U.S. Government Can't Get Rid of Kaspersky Labs Software - <AUTHOR> https://www.thedailybeast.com/exclusive-us-government-cant-get-controversial-kaspersky-lab-software-off-its-networks <comment><USER2> On the contrary, as an American not involved in government work, Kaspersky is one few AV products I'd trust. American antivirus makers like Symantec, Comodo, McAfee, Microsoft (Defender), Webroot, and CheckPoint are all subject to secret warrants and infiltration by the US government. Others, like the UK's Sophos, would be subject to US influence as well.

You have to think about the motivations of each country. Even if Kaspersky were spying for the Russians, they won't give a damn about your porn, tax cheating, affairs, your padding of expense reports, or whatever they find on your computer. As an American, it's MY government that I'd have to worry about.

<comment><USER3> "Even if Kaspersky were spying for the Russians, they won't give a damn about your porn, tax cheating, affairs, your padding of expense reports, or whatever they find on your computer"

How can you be so sure about that? You never know what they would need from you. You write on HackerNews - you are probably a computer professional, maybe an admin somewhere, but maybe you just know someone and you'd be useful to put pressure on that person? Think about the Swiss banker from the Snowden leak:

""" The Guardian said Snowden described a "formative" incident in which he claimed CIA operatives were attempting to recruit a Swiss banker to obtain secret banking information.

The operatives purposely got the banker drunk and encouraged him to drive home in his car, he told the newspaper.

When the banker was arrested for drunk driving, an undercover agent offered to help "and a bond was formed that led to successful recruitment". """

The American agencies don't need to blackmail you - they can get access in many other ways.

<comment><USER4> True, there is that danger. However I have to trust somebody - I don't write anti-virus software. I suppose I could, but it takes time to get expertise in that, time that I wouldn't get to spend with my kids. Not to mention working alone I couldn't fight all the attacks on my computer in a timely manor without help, and thus I still have to depend on other people who might or might not be trustworthy.

<comment><USER5> You could use a platform that doesn't require anti-virus.

<comment><USER6> Platforms don't require AV software: people do. A security-minded user could live in Windows and never catch a virus. On the other hand, I've seen careless individuals become infected with the worst malware by downloading the wrong thing to their Mac.

<comment><USER7> By choosing Apple or Microsoft products, you are still going with a company under US jurisdiction, which is silly if you wanted to avoid US AV companies for that reason.

<comment><USER6> Oh, certainly! I'd even go as far as call irresponsible the use of any closed source software in situations that call for tight security. In this sense, choosing Mac, Windows or PutinOS (oh, how I wish such a thing existed!) carries exactly identical consequences.

<comment><USER7> > PutinOS

It's like Red Star OS, except it uses you!

<comment><USER8> Virus protection for the masses.

</comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER9> I'm rather surprised the United States government would be using foreign software for information security. Really, I'm surprised that they're using outside software for it at all. As much as I'm a fan of the free market, that isn't the sort of thing I'd trust to an outside company.

If only there was some sort of group in the government that handled information security... Some sort of security agency, if you will.

<comment><USER10> It's not that surprising. Typically when you work with Governments, everything is specially done, doubly so for the US Government. Custom Federal forks of the main product (with feature parity), heavily customized SLAs, full access to the source code for review, and lots more to ensure that it meets the US Federal standards.

The Anti-Kaspersky stuff is likely just chest beating. I get it at the base level, and that AV software in general grants a much deeper reach that most softwares, but most likely they're not installing the same Kaspersky that anyone else is.

My current employer is a rather large non-US tech company, and we have custom branches for every product specifically made for the US Federal Government. It's all rebuilt from the ground up on US soil by US Nationals and the US Government has freedom to review the code.

It's the price you pay to play with the US Government. I would find it very hard to believe that Kaspersky doesn't have something similar.

<comment><USER11> For the vast majority of COTS software the US Government uses the same software versions as everyone else. This holds true for anti-virus software.

</comment></comment></comment><comment><USER12> This should be fairly alarming to all parties, not the least of which being the government.

I mean, let's just hypothetically assume for a moment that Kaspersky _is_ compromised and doing intel gathering for the Russian government. Can you think of a more perfect weapon than a compromised suite of software that is so deeply entrenched in a nation state's stack that they can't remove it, even if they wanted to?

</comment><comment><USER13> Kaspersky AV is an excellent product. For years it was the unrivaled market leader for non-signature-based malware detection in Windows operating systems. Its competitors are closing the gap, however. Qihoo 360 is also a good product.

Among the reverse engineering / exploit development crowd, I haven't heard much complaining about Symantec's detection mechanisms.

There are also bespoke anti-malware solutions marketed to the U.S. government, and they are not commercially available specifically to mitigate the risk that malware authors will test their products against anti-malware engines. These bespoke solutions are understandably far more expensive due to their smaller deployment and high quality.

It's reasonable that the U.S. government has to consider the need to have the best, reasonably affordable, commercially-available solution for the majority of its systems. This is balanced by the threat that the Russian Federation's government could interdict the software being delivered to the U.S. government client. Intermediate solutions, such as the project that Huawei set up with the UK government, or the source-code sharing that Microsoft does to get Russian contracts, seem to be optimal.

</comment><comment><USER14> ClamAV is ripe for creating a FOSS disruption in this arena. If I were in a position of governmental power I would be pushing for foss solutions instead of proprietary black boxes that can't be audited.

<comment><USER15> Security today is very much about blind trust, certifications and not paying too much attention to the man behind the curtain. If your security software is open source anyone can point out its weaknesses.

<comment><USER16> Even then we still have the issue of binary blobs of firmware. Also hardware it's self may be exploitable. For a truly secure system everything would have to be audit-able. Also as soon as you run or insert anything into system you did not audit that whole system might as be treated as un-audited as well. Since what ever that was may have modified firmware or software.

That also exclude any subtle bugs that people may miss.

</comment></comment></comment><comment><USER17> FWIW, the anti-Kaspersky train has been rolling for over three years.

Since the time that Kaspersky revealed (after Symantec) global co-ordinated state sponsored malware programs such as Reign, created by the NSA and GCHQ. [https://www.theregister.co.uk/2014/12/05/regin_kaspersky/](https://www.theregister.co.uk/2014/12/05/regin_kaspersky/) [https://en.wikipedia.org/wiki/Regin_(malware)](https://en.wikipedia.org/wiki/Regin_\(malware\))

Or the time that Kaspersky publicly humiliated the NSA by revealing their hacking of hard drive firmware. [https://www.dailykos.com/stories/2015/2/17/1364910/-Breaking...](https://www.dailykos.com/stories/2015/2/17/1364910/-Breaking- Kaspersky-Exposes-NSA-s-Worldwide-Backdoor-Hacking-of-Virtually-All-Hard- Drive-Firmware) [https://www.scmagazineuk.com/is-nsa-worlds-most-advanced- thr...](https://www.scmagazineuk.com/is-nsa-worlds-most-advanced-threat-actor- revealed-by-kaspersky/article/537596/)

Since then, congressional hearings, committees, and US intel agencies' warnings of "security threats" from Kaspersky had been rolling out with regular frequency. Last year's ban was just a culmination of other efforts already underway.

Kaspersky's role of tracking nation-state malware inflitrations gives them a position as a quasi-intelligence agency. US intelligence agencies hate Kaspersky because they out every program the US has going on, and because they operate out of Moscow.

Literally every US intelligence agency has testified before Congress about how they specifically don't trust Kaspersky. [https://www.npr.org/sections/parallels/2017/07/05/535651597/...](https://www.npr.org/sections/parallels/2017/07/05/535651597/congress- casts-a-suspicious-eye-on-russias-kaspersky-lab) So the US and its allies infiltrated their network and reverse engineered its software in order to find whatever dirt they could. [https://www.observeit.com/blog/kaspersky-lab- nation-state-at...](https://www.observeit.com/blog/kaspersky-lab-nation-state- attack/) [https://theintercept.com/2015/06/22/nsa-gchq-targeted- kasper...](https://theintercept.com/2015/06/22/nsa-gchq-targeted-kaspersky/)

The information they have on global intelligence operations, their location outside of an ally's control, their insistence on embarrassing nation states' covert operations and exploits, and the fact that their software isn't the most secure ([https://www.forbes.com/sites/thomasbrewster/2015/09/23/googl...](https://www.forbes.com/sites/thomasbrewster/2015/09/23/google- ormandy-finds-kaspersky-0days/#2263a6b65493)) has given the US government enough reason to want them out of their infrastructure. It's just politically untenable.

<comment><USER13> * > Basically, Kaspersky's role of tracking nation-state malware inflitrations gives them a position as a quasi-intelligence agency. The US government didn't like that, because they constantly out the various programs going on, and because they operate out of Moscow. So the US and/or its allies infiltrated their network and reverse engineered its software in order to find whatever dirt they could. [https://www.observeit.com/blog/kaspersky-lab-nation-state-at...](https://www.observeit.com/blog/kaspersky-lab-nation-state-attack/) [https://theintercept.com/2015/06/22/nsa-gchq-targeted-kasper...](https://theintercept.com/2015/06/22/nsa-gchq-targeted-kaspersky/*)

Is revenge the only motive to do this, if indeed it was the NSA (it's likely it is)? Wasn't there an allegation that Kaspersky software had exfiltrated NSA employees' and contractors inappropriately-stored classified material? Or wouldn't it makes sense for the NSA, an intelligence agency, to spy on a foreign company with good access to information about foreign officials?

