><comment><USER12> This is great AND its a poor substitute for tort reform that permits private companies and individuals to collect damages for hardware/software that is negligently or fraudulently insecure. Products liability lawyers are very effective at changing industry behaviors towards safety to the lawyer's financial benefit but, ultimately, for end-user's security and safety. IANL.

<comment><USER13> I agree but you seem confused about the phrase/concept of "tort reform", which in the abstract could mean many things BUT as usually touted by politicians, generally involves making it _harder_ for companies and individuals to sue other companies/individuals for damages.

<comment><USER14> Maybe they're from the future and it's long since been changed to prevent individuals from bringing suit against corporation. So in that future "tort reform" means repealing the previous reform.

Honest timetraveler mistake.

</comment></comment></comment><comment><USER15> This should happen more often.

The software industry must come to the same level of responsibility and quality expectations of other industries.

<comment><USER16> This. But when we go here, and I believe we will, I am concerned of what happens to our ability to put alternastive firmware / OS / SW on a systems we've purchased. We already see this in regulated industries such as automotive. Part of the motivation not to let us replace software in an automotive infotainment system surely is a concern over a liability this might cause. It would be a sad day indeed when we would regulate out our ability to update vendor provided crapware with OpenWRT, Lineage OS, or what not.

<comment><USER17> IMHO, we can make parallels with RF spectrum. Global network and RF spectrum are globally shared resources, so some rules for RF spectrum should apply to global network too. If your system is beyond some minimal power level, e.g. less than 1000 hosts, you are free to do what you want without license, unless you are harming someone. For more than 1K network hosts exposed to global network, minimum safety requirements must be met.

<comment><USER18> Nice analogy. Expanding a bit, if a popular walkie-talkie brand from 20 years ago starts failing today in a way that switches it to aviation frequencies, I believe the manufacturer would be on the hook.

</comment></comment></comment></comment><comment><USER19> Does anyone know if the FTC is backdooring a federal warranty carve out here for software with respect to security? Generally devices that come with software have specific disclaimers of all warranties for fitness and damages (either direct or incidental). And California has held such exclusions to be allowed[1]. So if the FTC prevails and D-Link is held to be liable for their software flaws, would that then create a place where consumers could sue software producers when their software broke even though there are specific exclusions in the TOS and EULA?

[1] [http://wmblaw.blogspot.com/2013/05/are-contractual- exclusion...](http://wmblaw.blogspot.com/2013/05/are-contractual-exclusions- of.html)

<comment><USER20> The FTC is suing D-Link for "unfair or deceptive acts or practices in or affecting commerce" because they claimed their routers were secure, but then failed to follow even the most rudimentary best practices.

I imagine that if D-Link claims that their software was provided without any "warranties for fitness and damages", the FTC will argue that such a claim _definitively proves_ that D-Link's marketing of their security features was unfair and a misrepresentation.

<comment><USER19> I get that, but _every_ software package I have ever bought explicitly disclaimed it would do anything in the EULA and TOS documents. So if they are successful at suing D-Link does it create a carve-out that says "If you tell people your software does _x_ or has feature or attribute _y_ , and it doesn't actually do that or have that, you are liable for misrepresenting your product."

Because it it does create that carve out then there are going to be a BOATLOAD of lawsuits against software companies.

<comment><USER20> _> So if they are successful at suing D-Link does it create a carve-out that says "If you tell people your software does x or has feature or attribute y, and it doesn't actually do that or have that, you are liable for misrepresenting your product."... Because it it does create that carve out then there are going to be a BOATLOAD of lawsuits against software companies._

They also need to prove material harm to consumers. So lawsuits will almost certainly focus on security, privacy, and outright fraud/theft.

I really do not understand why this bothers people so much. Hire competent engineers. Follow best practices. It's really not that hard, and it's in your company's best interest anyways.

(Also, since its come up in other sub-threads, the name of the FTC is the Federal TRADE Commission, and they regulate _commerce_. OSS projects that don't engage in commerce aren't subject to these regulations.)

<comment><USER21> The commoditization of this equipment means that any company doing things well would quickly be outmanuevered by those who do not care enough to do the same.

<comment><USER20> If that's true, then market mechanisms are insufficient to curtail the existence of huge IoT botnets.

That's a strong motivator for regulatory intervention.