<comment><USER17> Kaspersky didn't exfiltrate anything. An NSA contractor brought home classified files and put them on a machine on the internet that had Kaspersky AV. The AV tagged the files as malware and uploaded it to Kaspersky's servers to be analyzed. It's another ridiculous screw-up by the NSA that they had to cover for. [https://www.nbcnews.com/news/investigations/russian- hackers-...](https://www.nbcnews.com/news/investigations/russian-hackers- stole-nsa-tools-contractor-who-used-kaspersky-software-n808101) Quote:

      "Not only is the work of the NSA and CIA increasingly visible, there is
      a certain aggression implied by this," he said. "It's a 'game-on' moment."

      Kaspersky, he said, should be treated as a hostile actor.

Israel was inside Kaspersky's network, found the Russians looking for US files (or so they claim) which had been just hanging around on their servers for a year, and so they notified the NSA about the breach. [https://www.nytimes.com/2017/10/10/technology/kaspersky- lab-...](https://www.nytimes.com/2017/10/10/technology/kaspersky-lab-israel- russia-hacking.html)

I don't believe any agency operates based on revenge. They operate based on politics. Can they really continue to fund this organization that is constantly pulling their pants down? Kaspersky's biggest flaw here is just having shit security.

<comment><USER13> Considering that non-malware related documents were reportedly taken, you're not telling the full story.

You make some good points.

That said, the politics of the NSA and the politics of Congress are often quite orthogonal and shouldn't be equated.

<comment><USER18> From the article:

" _However, the anti-Kaspersky train picked up steam following revelations last year of a bizarre incident in which the company slurped up classified documents and source code from the home computer of a National Security Agency contractor running Kaspersky Internet Security software. That contractor, Nghia Hoang Pho, pleaded guilty last year to willfully mishandling classified material by taking it home._

" _Kaspersky claimed the incident was an unintended byproduct of its routine malware scanning. The source code was for an NSA hacking tool, which Kaspersky's product properly flagged for analysis by malware researchers. But because the code was bundled in a ZIP archive with the classified documents, Kaspersky's software uploaded the entire thing. When Eugene Kaspersky realized what had happened, he ordered his researchers to immediately delete their copy of the documents and code, the company asserted in a blog post last year. "The archive was not shared with any third parties," the company wrote._ "

Presumably, it was an _isolated incident_ and we can _trust Kaspersky 's statement_ about their actions. No?

</comment></comment></comment></comment></comment><comment><USER19> The U.S. Government doesn't want us using Kaspersky because Kaspersky blows the whistle on the back doors the gov't has installed in various software.

</comment><comment><USER20> > Congress didn't give anyone money to replace these devices,

Seems more like the U.S. Government doesn't _want_ to get rid of Kaspersky. They choose not to replace compromised devices. Doesn't seem like it is a hard technical challenge at all, rather the lack of action seems more intentional.

Surely we can all agree this is an issue of National Security. And if the task is to be done with no Federal assistance or financial help whatsoever, it seems clear that the government is compromised.

<comment><USER9> This seems more like a Pointy-Haired Boss-type move to me. Bosses in actual IT businesses often don't understand what's involved with a large IT project; what hope does a 79-year-old senator have of understanding what removing Kaspersky software from the entirety of the United States government's systems would take?

<comment><USER21> They don't. But starting Monday, we'll find out.</comment></comment></comment>


The Ultimate Amiga 500 Talk [video] - <AUTHOR> https://media.ccc.de/v/32c3-7468-the_ultimate_amiga_500_talk#video&t=70 <comment><USER2> I was actually going through a list last night of Amiga/Atari games. Lots of memories.. Beverly Hills Cop, Barbarian, Commando, Leisure Suit Larry etc.

Did any of these game developers make money from the games? All I can remember was borrowing floppy disks from friends or downloading from BBS, we barely had places that sold games in Sweden.

<comment><USER3> Check out the documentary From Bedrooms To Billions - it goes into good detail about the early home computer game development scene, well worth a watch.

<comment><USER2> Will check that out!

</comment></comment></comment><comment><USER4> I like how the "anomalies" of different chips in Amiga 500 are put together into a rigid intertwined system.

<comment><USER5> You mean the odd/even bus access solution?

It's far older than the Amiga, the C64 used it, and I suppose Atari 8-bit and Apple I/II did too.

</comment></comment><comment><USER6> Interesting to hear about the chip ram such, as i had heard the terms but never really looked into their meaning.

I guess that this setup was both the initial strength, and the Achilles heel of the Amiga vs the PC.

This in that they lived on the motherboard, in close synchronization with the CPU, and thus was not upgradeable without getting a whole new computer.

This unlike the PC where the video and audio stuff lived on expansion cards on the ISA bus.

Thus as time went on the PC gained richer audio and video, and later 3D accelerators/GPUs, without tossing the whole PC.</comment>


Blog reading becomes a habit, study says - <AUTHOR> http://www.cbc.ca/technology/story/2008/04/09/blog-readers.html?ref=rss <comment><USER2> magazine column reading becomes a habit, study finds.

I'm sick of everything on the internet being treated as if it were brand fucking new.</comment>


Ask HN: How best can we market our new social sports game? - <AUTHOR>

We're just two guys who spent a few months building a casual football strategy game.  It's sort of a cross between Tecmo Bowl, Fantasy Football and Poker.  We just launched it, and we're having a hard time getting anyone to notice it.  We think it's innovative and fun, and we'd love to get some good feedback, but so far it's been hard to find users.
Anyone have any suggestions on how to market sports strategy games?
If anyone here is into football, we'd love to get your feedback.  The game is at http://www.ffthrowdown.com/. <comment><USER2> The tutorial is pretty killer but afterwards when I go to play I just feel plopped into nothingness. Do I have a team? Is the game played in realtime or slowly turn based? There are still a lot of unanswered questions.

More importantly, where is the viral loop? I would expect after the tutorial to arrive at a point where I have $x000 and I can build my team. Oh, and for each of my friends that I invite into the game, I get $x00. And a zillion other hooks like that.

</comment><comment><AUTHOR> Thanks for the feedback. We've done a lot more to make it clear what to do after completing the tutorial. To answer your question, you can play both in real-time or turn-based-over-email or a combination of both. Hopefully the messaging makes that more clear now.

Also working hard on the viral loop. It's slowly coming together.

</comment><comment><AUTHOR> Clickable link in case anyone wants to check it out: <http://www.ffthrowdown.com/></comment>


Ask HN: How do you manage large files across multiple laptops/desktops? - <AUTHOR> My wife is a graphic designer and works on both a Mac desktop and laptop. The assets she generates for a single project can reach into gigabyte territory – multiple versions of a set of print layouts, RAW photos, etc. One problem she has is how to reliably sync large files between computers. She uses Dropbox currently, but sync over network can takes a long time or sometimes just doesn't finish depending on the file. And when she runs into space limits on one computer, she'll need to adjust Dropbox settings to selectively sync items.
I'm curious what people do in this case. I think she needs:
1) A large amount of storage, expandable as time goes on 2) Files accessible from multiple computers 3) Ability to access files securely when working from a coffee shop, traveling, etc. <comment><USER2> Have you looked into Nextcloud?

If you primarily do it at home, the speeds of Nextxloud are typically limited by the network bandwidth, and the storage is limited by what server you have. I use it and manage 5 TB of data on it without problems.

<comment><USER3> I am using Nextcloud for precisely thw usecase OP outlined and I am quite pleased with it I must say.

<comment><USER4> NextCloud is decent but not technically polished enough. Web UI is not performant, not too user friendly and mobile apps aren't really that good. I do have 4 instances running but I'll welcome alternatives if I find one.

<comment><USER2> Heh, I would say the Web UI works extremely well and is very friendly, and I really like the Android App. What issues do you have with it?

<comment><USER4> Here are my gripes.

\- Pages load pretty slow over mobile networks. Every app page requires like 5 seconds to load, as it loads the page in 2 steps, first the page and then then the content. Not talking about navigating folders in Files but apps like Calendar and News are especially slow.

\- Bookmarks app silently stopped working few weeks ago when I thought I kept adding Bookmarks through Android mobile app, so I lost 2 weeks worth of them. Not sure if the server or the client app went wrong but I switched to Pocket even though I run everything self hosted where I can.

\- Contacts app previously had a problem where you couldn't save more than one information per page reload until recently when used through CloudFlare which was very confusing to see some saved data disappear.

\- News app's UI is a bit of a joke in terms of speed and usability, so you need a mobile app to consume it than from the web.

\- Frankly all of the apps need mobile apps because pages load slow and it's reluctant to go through them from the web but the mobile app quality varies so much as they're all dependant on third party developers.

\- NextCloud talk, I had a high expectation of it but no matter how I tried, it never worked reliably and client apps were nowhere near the quality to recommend to non tech work people.

\- Using an external storage for Files makes the performance and reliability quite low and when you think about using it for work, you need maximum reliability but I ended up using local storage as that seems the only way that's tested enough.

\- You can't tell how much of a file is uploaded reliably at all. The "seconds remaining" display jumps all over every second as it's probably calculating from the speed of the moment instead of averages of the last minute or something and you can't cancel the individual files queue.

\- I have basic auth on the NextCloud instance but the official NextCloud app refuses to work through it, even though the web version allows you to have yourself logged in via basic auth.

\- Email app acted like an alpha version, so I instead use integrated RainLoop which is fine but I couldn't get people to login automatically using the NextCloud logged in user even though I have that option turned on, instead I had to edit some source code to make it happen.

\- Logging out takes forever.

I am impressed that the look and feel is good and the caldav being so easy to use but I'd say it's close when it comes to overall quality to have work people use it than just for yourself.

</comment></comment></comment></comment></comment><comment><USER5> There are already a lot of suggestions to use an externally attached storage (or "sneakernet"). I think it's the simplest solution with best performance. I dual-boot off an EVO SSD in an external thunderport/USB-C enclosure, and performance is similar to the built-in HD. The enclosure is the size of a pack of gum. Make sure the USB-C to USB-C cable is actually USB 3.0 certified.

She should also verify her Time Machine configurations on both Macs are set up to back up her sneakernet drive fairly frequently. ... You only seem to need backups when you don't have them...

</comment><comment><USER6> Something that isn't uncommon in some shops is using a big system/VM where the person does their work and just remotes into it from their mobile system as needed, so the file only actually is in one place.

Of course, it only works if you're online, and VDI-ish solutions aren't really a thing on OS X, so YMMV, but I remote into my desktop while I'm at school because my laptop doesn't have much ram.

</comment><comment><USER7> One thing Dropbox does well is transparently resuming a stalled or failed sync. The other solutions I can think of are more manual or the UX is very basic or obtuse. You could set up your own storage space on AWS and rsync (which has GUI tools available), but that's essentially roll-your-own Dropbox.

I work on large video files that I transport between locations and had an external drive that I used for a while but would end up forgetting or not wanting to unplug everything. I have settled on a high speed 64gb SD card that fits in any pocket or even my wallet. Out of all the fancy network tools I set up, this option has proved to be the most enduring.

Doesn't help with synchronizing which files are most current though. You might look at Transmit 5 from Panic. It has lots of useful syncing features now.

</comment><comment><USER8> I use an external USB drive. You can get anywhere from the standard thumb drives, up to multi-terabyte larger drives. So when travelling I just take whichever drive I need and whichever laptop I need, and plug them together.

It isn't exactly syncing, but it solves the problem, at least for me.

</comment><comment><USER9> If they're reliably on the same network, then I'd probably use syncthing. Or, a NAS device and mount the volume across the LAN. Or rsync or syncthing to the NAS.

If you have to share files off the LAN, that gets more involved.

We currently use a mix of syncthing and NAS for our internal purposes, and iCloud for external syncing.

</comment><comment><USER10> Use rsync to make one folder structure match another by copying only the changed parts of files. You can sync many gigabytes VERY quickly this way.

You'll want to have an external USB3.0 drive to get from one machine to another IMO, because you would have wanted it backed up ANYWAY right? ...so there's no need to try to copy directly from one machine to another machine, without using the USB drive.

Here's an example command:

sudo rsync -aAXv --delete --force "/home/clay/ferguson/" "/media/clay/BAK/ferguson"

<comment><USER4> I'd hate to recommend a command line to a designer.

<comment><USER10> It really seems like there should be some kind of "SyncGUI" app built into Linux that does this sync with a nice GUI, and maybe there is one, I've never looked that up...

because all it needs to do is prompt for source and destination folders, with a stern warning about what it DOES. ha.

</comment></comment></comment><comment><USER11> Buy a large SSD like 2-8TB (just avoid the Samsung 860 QVO 4TB, it sucks more power during write than USB A standard allows) and buy a nice case like [https://www.amazon.com/dp/B07D2BHVBD](https://www.amazon.com/dp/B07D2BHVBD) and mount it there. Work from the external SSD, it's fast enough in my opinion. Use the cloud only for backup purposes whenever the drive is attached (I use Insync for that but this is Google Drive centric).

<comment><USER12> A Mac Mini expanded with two SSDs with syncthing is superior to sneakernet because it provides replication. And, if you really want to, add a 14 TiB HC520 placed in an external USB 3 case.

Add an rsync server to get backup. Forget the cloud, most solutions are overpriced and insecure. Use TarSnap if you have absolute have to backup reasonable quantities of critical data and call it a day.

</comment></comment><comment><USER13> Second the use of high speed SSD or SD Card, at night just make sure it backs up to the cloud just in case you lose it.

</comment><comment><USER14> If just a 2 terabyte cloud service faster than Dropbox would be enough, pCloud is nice.

</comment><comment><USER12> Try them all and then pick one (or two):

\- SpiderOak One

\- Mega (very cheap)

\- Syncthing (open source)

</comment><comment><USER15> icloud, otherwise external storage</comment>


British scientists pave way for simple pill to cure Alzheimer's - <AUTHOR> http://www.independent.co.uk/news/uk/home-news/alzheimers-treatment-breakthrough-british-scientists-pave-way-for-simple-pill-to-cure-disease-8869716.html <comment><USER2> The article is scarcely worth glancing at. It has all the deplorable elements in popular science journalism -- a total misreading of the research, a conclusion completely unsupported by the original work, and employment of every stock science journalism cliche including the perennial favorite: "breakthrough".

One barely begins reading when they get to "UK researchers discover how to halt death of brain cells". That's not a cure -- if true it can only prevent further damage, and the person's faculties won't improve, they just won't degrade further.

Also, the model is laboratory animals with prion disease. A prion is a tiny organism, smaller than a virus, but that can replicate. Alzheimer's is not a prion disease, so the model is questionable.

Finally, the title of this submission is not the title of the article, which only adds to the confusion.</comment>


Xmas Game built using JavaScript - <AUTHOR> http://inlight.com.au

<comment><USER2> Works in Chrome, but can you get it to work in IE?

<comment><AUTHOR> Yeah - unfortunately I ran out of spare time to do more thorough cross browser compatibility testing, but decided to deploy it as it was so people could play it before Xmas comes and goes.</comment></comment>


A dialogue between two aliens discussing the human race - <AUTHOR> http://mathoda.com/archives/584 <comment><USER2> "History Lesson" by Arthur C. Clarke (<http://web.math.hr/~veky/T/T1/historylesson.txt>)

</comment><comment><USER3> We found a new world in the forest and we killed every creature in the wild for food or amusement.

Then we found new species in the air, and we killed every one of them for food or amusement too.

Then we went underwater, and yes, we did that again, for food and amusement.

Then we looked up to the stars...

</comment><comment><USER4> "Om nom nom."

"Crunchy, aren't they."</comment>


On Game Development - <AUTHOR> https://akbiggs.silvrback.com/on-game-development <comment><USER2> I made games for 30+ years and I had this exact question about year 4. I was sitting at home, writing some 6502 I think, and my cousin called. She had to call to tell me about a Commodore 64 game she bought from FisherPrice. She started to describe it to me, an educational game where you controlled a penguin who dropped letters down a chute to form words. I had to interrupt her to explain, I had written that game.

She had no idea I was the author and designer.

She spent the next 45 minutes telling me how it was the only game she and her daughter played together. She told me that her daughter was motivated to read, and became an avid reader, after playing my game.

I never felt more rewarded, or that I was doing the right thing with my life so mach as during that conversation.

Somehow I think it fair to add that the last game I was the producer for, involved pushing over a port-o-potty, putting wheels on it and then pushing it down a hill and off a cliff to see how far it would go. Don't laugh, Potty Racers went to #1 in the App Store...

<comment><USER3> On the flipside: I once worked for a major games vendor (won't say who) and had this terrible experience - worked 60hour-weeks 5 in a row, to get the online multiplayer backend running and able to support more than a few hundred users. Got it up, deployed, rolled out, in use.

Come in the next day, the CEO and all the head devs are crowed around the server console, watching the stats after release, this conversation happens, verbatim (I still remember every detail):

        CEO: "Time for my favourite question - How long has the longest
        player online been playing?"
        HeadDev: "Lets see .. 12 hours since we launched, longest active
        session is .. 11 hours, 45 minutes.  No pause."
        CEO: "HOORAY!!  CELEBRATION!  WE GOT OUR FIRST ADDICT!!!!"
        HeadDev: "Yay!"
        CEO: "Wait .. how old is he.. ?"
        HeadDev: "Profile says: 12"
        CEO: "YAY, he'll be with us for years!"
        Me: "Isn't that a bit .. unhealthy .. for a 12 year old?  Its summer,
        schools out, the kid should be .. enjoying some weather?"
        CEO: "We don't like that thinking here .. are you sure you
        know who you work for?"

Oh well, that killed the games industry for me, well and good. Haven't logged on to a multiplayer game in 12 years.

TL;DR: The people behind the curtain do _not_ have your best interests in minds, kidz ..

<comment><USER4> Which geek did not play for 12 hours one day?

<comment><USER3> Those who had and did their homework, or wrote code, or tried to do something with computers other than just waste time.

Lots of geeks don't play games.