But also, the sorts of minimum safeguards that are being requested by the FTC don't actually cost these companies anything more to implement. Requiring credential changes on first login? That's maybe 100 LoC. A basic once-over to catch any super obvious command injections in a relatively simple web UI? Maybe a day or two of engineering effort. Not posting private keys on a public website? Properly train one set of people and make them gatekeepers -- a bit of overhead, but again, extremely minimal when measured against overall product lifecycle costs.

FTC isn't asking for formally verified secure kernels with locally sourced state-of-the-art crypto and in-depth end-user training by top psychologists. They're asking for very simple, easy to implement safeguards that a novice developer could implement in a few days. These companies surely spend more than the entire cost of compliance on executive retreats and office holiday parties...

Device manufacturers _do_ have to hire one or maybe two engineers who are competent at security. But it's not like those people necessarily cost more than whoever they have on payroll ATM. And in fact, it's likely that those people _already are_ on payroll at these companies -- in which case, all they have to do is start prioritizing and listening to security-minded voices already in their organization.

</comment></comment></comment></comment></comment></comment><comment><USER22> After Mirai botnet disaster, government decided to step-in to IoT security landscape. I am not sure how far they can go to force consumer electronic manufacturers to add security to their products. Some CE manufacturers do not control the bulk of the software in their products. They just take kernel/libraries/binaries provided by SoC vendor and glue them together. SoC vendors are even more careless about security and they often provide out-dated and unpatched software. Even if SoC vendors or CE manufacturers start patching the vulnerabilities, it is very difficult to implement a secure firmware upgrade mechanism. A glitch in automated firmware upgrades can be very risky.

Perhaps FCC could start addressing these issues as part of certification requirements. However there are many challenges. How will FCC enforce SecureBoot and secure firmware upgrades and longterm product support? What will be the penalties. How will they deal with unbranded (or foreign) brands.

</comment><comment><USER23> Now if only ISPs could start notifying/disconnecting compromised users until they fix their shit.

<comment><USER24> So the customer throws away every networked device in their home (because they have no idea which one got them banned) and buys new ones from different vendors... which are also insecure and result in their ISP banning them again? And ISP bills go up to cover the massive security scanning infrastructure needed?

<comment><USER23> > So the customer throws away every networked device in their home (because > they have no idea which one got them banned)

If a breaker in your kitchen trips do you throw out every single appliance? If your water bill is high do you replace every single sink and toilet?

> and buys new ones from different vendors... which are also insecure

Maybe after getting burned by purchasing insecure unsupported devices they find out what vendors support their products and don't ship devices with unfixable backdoors before buying new ones?

> And ISP bills go up to cover the massive security scanning infrastructure > needed?

A bunch of $30 cameras can scan and infect the entire internet, what makes you think the infrastructure needed to find these devices is massive?

ISPs already have everything they need to find out which of their customers are compromised, they just don't give a shit.

</comment></comment></comment><comment><USER25> It's interesting to see the FTC bringing this based on injuries to the consumers themselves. We've previously discussed a regulatory body such as the FCC regulating the externalities of networking bugs. Here, the damages are internal to the consumer. It makes sense the FTC acts here, where individual damages could be very difficult to prove, if even discover. But query whether the potential for a class action suit (and lack thereof) have already suggested the proper result here. While this claim seems well-placed, hopefully, both the FTC and the court weighing the claim will establish a reasonable "foreseeableness" limit to the liability such that potential claims as this don't quell innovation in the space.

<comment><USER26> Case wouldn't get that far. It'll settle before there's any assessment of liability. Probably end with a consent order and a suspended judgment. So basically, they have to submit to compliance audits once a year, and there's an order in place that triggers liability if they violate the same law again. That accomplishes your foreseeable principle.

</comment></comment><comment><USER27> I have a Netgear router. Netgear has end of life'd it and will not provide anymore firmware updates. It has security vulnerabilities. There is DD-WRT firmware available for it. However, Netgear has since modified their firmware to disallow installing DD-WRT.

<comment><USER28> When that happened to my WRT54GS, I managed to downgrade to an older Netgear firmware that did not do this check. Then, from the older firmware, I could flash DD-WRT, no problem.

I now build routers / firewalls with a free OS to ensure I do not get burned again.

</comment></comment><comment><USER29> How about all these smartphones being sold with unsupported broken versions of Android?

<comment><USER30> Mostly not remotely exploitable or not easily, so they can probably get away fine. There's no giant Android botnet eating the internet.

<comment><USER31> That still doesn't excuse it at the least. Forcing manufactures to support security updates on these devices for a reasonable amount of time (no less than 6 years) would greatly slow planned obsolescence and may even force manufactures to actually agree on driver and kernel standards instead of their mess of non-upstreamable garbage patches.

Right now we're lucky to get even 2 years of normal updates (much less security updates) on any Android device.

<comment><USER32> Are the any big vulnerabilities you're thinking of?

</comment></comment></comment></comment><comment><USER33> Anyone know what are the reasonable steps that d-link failed to take?

I see no mention of it in the article.

<comment><USER20> Here are the things the FTC faults D-Link for ([https://www.ftc.gov/news- events/press-releases/2017/01/ftc-c...](https://www.ftc.gov/news-events/press- releases/2017/01/ftc-charges-d-link-put-consumers-privacy-risk-due- inadequate)):

1\. "hard-coded" login credentials integrated into D-Link camera software -- such as the username "guest" and the password "guest" -- that could allow unauthorized access to the cameras' live feed;

2\. a software flaw known as "command injection" that could enable remote attackers to take control of consumers' routers by sending them unauthorized commands over the Internet;

3\. the mishandling of a private key code used to sign into D-Link software, such that it was openly available on a public website for six months; and

4\. leaving users' login credentials for D-Link's mobile app unsecured in clear, readable text on their mobile devices, even though there is free software available to secure the information.

There are pretty common-sense mitigation techniques for all of these.

For 1,

* Don't ship with default credentials (change credentials per-device and slap a sticker on the device with user/pass)

* Force credentials to be changed on first login.

* To avoid attacks targeting specific devices via crafted search engine queries, add a robots.txt and/or use HTTP authentication.

For 2, sanitize user input

For 3, don't publish private keys on your public-facing website

For 4, encrypt stored credentials (or don't store credentials at all)

None of these are particularly difficult to implement. In fact, they're all pre-Freshman-level, obviously boneheaded security mistakes. That we've known about and how to prevent since at least the 90's...

<comment><USER30> Correct me if I'm wrong, but isn't #4 just encouraging security through obscurity? If I hacked someone's phone, I can read those credentials, whether that amounts to reading them off the device, sniffing the connection, injecting code into an app, etc. Not encrypting the credentials on the device is not a security offense as it's not a valid security mechanism. Go ask Mozilla, Google and Microsoft about how well their encrypted credential stores work against freely available NirSoft tools or actual malware like iStealer.

<comment><USER20> _> If I hacked someone's phone, I can read those credentials, whether that amounts to reading them off the device, sniffing the connection, injecting code into an app, etc._

Assuming attacker has root while the customer is logging in. But what if the attacker only has access to the file system (e.g. in the case of a stolen phone, or a broken jail/sandbox)? In that case, requiring a password/PIN to unlock the stored credentials does provide some protection to the user.

Storing passwords in the clear is _always_ a terrible idea. If you _must_ store credentials, at the very least they should be encrypted when at rest, and the system should require a sufficiently strong password/pattern/PIN to unlock the key chain. That way the attacker has to intercept and/or brute force, rather than merely gain access to, the device.

Ultimately, the answer is very simple: _if you can 't store credentials securely, then don't store them at all!_

So you may be correct that DLink should not have stored those credentials _at all_. But just because there's no secure way to implement a convenience feature doesn't mean it's reasonable to go ahead and store passwords in the clear.

<comment><USER34> Is the mobile app storing the credentials so the user can send them to an outside service? If the user checkmarked the box for "save my password", then

>requiring a password/PIN to unlock the stored credentials

defeats the purpose of a feature built to not require a user to remember a password. "Save my password" features are very common. I use that feature of Firefox all the time. I fully understand if someone gets access to my filesystem, then they get my passwords. (And they also get all the other important stuff on my filesystem like my photos and documents.)

<comment><USER20> _> defeats the purpose of a feature built to not require a user to remember a password_

And yet millions of people use password-protected password managers.

Including FireFox, which DOES encrypt your passwords, and which DOES allow you to optionally set a master password. And if you do set that password, it DOES use that password as an encryption key. And in that case, if someone gets physical access to your device, they'll need to install a keylogger or brute force your master password. Which requires a lot more effort than simply copying a file, providing more opportunities for the attacker to fail, for you to detect the attack, or for investigators to track the source of the attack.