<comment><USER4> I managed to do both :). My statement was a generalization, but I had seen more gamer programmers than not.

<comment><USER3> Ah, I'm with you anyway, I did indeed spend hours and hours and hours, at one point in my life, gaming away .. for me it was Descent2 and Warcraft2, the good ol' 90's, and well .. it didn't last long. I realized I was better off writing code than running someone elses. ;)

</comment></comment></comment></comment></comment></comment><comment><USER5> Don't forget the stress relief video games can give. Society managed to make even sheltered 1st world lives stressful thanks to unrealistic expectations imposed on a personal and professional level. We're all apes though, despite all that's expected of us. And these apes love to wonder about their world and explore its every corner. Video games satiate this desire somewhat - and that will do, on a fucking Monday night after a long, frustrating day at work.

<comment><USER6> Also [http://www.childsplaycharity.org/](http://www.childsplaycharity.org/)

<comment><USER7> almost time for desertbus again. hilarious way to support childs play: desertbus.org

</comment></comment></comment><comment><USER8> Jonathan Blow (Braid and Indie Fund) recently gave an amazing presentation on the evolution of Television, and he made an interesting parallel to the evolution of games: [http://www.youtube.com/watch?feature=player_embedded&v=AxFzf...](http://www.youtube.com/watch?feature=player_embedded&v=AxFzf6yIfcc)

<comment><USER9> Jonathan Blow is one of my favorite game developers of recent times. Not only is he brilliant technically, he's also an amazing game academic (there are plenty of people on either side, but few manage to be both). The whole of his lectures, talks and writings are heavily recommended!

<comment><USER10> If you liked Jonathan Blow's lectures make sure to check out Chris Crawford's. A number of them are on his channel on YouTube. Crawford was more or less the first game developer to combine practical work with academic study of game design (and he's wrote the first-ever book on it). Your might know him as the developer of Balance of the Planet and the founder of the GDC; the latter he then left after the famous "Dragon speech", which is probably the first thing of his you should look up.

<comment><USER9> Oh yes, I absolutely love Chris Crawford's work as well- thank you!

An up and coming dev I really like is Andy Hull (from the Spelunky remake fame). He gave an amazing talk at GDC about drawing inspiration from children's toys in game design, and I see much promise in him. :)

</comment></comment></comment></comment><comment><USER11> I used to make MMOs and we'd often question why we were doing it when we'd read stories about people's relationships falling apart, kids flunking out of school, or other really negative things that happened when people played too much and didn't keep a handle on their life.

Then one day we got a letter. It was from a man who suffered a host of physical ailments, including quadriplegia, and could barely leave his bed, nevermind his house. In his letter, he wanted to thank us for making our game. He made friends, lead a successful guild, and could feel powerful and accomplishment in a way he couldn't in real life.

The stories would repeat themselves over the years, too... I know at least one very successful HN denizen met his now-wife in our game. Families would stay in touch and play together, groups of people who didn't know each other would raise money to help guildmates who needed surgery or had fallen on hard times and had trouble making ends meet, and so on.

It's for those people that I make games. (Or at least that's what I tell myself when I'm having moments of doubt and questioning why I spend so much time pushing bits.)

<comment><USER12> I'm curious about your experience developing MMOs. Would you mind emailing me[at]lukewal[dot]sh? I am a student right now and interested in hearing from someone who knows the full landscape.

</comment></comment><comment><USER13> I think I'd put games in the same category as music and painting and novels and all the other pleasures that make us human.

What are we solving all those other problems for if not to make more time for things like games?

<comment><USER4> Yes, it's like saying "you can have sound, you can have pictures, you can have plays. But god forbid you from mixing them together, because that's like useless and evil". Why do we even have this conversation? Either all art is useless or games are not useless.

</comment></comment><comment><USER14> It would be a drab, depressing existence to live out your slightly longer life on a planet where everyone was a doctor and no one a novelist. Kudos for making beautiful experiences.

</comment><comment><USER15> I see game developers, especially those one-man indie efforts, to be modern reincarnations of renaissance artist-cum-technologists. At their core is the artist that longs to explore unknown world through manipulation of certain mediums that may or may not lead to useful applications. I see the author as somebody that takes pride in seeing his work affect people's daily lives. An artist might not even care if anybody understands his work or if anybody cares about it at all.

</comment><comment><USER16> I'd like to drop this link, which was posted to HN before without any reaction: [http://hitboxteam.com/designing-game- narrative](http://hitboxteam.com/designing-game-narrative)

Especially after the impact that Minecraft has, my impression is that creating games is your best bet to create new ways of story telling and user interactions. My feeling is that we didn't even scratch the surface of what is possible.

</comment><comment><USER17> Nice post Alex, thanks for that.

A lot of people forget how important two particular industries have been in terms of pushing the envelope when it comes to computer processing and Internet bandwidth technology: Pornography and gaming.

While porn and games are certainly among the more hedonistic (and certainly less virtuous) of products, because people care so much about them is in large part the reason why we have more powerful CPU/GPUs - for example - or faster connection speeds. (I guess you can thank U.S. military investments for some of this stuff as well.)

My point is, gaming is important. Like, really important. It might not have the direct impact on African schoolchildren that Kiva or Doctors Without Borders does, but one could argue that those organizations would not be able to leverage the technology that they rely on so much if others hand't paved the way. Keep doin' the good work, son! ;-)

</comment><comment><USER18> I investigated the "why make games" question recently:

[http://ludamix.com/essays/the_answer/index.html](http://ludamix.com/essays/the_answer/index.html)

<comment><USER19> Good post!

I specially liked the "Why should people bother playing the game I make?" part. I keep making myself this question over and over again, and your answer really clicked with me.

</comment></comment><comment><USER20> While it's true that games don't necessarily have the same impact on people's lives as other, more "important" work, for me, making a game or studying how a game works is such a fun process that it's worth doing anyway.

I spent some time trying to make games in my high school years (NeHe's tutorials helped me a lot)and trying to understand how other games work (I remember the sense of achievement when I managed to switch textures in some crappy FPS game).

Today I deeply regret that I didn't put enough effort to study this field properly... I like my current gig, but I will always look at real game developers with a sense of envy.

<comment><USER21> > games don't necessarily have the same impact on people's lives as other, > more "important" work

This is honestly more for lack of trying than because it just doesn't. Some people are trying, but game development has the disadvantage of coming into its own _after_ the ascent of capitalism and thus most people have been introduced to it as a cash cow rather than as an artistic medium.

<comment><USER22> That's an interesting thought. How different would the interactive games landscape be if it was around during the renaissance. If game designers had sponsors that supported their lifestyle.

As I write this, I think this is the utopian vision of crowd sourcing. Creating a new class of patrons of the arts.

</comment></comment></comment><comment><USER23> Fortunately it's been rare that someone has condescended to me that games are pointless, cruel, evil or mere diversions in general. Games bring joy. Although the same could probably be said of pornography, and yet porno isn't getting any more mainstream of an art form…

Just being entertaining, I think, doesn't legitimize games.

Surely earning lots of money has something to do with gaming as a legitimate full-time culture-making pursuit. A coworker taught a General Assembly class whose attention immediately rose when he pointed out that Clash of Clans earns more than $1 million a day selling virtual goods. But I don't think the creative folks behind that game are necessarily proud of its making money—I know I'm not exactly proud of making a slots game. And I don't think casinos—the highest revenue game in town—are all that respected.

Being a growth industry probably doesn't legitimize games either, it seems.

The challenge though: that's why I make games. I think it's bigger than breadth & depth of computer science. In one scientist's words, a game developer rewires people's brains without reading any scientific literature. Little could be as thrilling. And I know I look at guys like Brian Reynolds and Will Wright as inspiration—smart cultural observers whose technical wizardry turned into real social commentary.

</comment><comment><USER24> Why write them? Because games are play which is the most vital activity humans, indeed mammals, engage in. Without it, not only would I not have this very alphabet I'm writing in (which descends from drawings), but I and everyone reading this would still be sitting in a bush very practically gathering as many berries as we can to survive.

And as the gaming population becomes older, gaming will account for a larger and larger percent of human play.

</comment><comment><USER25> Games are entertainment, leisure time, fun and ignite creativity. If your game can provide that to people, its probably doing alot more good to them than many of the "life-changing" social apps out there.

Apart from that it poses many interesting technical challenges and will make your a better programmer.

</comment><comment><USER26> I wonder if the idea that what we're doing can and/or should be important or world-changing is particularly strong in our industry, if it's something more widely shared, or if it's more narrow (e.g. an HN thing).

We see it a lot here: People talking about how they want to change the world, how they wish they were doing something more meaningful, etc. The reality is that _almost no one_ does work with any sort of profound (positive) impact on humanity or the world around us; the kind of philanthropic work that gets this sort of love just is not that common.

The vast majority of work available, and the similarly vast majority of potentially viable business models, just don't fit this mold. I'm not saying we shouldn't aspire to be and do better, but I am suggesting that the expectation that we should be involved in positive change at all times just isn't reasonable or practical.

</comment><comment><USER27> I started making games when I was 5, and I love doing it. From flash to 3D applications I've probably given it stab.

I've came to the conclusion that making games is far more constructive than watching TV or playing games, but untimely you're wasting your players time. Creating content now isn't novel, you're competing for users time which is already saturated with other games (plus other mediums such as TV).

</comment><comment><USER4> "Is what I am doing actually important?" \- well it beats Facebook in terms of usefulness.

</comment><comment><USER28> Also, think of all the potential Hitlers that will be just playing your games instead of doing anything mischievous. The more time you make those people waste, the better.</comment>


Ask HN: Who is the best programmer in the world? - <AUTHOR>

<comment><USER2> I think there must be very few examples of groups of things for which 'best' is a useful word.

What's the best car? What's the best country? Who's the best singer? What's the best beer? Which is the best musical instrument? Who's the best ever artist? Who's the best ever scientist?

As a step towards a more answerable version of your question, how about this: What are some orderings by which we can evaluate programmers? Who comes at the top of those? Who comes at or near the top of several?

</comment><comment><USER3> That's like asking "Who's the best prostitute?" It's totally subjective.

As an example, for 3d game engine design, clearly Tim Sweeney of Epic Games is one of the top developers, if not THE top developer, in the field today. TODAY.

That said, I wouldn't hire him to write an operating system.

</comment><comment><USER4> I can't imagine an internal view of programming that's so much more quantitative than qualitative that it could lead to forming a question like this.

</comment><comment><USER5> John Carmack

<comment><USER6> Carmack was the first to come to my mind in terms of individual programmer notoriety.

In his day, he was probably considered by many to be the best programmer in his field. Part of that had to do with pushing limits of the hardware at the time and also shipping code.

With the speediness of computers now, this sort of raw optimization is less celebrated. Also, games and other projects have tended to become massive team efforts, harder to pinpoint to one great programmer.

</comment></comment><comment><USER7> Best measured by dollars - Bill Gates.

<comment><USER8> > _Best [programmer] measured by dollars - Bill Gates._

How many of those dollars did he earn actually programming.

Don't get me wrong I think he has been an awesome business man I just don't know how good a programmer he really is. Indeed he may be a most brilliant programmer but still have not really worked as a programmer in earning his fortune?

</comment></comment><comment><AUTHOR> I know there is no answer for this. But, I am looking for good stories of people that you admire, not only for having created big companies but also for the code they've written.

<comment><USER9> You probably should have asked that question rather than the one you did.

</comment></comment><comment><USER10> John Skeet, provided Stack Overflow reputation is creditable.</comment>


Hollywood Wants To Kill Piracy? No Problem: Just Offer Something Better - <AUTHOR> http://www.techdirt.com/articles/20120202/01473517632/hollywood-wants-to-kill-piracy-no-problem-just-offer-something-better.shtml <comment><USER2> I agree that convenience and ease of use are a compelling argument for piracy, but really I think that most piracy occurs because it is free. It just so happens that the technology that makes piracy possible also makes it convenient and easy.

Really, what we are asking Hollywood to do is compete with free. This post is saying "Tack on all these features to your movies, and I'll pay less than the current price of your movie for those features." I get the feeling that Hollywood hears that as "Your product has no value, so do all these things to add value to it."

Hollywood is saying: "We shouldn't have to compete with free. Our product has value (regardless of delivery or portability). Free is illegal." Now, this may or may not be the case technologically, but I find it difficult to fault an industry for failing to come to terms with those realities.

<comment><USER3> To continue the recurring argument...

No, it's not just because it's free. There's a cost to the "free" route: technical adeptness & tools, time digging for what you want, dealing with crappy rips, etc. Sure, it may be _cheap_ , but it's not free. Nothing is free.

And that's the point of the OP: most customers _are_ willing to pay, so long as the price is lower than the alternatives - and for most customers, that's making selection & delivery drop-dead easy to the tune of pocket change. [poster pauses, noting he hasn't had any change in his pocket for weeks due to ubiquity of plastic]. Apple is doing very well distributing content for a market it had nothing to do with a few years ago - why? because they made distribution _easy_ to the point that those with limited time and a little spare change will pay a few bucks to watch/hear something _right now_ , with less effort & better quality than pirate channels. Oh, sure, a few people will opt for "free" out of more time/resources than money, or out of sheer tenacity, but they're of marginal impact so long as the price & ease balance.

Hollywood's problem, like that of Kodak, Smith Corona, and other big-money megacorps of the past, is that technology changes the supply-and-demand curves, reducing the value of their products. It still ain't free, but the value per unit is dropping ... and the middlemen and stakeholders are going to squeeze every penny they can out of their cash cow until the carcass stops producing.

<comment><USER4> "There's a cost to the 'free' route" - your mistake here is thinking that people actually compute those costs. "Free" is a word that lights-up irrational neurons in our brains, like "all you can eat." It almost doesn't matter the cost.

That said, I can prove to you right now that this scheme will not work: On the music-side of the media world, I subscribe to Rdio. It's $10 per month for all-I-can-eat music. I listen to it via my computer, via my home stereo using Sonos (I can play up to three different songs simultaneously via Rdio using Sonos -- more than I'll ever need). And, I can download the songs to my iPhone and listen to them offline.

Yet, even with Rdio and the many compatible competitors (Rhapsody, Spotify, etc.), people still download music illegally "for free." For $10 per month, I can have millions of songs available on-demand for instant playback or I can spend my time downloading songs, installing them in iTunes, syncing with my mobile device, etc. Why would anyone choose the "free" option? Personally, I don't know, but they do.

One difference... In the world of Rdio, songs are not free of DRM, but no one should care -- I certainly don't even though I was one of the people celebrating the move of music from DRMed to non-DRMed -- because six million or more songs are instantly available anywhere I might want to listen to them without any hassles. If I can get at the songs anywhere, at any time, from any device, without hassle, why do I care about DRM?

<comment><USER5> The mere existence of piracy does not invalidate the convenience and ease-of- use arguments.

For example, Valve seems to have found compelling evidence supporting the "service" side of the argument: [http://www.pcgamer.com/2011/10/25/gabe- newell-on-piracy-and-...](http://www.pcgamer.com/2011/10/25/gabe-newell-on- piracy-and-steams-success-in-russia/)

They haven't stopped piracy (which can't be stopped completely), but they have carved out a huge, lucrative market where others with the "free will always trump non-free" mindset were too fearful to tread.

<comment><USER6> I'm always wary of what Valve have to say on the subject of piracy. They are a gatekeeper, not a content creator[1], and everything that they say on the subject suits _them_ in that position. Saying that they oppose DRM is beneficial for Steam as a marketing move. In addition, being privately owned they are under no shareholder obligation to maximise profit by conventional means. I.e. their position is not typical of anyone else in the industry.

It's like when Netflix talks about Hollywood and the TV industry: sure, they bring up some good points, but always something that would benefit the gatekeeper first.

[1] My argument is that the games they create sell the Steam platform, not the other way around.

</comment></comment></comment></comment></comment><comment><USER7> This is a nice, but typical Reddit solution which is a bit more complicated in reality. There are outstanding distribution licenses with many companies for many different parts of the world which can't just be wiped away so this service can just spring to life.

Also Steam works well because it really isn't easy for the common consumer to copy a Steam game vs. as easy as it would be to copy a single unencrypted movie file to share casually with their friends. It is much easier to buy a movie on this Steam type clone and then put it online or give it to everyone you know, which the industry won't want.

Until you get a Steam like service written for OSX, Linux, Windows, Android, iPhone and streamable via the web with proper copy protection this will not fly.

<comment><USER8> > There are outstanding distribution licenses with many companies for many > different parts of the world which can't just be wiped away so this service > can just spring to life.

Copyright is not a right, it s a privilege given to promote the creation of new works in exchange for reasonable access to that work.

Hollywood could easily lobby the government about their contracts not being in the spirit of copyright and that they need to be wiped clean in the interest of the American people.

Instead, they lobby to reduce the reasonable access even further. Forcing people into pirating even more.

I guess they know they have a better chance changing the law for 300 million people than to change it for a couple of other corporations. Pretty sad, really.

<comment><USER9> _Copyright is not a right_

I don't think you've thought that through.

 _Forcing people into pirating_

Nobody is forced into pirating.

<comment><USER8> You are right that I did not choose my words very carefully. The underlying point still stands.

</comment></comment></comment></comment><comment><USER10> As a user here is what I want:

       * I search for movie/TV series title using Google what I want to watch,
       * I find it,
       * I type my credit card number and
       * I watch.

But no - I cannot.

I don't need special features or other things: I have money - you have the movie I want to watch.

<comment><USER3> AppleTV.

'nuf said.

OK, so it doesn't have everything yet, but between that & Netflix there's more than enough to keep most satisfied, and more content is always being added. And you don't have to enter your CC# more than once. Funny, Apple is making crazy money by offering customers the best implementation of what you want, rather than cutting them off...

<comment><USER11> If by "AppleTV" you mean the iTunes Store (since AppleTV does not provide its own content), you have to be joking. No wonder the content companies are most friendly to that place — it makes their old distribution channels look downright cheap. Three episodes of "Whitney" costs as much as a month's subscription to Netflix.

<comment><USER12> Perhaps this is the problem.

Does content have inherently lower value now that it is abundant, and distributed for (nearly) free?

If content providers charged say, (cost of bandwidth)+10%, for each item rather than arbitrary whole-dollar prices, they would certainly see more takers--and perhaps higher profit.