And no, that won't save you if there's a critical security bug in your OS's kernel. Which there probably is. But that doesn't mean you give up on a sensible and easy to implement security policy.

The calculus is very clear here -- encrypting the passwords costs the developer and the user almost nothing (maybe 10 minutes to 2 hours of time for a competent developer; maybe a penny or two of electricity across the lifetime of the device). And there is a definite benefit to the overall security of the system -- the attacker needs to clear one more hurdle to get device passwords, and security-sensitive consumers can make that hurdle a rather large one (rooting the device and installing a keylogger).

No, it's not a silver bullet.

Yes, it is strictly more secure that the alternative.

<comment><USER30> > they'll need to install a keylogger or brute force your master password

Not true, they can simply dump the RAM on your browser while your passwords are decrypted, which is probably the case when you run their malware anyways. It's a completely pointless half measure to encrypt those passwords. Worst case they have to patch it or hook it with something like Frida to do it next launch cycle. Keyloggers just ain't targetted and automated enough for me at least, but it's fairly trivial to just grab what you need from memory and run.

In fact according to this bug, the master password is stored in cleartext in RAM when your firefox is logged in so a simple string search on a memory dump could potentially do the job for someone without even the smallest RE capability:

[https://bugzilla.mozilla.org/show_bug.cgi?id=539608](https://bugzilla.mozilla.org/show_bug.cgi?id=539608)

If you have the RE capability to do one, it's not really any more than is required to do the other. It's not another hurdle. Just doing it at runtime instead of purely on disk.

<comment><USER20> _> If you have the RE capability to do one, it's not really any more than is required to do the other. It's not another hurdle. Just doing it at runtime instead of purely on disk._

Phones/laptops are stolen. When they're stolen, they're turned off -- often by yanking a battery -- to prevent lockout/wipe/locating features. That wipes RAM. And after they're stolen, they're rarely returned for use.

Also, file system access doesn't imply access to a RAM dump. Especially on Android/iOS. And on a server, there are whole classes of vulnerabilities that provide RO access to certain files but can't be trivially exploited to provide access to a RAM dump.

So on many relevant platforms, I don't think it's true that access to portion of file system == access to RAM dump for particular process.

I agree that nearly all password storage mechanisms have serious problems, and that storing passwords is not ideal. However, if you're going to do it, then encrypting at rest is one small, extremely cheap security mechanism that _does_ prevent out certain attacks.

I think maybe you're arguing that we shouldn't store passwords in app-specific password managers _at all_ , which I don't necessarily disagree with. But I do disagree that encrypting at rest is "not another hurdle". For many attack profiles, it is.

<comment><USER30> > does prevent out certain attacks.

No, it doesn't. If I have filesystem access in the sense you're talking I can just replace the application's executable with a malicious or modified one for example, which will allow me to steal your password still.

Correct me if I'm wrong here and there is some exploit class which might allow reading of but not writing to private application data and executables? I certainly haven't seen one and this would be the only scenario in which what you're saying has an impact.

As for the theft scenario - you could just as easily prevent the theft risk by setting a password on your device which would protect it at the platform level - where it should be. It'd also prevent other private data leaks which I'd say are higher risk than your router password which is useful only on your internal network, like your SMS messages, email accounts, authenticator tokens, etc. None of which I might add ask for passwords, dumping Google Authenticator tokens is as simple as running a SELECT on the sqlite database, they're not encrypted at all.

</comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER35> Although we should emphasize securing consumer devices by default I don't see any other way to motivate companies to secure devices having either the FTC or a class action lawsuit to implement security.

</comment><comment><USER36> Any tips on how to find out which cameras are actually secure?

</comment><comment><USER37> This is an unfair lawsuit targeting a foreign corporation. If the FTC were consistent, they'd go after a majority of American tech companies (Cisco, juniper, MSFT..) with publicly known back doors into their technology.

<comment><USER31> Cisco seems pretty good about patching. There have been some controversial cases, but typically when I see Cisco exploits at a conference, it will start with, "If you haven't patched your routers to xx.xx.xx, do it now."

Do you have specific examples of holes that have existed for a long time without official patches or mitigation?

<comment><USER37> Flip this around. If Chinese regulators sued Cisco, Juniper, etc. for known vulnerabilities while deliberately omitting local companies, everyone would scream protectionism.