<comment><USER11> I don't think cost-based pricing is the answer. Cost-based pricing is almost never the answer unless you're a charity, and it creates some really perverse incentives for the producer (for example, if I'm running my web service as cost-plus, it's in my interest to buy gold-plated servers cooled by ice hauled in from Antarctica — 10% of that is a lot more than 10% of $200). I do think the value of entertainment has dropped as the supply has ballooned. The problem is basically just that they're stubborn as a mule and refuse to seriously compete in the market that exists today. They want to keep things the way they were, and if you ask for something else, they'd rather just take their ball and go home than negotiate. And I mean, that's their right, but when they do that, they are really the ones who are undermining their business model.

<comment><USER12> Quite right about the perverse side of cost-plus pricing.

</comment></comment></comment></comment></comment></comment><comment><USER13> I remember watching a documentary a while back on how Hollywood screened and rated TV/film productions. It angered me to see that focus groups consisting mostly of soccer moms controlled our movie rating system & what we see on TV. This is exactly what's wrong with Hollywood and the music industry in America.

Seriously, it amazes me how an industrial complex like Hollywood can collectively make so many dumb mistakes, that would otherwise cripple/kill other industries, and still rake in billions.

<comment><USER14> The documentary you're probably referring to is "This Film is Not Yet Rated" (<http://www.imdb.com/title/tt0493459/>).

</comment></comment><comment><USER15> The thing is I don't think you really can kill piracy and Hollywood should realize that it doesn't need to.

For me personally, piracy is a crime of opportunity - I do it because it's easy and available. However, me downloading movie doesn't represent lost revenue for Hollywood - if I were forced to pay for a movie, I would simply do something else.

This is what I think goes over the head of Hollywood execs. If a youtoube music video has 5M views, it doesn't mean it missed out on 5M customers, it just means 5M were willing to watch something for free.

As a side note, the one movie service I have paid for in the past 5 years, Redbox, has strong opposition from Hollywood. I use it because as the OP mentions, it's better than pirating. Instant, convenient, and the cost is a non issue. Why doesn't Hollywood embrace this rather than oppose it? Who knows.

All that said, it starting to feel like we're beating a dead horse here on HN.

</comment><comment><USER16> To me, the offer exists. Is called Cuevana.tv (<http://www.cuevana.tv>)

I would GLADLY pay Cuevana 35$ a month to watch the content in there. That's 35$ the industry is not getting from me when they could.

Hollywood should embrace sites like Cuevana: they would have the distribution, the bandwidth, up-loaders, ratings, subtitles... all outsourced for FREE.

Not to mention, these type of sites can work like marketing tools: you have ratings, user sentiment, geography...

It pains me the amount of effort being placed to find a solution to stop this. It makes no sense.

</comment><comment><USER17> People WILL pay for convenience. It makes absolutely no sense for them to resist a move like this. Their misguided rationalizations are going to drag them down.

</comment><comment><USER18> I think Hollywood is way to resistant to change. People (consumers) are quick to pick up new technologies to fit their needs. Big corporations can either comply and cater to those needs or force their own model on their customers.

The latter is NEVER the correct decision. Companies exist solely to please customers (which in turn amasses profit and satisfies investors).

Hollywood, you work for us.

</comment><comment><USER19> I have a dream. I want to pay the Government of the United Kingdom for a TV License, and the right to stream all their stuff using iPlayer. I would also like to stream BBC One through Four and BBC News conveniently. You can have GBP 144.50 per year from me. If only you will let me do this.

</comment><comment><USER20> They will do that at some point, however at the moment it's probably cheaper to pay off politicians and keep the old model going for as long as they can. it's as simple as that.

</comment><comment><USER21> Thats what is so confusing about hollywood - they want to kill piracy and at the same time kill/supress netflix.

They are an outdated model.

<comment><AUTHOR> Perhaps this against the current behavior will lead them to exhaust their resources and make them naturally selectable for extinction as a business model.

They had their chance to evolve.

<comment><USER22> But they can't go bankrupt until the movie studios themselves go insolvent.

The problem is these studios are rolling in cash. Even if they were to lose significant piles of it, they'd simply be bough tout by another large corporation that can afford to pump yet more money into it.

They'll remain on life support so long as people go to theaters to watch blockbuster movies. Their business model won't change until people as a whole turn away form them.</comment></comment></comment>


Encrypting Amazon RDS Resources - <AUTHOR> http://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/Overview.Encryption.html <comment><USER2> This is encrypting the disk that the RDS instance is using to store the data right? And amazon are holding the decryption key.

What exactly is this protecting against? (Genuine question not rhetoric).

Without encryption, I guess someone with physical access to an Amazon data center could pull a drive somewhere and grab the data.

With encryption, that same person would also have to get hold of the key as well, but nothing seems to be said about the key storage being in some separate super secure location, so could that same malicious employee with physical access not also go on a key hunt and end up getting access anyway? So it's just another "layer" of protection not totally impossible.

.... or am I missing something crazy obvious where an unencrypted RDS disk is accessible by some other means? Maybe via to nature of disks being reused without proper cleaning or similar?

<comment><USER3> I wonder if it has anything to do with the fact that the CIA is now an Amazon customer. Hopefully they don't also become Amazon's _employees_.

<comment><USER4> The NSA almost certainly has staff posing as Amazon Web Services employees. They would be negligent _not_ to have infiltrated the company.

</comment></comment></comment><comment><USER5> Great news, I might finally be able to use RDS now. I'm always impressed that the AWS team seem to be on the ball with improvements - whenever I think "I could really do with X feature", they come out with it a few months later.

Having said that, the limitations at the bottom are a little arduous if you're already on RDS. Can't encrypt an existing unencrypted database. So you'd think to take a backup and restore to a new encrypted DB, but you can't do that either. Nor can you stream from an unencrypted master to an encrypted replica, freeze and swap over. Bit of a pain there!

</comment><comment><USER6> It looks great but it appears the smallest encrypted RDS is medium. I would love to see it for the micro or small instances (my level :-) ).

</comment><comment><USER7> Encrypting backups makes a lot of sense. Is encrypting an active db a requirement in some enterprise environments?

<comment><USER8> PCI compliance requires that, IIRC.

<comment><USER9> Been a while since I've had to deal with PCI, but I don't think encryption is required.

<comment><USER10> It is now. From [https://www.pcisecuritystandards.org/documents/PCI_DSS_v3.pd...](https://www.pcisecuritystandards.org/documents/PCI_DSS_v3.pdf)

PCI Requirement 3.4:

Render PAN unreadable anywhere it is stored (including on portable digital media, backup media, and in logs) by using any of the following approaches:

\- One-way hashes based on strong cryptography, (hash must be of the entire PAN)

\- Truncation (hashing cannot be used to replace the truncated segment of PAN)

\- Index tokens and pads (pads must be securely stored)

\- Strong cryptography with associated key-management processes and procedures.

PCI Requirement 3.5

Document and implement procedures to protect keys used to secure stored cardholder data against disclosure and misuse.

<comment><USER9> Perhaps this is new in v3 since I was working under v2 at the time. It certainly makes sense that the card number must be stored encrypted.</comment></comment></comment></comment></comment>


Water evaporation-driven toy motor - trimble-alum http://www.theguardian.com/science/2015/jun/16/scientists-build-toy-car-propelled-by-evaporating-water

<comment><AUTHOR> I was the only poster to the previous thread about this at: [https://news.ycombinator.com/item?id=9732609](https://news.ycombinator.com/item?id=9732609).

Here is what I wrote:

I also work in this space, so the headline caught my attention. This is far from the first. Some other evaporation driven engines include:

[https://en.wikipedia.org/wiki/Drinking_bird](https://en.wikipedia.org/wiki/Drinking_bird)

[https://en.wikipedia.org/wiki/Energy_tower_%28downdraft%29](https://en.wikipedia.org/wiki/Energy_tower_%28downdraft%29)

[https://en.wikipedia.org/wiki/Barton_evaporation_engine](https://en.wikipedia.org/wiki/Barton_evaporation_engine)

The solar updraft tower and vortex engine also operate in a similar space, meaning that all of them operate using the temperature difference between ground and tropopause which feeds the water cycle.

It is my personal opinion that evaporation-driven engines (or something quite similar) are the most promising energy source (on this planet). Essentially, they are an alternative source of solar energy which doesn't have the problem of needing the sunlight to be present to work.

The main issues, as with most new energy sources, are efficiency and cost. The Columbia motor costs $5 for 50 microW, or $1x10^5 dollars per watt. You generally want something nearer 1$/watt for primary energy use. The efficiency in terms of water or thermal energy is not stated, but is likely similar to drinking birds, which have a thermal efficiency around 0.01%. The theoretically possible efficiency for the evaporative half of the water cycle is on the order of 12%, so there is a lot of room for improvement.

</comment><comment><USER2> "(Water)has a desire to evaporate". I wonder what other previously unappreciated emotions it has.

<comment><USER3> Even better, the subtitle reads: "Researchers at New York's Columbia University harness the element's natural process"

</comment></comment><comment><USER4> Aw. Anyone still have a drinking bird?[1] Same principle.

[1] [https://www.youtube.com/watch?v=Yk71GY02diY](https://www.youtube.com/watch?v=Yk71GY02diY)

<comment> david-given I used to have one, but I lived in a hard water area, and the felt evaporator scaled up and is stopped working.

IIRC a sipping bird is powered by the heat differential caused by cooling of the evaporator. This thing seems to be powered by centre-of-gravity changes caused by motion of hygroscopic material.

I _suspect_ that IRL it would very quickly stop working due to gunk in the water affecting the hygroscopic material, but it's a very neat hack nevertheless.

I wonder if you could build a passive humidifier out of one of these? Float one in a container of (clean) water and attach some fan blades. As it spins, it pushes water into the air. At the very least it'd make a fun executive toy.

</comment></comment><comment><USER5> See also the rubber band heat engine, e.g. [https://www.youtube.com/watch?v=dBXL93984cQ](https://www.youtube.com/watch?v=dBXL93984cQ)

</comment><comment><USER6> They're using difference in humidity... wow, inventive.

</comment><comment><USER7> Wow this is amazing. I'm actually blown away.

</comment><comment><USER8> How much power can these motors produce? Can they be used for practical purposes, or are they simply a cool experiment?

<comment><USER9> The fact they don't give any hard numbers is a pretty big sign that this is nothing more than a neat toy. Powering LEDs takes very little energy - 1 mA at 2V (2 mW) is enough to make it visible. Making it flash reduces that power again.

The concept of using bacterial spores as a means of producing motion is pretty neat, though it's obviously a long way from being practical. The suggested use case (low power remote floating sensors) seems pretty suitable for solar power, which has the advantage of maturity and no moving parts.

</comment></comment><comment><USER10> It looks like those discs-and-marbles perpetual motion machines... maybe that's how those work (for a while).</comment>


Ask HN: Georgia Tech OMS CS Program? - dan-g

Was anyone in the inaugural group? It looks like they're going to open up applications for Fall 2014 and I was hoping to gather some experiences and opinions before I apply. <comment><AUTHOR> I did not enroll, but I wonder what concerns you have. I mean since it looks like you plan to enroll, what would someone have to say to dissuade that intent?</comment>


Inside the mind of the man behind Google's most important products - <AUTHOR> http://www.theverge.com/a/sundars-google/sundar-pichai-interview-google-io-2015

<comment><USER2> Google experiments with its employees. The short-term outlook is personal. Google is still in for the long-term.

<comment><USER3> I do not understand your point. Rephrase please?</comment></comment>


The Day The Day Job Died - Celebrating the Plunge - <AUTHOR> http://www.promoterforce.com/blog/2007/05/18/the-day-the-day-job-died-celebrating-the-plunge/ <comment><USER2> Three weeks since I've left my day job (it was my first one and I've been working for three years at this place).

I have no real plan yet, nor any savings remaining but, still, I'm really happy I left. I promised myself to never accept being employed again.

<comment><AUTHOR> "no real plans yet" thanks for your comment, I have a strong startup concept and some dev work completed and am looking for one or two great people to work with. maybe we can chat, click through to my YC News profile to get my email.

<comment><USER2> Thanks for the idea but I have no plan to join nor start a start-up.

I'm just trying to find a way to be as free as possible while feeding myself.

<comment><USER3> Try grazing. I recommend the open range.

</comment></comment></comment></comment><comment><USER4> Congrats! I quit my job last week and have planned to write a similar article but I don't have time because I'm working too hard on my start-up. Maybe once we get over the first milestone, funding, I'll be able to talk about my experiences.

</comment><comment><USER5> Same here. Today was my last day at work. I liked the first comment in the post. True, once you leave your job you only have a short time to build your business before you exhaust your savings and be forced to look for a job again.

</comment><comment><USER6> For people of a certain personality type working for someone else is a traumatic and harmful thing. He sounds like someone back from the front lines of a bloody battle.

<comment><AUTHOR> not so traumatic and I learned a lot, just lost the focus with all the clutter of politics.

</comment></comment><comment><USER7> Jobs' days are numbered. The only way to really motivate people is the chance to strike it rich.

<comment><USER8> A lot of money is the only thing that motivates? That's just sad.

I think you're wrong, though. If you're only going for the money, you're not motivated by what you are doing, you're just a mercenary. To me real motivation is someone who is passionate and loves what he is doing, and would be doing it with the same passion even if it never would make him a dime.

<comment><USER7> I don't think most YC start-ups are doing what they _love_ \-- they are doing something to get rich. That's how you get a group of people together to work hard on something. Programming is mostly tedium, and nobody loves _that_ \-- why would Arc be taking so long otherwise? Once you don't _have_ to work, and have money, and can do what you "love", I think you'll find most people become indolent.

<comment><USER9> I hope this isn't true. I'm not sure about YC start ups but I know that I'm in this field because I love it. If you just want to get rich there are certainly easier ways to do that (e.g. real estate, investment banking).

</comment></comment></comment></comment><comment><USER10> same situation here. last day at the day job was last friday. rock on :)</comment>


What country has the best privacy laws to connect to a VPN in? - <AUTHOR> The Snoopers' Charter passed into law here in the UK, and now ISPs will be compelled to keep internet connection records, which will be made available to a shocking number of agencies.
For some time, I've been meaning to route my traffic via a VPN to a different European country, but with Switzerland voting to weaken its privacy laws, I'm unsure to which country I should route my traffic.
So my question is: which countries make the most sense to have a VPN in from a privacy perspective (also taking into account the available VPN services there - I'm not hosting my own)? <comment><USER2> You may be surprised, but the United States may be one of your contenders.

I recommend Private Internet Access [0], which what I use as my VPN service.

Ultimately, it's about trust, and it is very difficult to determine which services ensure your privacy and which ones might sell your history or cooperate with prying governments.

[0]: [https://privateinternetaccess.com](https://privateinternetaccess.com)

<comment><USER3> US is a contender as long as you're willing to fight the US government in court, and you'd likely have to. The law may ultimately be on your side, but that doesn't mean the US government won't try to drop the hammer hard on you if they really want your data. They know most of the small companies and even some of the big ones scare easily, so the aggressive attitude is well worth it for them, even if they know they're doing unconstitutional data requests.

Switzerland and Germany are probably the best right now, although Switzerland recently passed a surveillance law, too, but I'm not sure how it affects VPNs. Germany has a privacy-friendly Constitution and resides within the EU, which also has strong privacy laws. However, Germany is also trying to limit privacy rights, so this may be a little unpredictable right now. Germans usually tend to care more about privacy so they may fight this, though.

[https://www.theguardian.com/world/2016/sep/25/switzerland- vo...](https://www.theguardian.com/world/2016/sep/25/switzerland-votes-in- favour-of-greater-surveillance)

[http://www.dw.com/en/germany-planning-to-massively-limit- pri...](http://www.dw.com/en/germany-planning-to-massively-limit-privacy- rights/a-36529692)

More than anything I would recommend a "zero-knowledge" approach, so use the strongest and most ephemeral VPN encryption and generally try to discard user- related data as soon as you get it. And put it all in your ToS/Privacy Policy so that it's legally harder to lie to your customers when you're forced to not do that anymore.

</comment></comment><comment><USER4> Go with the Eastern Europe, language barriers will keep international cooperation between agencies to a minimum, no matter what kind of local privacy laws they have. And they only 50 ms away from the UK.

<comment><USER5> Language barriers are hardly a problem with things like Interpol or the EU itself. Maybe you want to keep going East... or not.

</comment></comment><comment><USER6> My VPN gateway of choice is currently in Dublin. It's close, with good infrastructure, and not in 5 Eyes. Don't know about legislation but I don't do anything nefarious, just making a point against Snooper's Charter.

<comment><AUTHOR> Nefarious or not, given the UK police's propensity to attack any and all critics (e.g. the Lawrence family, Baroness Jones), I'd rather have some legislative protection from state overreach.

</comment></comment><comment><USER7> The Scandinavian countries have a good reputation for legal protections on privacy. I can't comment on whether they actually live up to that reputation.</comment>


The One Thing Programmers and Musicians Have In Common - <AUTHOR> http://www.codinghorror.com/blog/archives/001214.html

<comment><USER2> I think it's simpler than he proposes.

1\. Everybody likes music

2\. Music making is very accessible (offhand, I can't think of any condition which would prevent one from playing music at all)

3\. If you have the dedication to get good at making programs, you also have the drive to get at least half-decent at making music

Result: good programmers tend to be musicians. Alan Kay was once a professional jazz guitarist; I don't find this coincidental.

The problem I have with music-anything analogies is that "music" covers such gigantic scope that you can make all kinds of generalizations about it, and they'll be true for _some_ kind of music. Individualistic? Collaborative? High-tech? Low-tech? Intricate and exact? Improvised and free-form? Notated? Oral tradition? Hey, we've got that, too! My field is just like music!

<comment><USER3> But the same doesn't go for people with the dedication to get good at doing various other things, like cooking or cutting hair. Or does it?

</comment></comment><comment><USER4> About 15 years ago I was curious about the number of programmers I met who were also musicians. I wish I could remember fully the article I read at the time but IBM had a formal recruiting strategy for musicians sometime around the 50's-60's. The company recognized a relationship between musical and programming ability.