Router companies need to be security conscious, but for the FTC to single out ONE foreign company doesn't smell right.</comment></comment></comment>


Ask HN: Do you have Covid-19? - <AUTHOR> I'm just curious to hear from people who have been confirmed to have Covid-19, and what is has been like for you personally (e.g. your symptoms, family, etc.) <comment><USER2> No, nor do I know anyone who does, however, I do have a few friends who are nurses in the New York / New Jersey area who are quite busy. I can't say if they have come into contact with anyone directly, but it seems like they likely would.

I have also been taking strict measures myself, having only gone out about 3-4 times in the past 3 months and covered my mouth with a cloth-like mask to cover my respiratory holes. Once I return home, I immediately wash my hands. Then I proceed to put the groceries away. And then I re-wash my hands. I've never touched door hands and always have used my shirt. So the two missing items not wiped down are: car door handle and steering wheel. Make sure you get those!

As I've heard, the way most people are being infected is mainly through family and touching their face. The virus just needs to get close enough to get sucked into a nostril. So making yourself aware, with your mask on, is a good way to not touch your face in public.

When you arrive home, as long as you wash your hands for 20 seconds -- feel the oil of the soap on you hands, once you feel that lube, you can rinse off, and touch your face all you want, as long as you don't start touching items from outside the home that you brought in indiscriminately and touch your face. If done by accident, likely not a big deal.

I also know a great deal of people who are NOT doing very well mentally in self-quarantine isolation.

<comment><USER3> "I've never touched door hands and always have used my shirt. "

I haven't been able to find any data showing how long Sars-CoV-2 can live on fabric but that could be one vector of potential infection, though it is probably incredibly unlikely.

<comment><USER2> Definitely have to make it a habit not to wipe your face with places you used to open the door, which is why you scratch your face -- if you can't wash your hands -- with the inside of your shirt.

</comment></comment></comment><comment><USER4> [https://www.reddit.com/r/COVID19positive/](https://www.reddit.com/r/COVID19positive/)

The above subreddit has lot of posts from people with Covid19 all over the world

<comment><USER5> I think these kinds of subreddits show the power of reddit. I don't know anywhere else a very specific community like this could get traction so fast.

</comment></comment><comment><USER6> I was inspired by this post to set up a HN poll, someone who knows how polls work may do a better one.

</comment><comment><USER7> no but i know 3 people that have it (friends, and parents of friends)</comment>


Ask HN: Plans for/existing Stackoverflow-style sites with a different focus? - <AUTHOR>

I'm yearning for a Stackoverflow-style community for the sciences. That'd be sweet. Does anyone know of such a site? Or maybe one in development (as I'd sure like to get involved)?<p>Thanks! <comment><USER2> <http://area51.stackexchange.com/> lists a few science related sites in beta, and a few more close to being released.

</comment><comment><USER3> Quora has a lot of science questions/answers. Quora itself is not focused on a topic.

<comment><AUTHOR> Cheers for the tips, guys. However, I was slightly put off joining Quora by the following in their privacy policy:

"Quora may share your personally identifiable information with third parties for the purpose of providing the Service to you. If we do this, such third parties' use of your information will be bound by this Privacy Policy. We may store personal information in locations outside the direct control of Quora (for instance, on servers or databases co-located with hosting providers).

As we develop our business, we may buy or sell assets or business offerings. Customer, email, and visitor information is generally one of the transferred business assets in these types of transactions. We may also transfer or assign such information in the course of corporate divestitures, mergers, or dissolution."

<comment><USER3> I would be hard pressed to find a site that required serious development effort and did not collect and sell your information.

In this case though, they're mainly collecting your interests, subjects you follow, answers on subjects, how others rated those answers, and your questions. Not exactly private stuff unless you're interested in crazy subjects.

They also have an anonymous option, where you can answer anonymously. I'm not sure how that will be sold, Quora still knows who you are, answered as anonymous vs not would be useful information.</comment></comment></comment>


Facebook Will Deliver Internet Via Drones With "Connectivity Lab" Project - <AUTHOR> http://techcrunch.com/2014/03/27/facebook-drones/

<comment><USER2> Free Space Optics will be used for the backhaul to the internet. What will the connection to the subscribers be? Wifi, 3G/4G, there are range limitations to both that will make communications from high altitude difficult.</comment>