I'm going to speculate that it has something to do with musical composition being akin to software design.

Paul Hudak is another noteworthy person in the field who pursues music and makes it part of his research. His book "The Haskell School of Expression" teaches aspects of Haskell using music composition. As an aside, he also was involved in a new program at Yale called "Computing and the Arts" which looks like a heck of a program for developers with artistic leanings.

</comment><comment><USER5> As a musician and a developer, I can agree with most of this. I do however, see it as two opposite sides of a defined spectrum.

When I am playing an instrument, I typically lose any connection with thought or the rest of my body not directly involved in playing. My mouth sorta drops down and I begin to almost drool. Something my girlfriend loves to remind me of. I am literally lost in the music.

When coding, I am almost hyper aware of the thought process. I am surely focused on only what is happening relating to the code, but the disconnect from myself never happens.

I think the connection is the desire to create something and an inborn understanding of modularity and the flow of ideas/actions. People with these qualities are often drawn to both.

</comment><comment><USER6> Ex classical musician checking in. One other possibility that has been hinted at indirectly: many good musicians are rather introverted (singers being the notable exception). You have to be -- or at least not be overly extroverted -- in order to lock yourself in a practice room for many hours a day. It's often lonely. This thus makes musicians temperamentally suited to be programmers.

<comment><USER7> I used to play the violin for my high school orchestra. I wasn't great, and I often wondered how professionals could practice for hours on end. Now I realize that it may very well be asked how I could sit in front of a computer programming for hours on end.

<comment><USER4> It's just a matter of finding something you love to do and it won't feel like a chore.

In college, I was in a 1 credit small jazz combo that met every Friday from 3-4. After the instructor left at 4, we'd whip out songs we wrote and would start jamming. Often it was 7 before I looked at the time.

I read an interview with a famous Chen Tai Chi stylist a few years ago. He recalled practicing 12 hours daily for a few years in his youth. He didn't talk about it like work, he just got a thrill out of every moment.

</comment></comment></comment><comment><USER8> I've often wondered how much of this "Programming is like playing music" is true, and how much of it shit we make up to make ourselves look better. I mean, musicians _are_ much cooler in the popular psyche than programmers.

I play a bit of guitar and I can think up of all sorts of seemingly valid comparisons, but I don't if they're just too general to draw any conclusions from. After all, many of these are just as applicable to something like photography (another thing that seems common amongst programmer types)

One thing I _can_ say for sure is that true or not, you can use these musician/programmer analogies to impress girls, who'll start to think of you as the "creative type" many say they like ;)

</comment><comment><USER9> I love music. I never actually tried to learn any instrument, so i may buy a guitar this sumer and just have fun with it(i doubt its going to be any good).

From what i know about music, and other creative activities, i can say that programming has some similarities with the other creative arts, but it an entirely different art of its own. We can draw connections between all the arts, painting is like music, programing is like dancing, i can write a blog post on all of those, but they are still different arts.

Maybe knowing how to play doesn't make you a better programmer directly, maybe it does it indirectly by making you more creative in general. Those are my thoughts on the topic.

</comment><comment><USER10> Part of the problem with all the Programmers are the same as Foo comparisons is that programming styles are so numerous that any one can find similarities between their style and some hobby, it's just that no one ever compares it to say knitting, crochet, scrap booking, gardening, etc. because those all strike people as a step down in terms of "leading a meaningful life"

The only thing I can find in common with musicians is that both are incurable gadget nerds.

<comment><USER11> Totally, for instance as a drummer and a programmer I find myself comparing "drum patterns" and riffs as procedures, but particularly with drum patterns they can be re-used across bands/styles and songs even within the same record! So being a drummer is definitely about code re-use and modular design. I could go off on my project to generate recursive music (live) but thats a whole other world. I would like to think that I drum with s-expressions.

</comment></comment><comment><USER12> My first job was in a small software company where all programmers worked part-time. Their interests outside the job were varied widely. One wrote software for chimney sweepers, another published a chess fanzine, there was a coach of an athletics team and I make comics. But yes, there also was one musician.

<comment><USER13> Pardon my curiousity, but what did the "software for chimney sweepers" do?

<comment><USER12> I think it had something to do with the paperwork specific to their trade.

</comment></comment></comment><comment><USER14> I find it easy to express myself through music and relax a bit when my head is full of binary trees.

</comment><comment><USER15> Being a programmer is like being a garbage collector. You drive a huge truck, don't mind noxious odors, make frequent stops, you lift heavy things, your job is extremely monotonous, and you get paid better than teachers.

The parallels are really much closer to the arts than they are to the service sector.

</comment><comment><USER3> That's a sweet Meinl Byzance ride he's got in the youtube vid.

</comment><comment><USER16> Long hair and beards?</comment>


How Little Exercise Can You Get Away With? - <AUTHOR> http://well.blogs.nytimes.com/2009/12/30/phys-ed-how-much-exercise-to-avoid-feeling-gloomy/?ref=magazine <comment><USER2> _"... You do not necessarily have to divide your exercise time into daily allotments, either. Existing "scientific evidence does not allow researchers to say, for example, whether the health benefits of 30 minutes on five days a week are any different from the health benefits of 50 minutes on three days a week," according to the activity guidelines. Do what suits your schedule. ..."_

Minimum for mental health, not physical health and doesn't take into account is the way people work very well. If you do lots of little bits of _"regular"_ exercise it adds up. Leave a time interval and it _"appears"_ to get harder to do the next time. I found this last year trying to see exactly why it's easy to fail doing hard things. By breaking the hard thing into little irregular steps and repeat them at fixed regular intervals there is less chance of failure.

The fail point is right around the time you start to do a hard task after an idle period. Take a break and things appear harder than they are. The amount of motivation energy is high. Do things regularly and the energy barrier seems lower. I found this out the hard way trying to see how far I could push myself without cracking or failing. My target last year was 1000 miles.

</comment><comment><USER3> 20 minutes per week for reasonable mental health? Looks like I need to pick up my pace a little.. :-)

</comment><comment><USER4> More about METs and tradeoffs between minutes exercised and intensity of exercise:

<http://www.health.gov/paguidelines/guidelines/Appendix1.aspx>

</comment><comment><USER5> Title is a bit misleading - sure 20 min a day may be fine for achieving some milestone, but the bottom line is that our bodies are machines that are not meant to be sedentary!!! at the very least, 1 lb of fat = 3200 calories and we should not be walking around with whole people of fat tied to our guts

</comment><comment><USER6> Causality FAIL. They even have the unmitigated gall to talk about a "dose- response" relationship for what is a _purely observational_ study.</comment>


The Difference Between Machine Learning and Statistics - <AUTHOR> http://www.galvanize.com/blog/2015/08/26/why-a-mathematician-statistician-machine-learner-solve-the-same-problem-differently-2/#.Vd8nJdNVikp <comment><USER2> So machine learners have no notion of uncertainty?</comment>


Vista's big problem: 92 percent of developers ignoring it - <AUTHOR> http://news.cnet.com/8301-13505_3-9969231-16.html <comment><USER2> I think that counts corporate developers, and corporations are not switching to Vista yet. And anything you write for XP will port to Vista, so there is no reason to target Vista specifically. To port to Vista, you may have to add a manifest file to your software and possibly rewrite some parts like installer scripts, rethink some of the flow of the program due to user prompts that might popup and scare the user, and update documentation to warn users. But developers had the same problem of having to test in Windows XP separately from Windows 2000 and Windows 98 when XP came out.

Microsoft's own latest software remains compatible with Windows XP, and while Vista is one extra operating system you will have to test for, Virtual Machines let you run multiple operating systems on one computer.

That's not to say I miss my Vista system that I ditched for my mac. :)

</comment><comment><USER3> My recent experience with Vista has been hell.

It virtualizes c:\Program Files for "compatibility" so that you can see bizarre situations like writing to a file and then having it not exist where you thought it was.

To avoid these virtual store problems, you have to embed XML in your application's executable to get the infamous ALLOW or DENY window to bother the user. If you use Visual Studio 2005 to do it, watch out! There's a bug in a certain class of unpatched XP that _blue screens the computer_ because of the way the XML is structured that Visual Studio's manifest tool spits out when it merges manifest fragments. It's all overly complicated.

I would never develop Windows software if there wasn't a market for it--it's exciting to see the underdogs picking up marketshare.

</comment><comment><USER4> Give it time. The computer manufacturers are no longer supporting XP. If you buy a Dell now, you have to get Vista. So before long everyone will port over to Vista.

</comment><comment><USER5> Not that surprising. Two years ago I was a fulltime commercial desktop application developer, and our minimum supported spec was Windows 98.

</comment><comment><USER6> This statistic is misleading. All those xp developers could be making vista- compatible programs without specifically making vista the primary target OS.</comment>


Abacus Raises $3.5M to Eliminate Expense Reports - <AUTHOR> http://blog.abacus.com/post/101426081019/abacus-raises-3-5m-to-eliminate-expense-reports

<comment><AUTHOR> Abacus (YC W14) is eliminating expense reports. Submit expenses in realtime, and get paid out directly to your bank account via ACH. It's the fastest way to manage and pay your expenses.

It's spooooky how easy it is to use (happy halloween yall)</comment>