Ostel: Encrypted Phone Calls - <AUTHOR> https://ostel.co

<comment><USER2> OK, I'm a phone geek, but I'm hoping Moxie will jump in here to set the story straight.

I see ZRTP[1], but I didn't see anything on the site about signaling encryption. As you may or may not know, the content is only one component of a secure communication. There needs to be signaling encryption as well. The signaling encryption is harder than the media encryption, because the media encryption only works if the signaling encryption was successful. Signaling across a network you don't trust is really the hard part, and it's a problem for all of these apps.

I don't know if Moxie implemented the certificate pinning stuff in RedPhone, but that's the sort of Crypto you need to have fool proof call security.

Calls are vulnerable to MITM attacks because you have to trust the network you're riding over to some extent. Redphone has intermediating crypto for the call setup that's nifty, and I'd be cautious about using any "secure" calling system that didn't provide setup protection.

Again, I'm not saying Ostel doesn't have these things, I just couldn't find them.

[1][http://blog.cryptographyengineering.com/2012/11/lets-talk- ab...](http://blog.cryptographyengineering.com/2012/11/lets-talk-about- zrtp.html)

Edit: Also wtf is FreeSWITCH doing in there??

<comment><USER3> Here is my (obviously biased) view of the landscape:

1) ostel.me :: Like many of the Guardian projects, this is an experiment in combining existing OSS libraries to create an app. In this case, CSipSimple, pjsip, and ZORG. It's basically a standard SIP/RTP VoIP client with an Android UI. That means it needs to maintain a persistent connection to a SIP server at all times, which doesn't necessarily work well with the Android process model, could drain your device's battery life, and could be flaky in scenarios where you're going in and out of coverage or switching from data to wifi. However, it is ideal for the hacker crowd that wants ultimate control, maximum configurability, and enjoys occasionally drop to the command line. You're correct that it's likely not possible to do things like certificate pinning in this context.

2) RedPhone :: While it remains to be seen whether we were correct or not, our development philosophy with RedPhone was to eschew the VoIP libraries and paradigms that were originally developed for the desktop environment in favor of OSS/Free code written from scratch for the mobile environment. Our belief is that the different network and platform characteristics of mobile devices require a mobile-oriented solution. This means that we use a lightweight mobile-oriented signaling protocol instead of SIP, push notifications instead of maintaining a persistent connection at all times, techniques for establishing low-latency routing for global calling ([https://whispersystems.org/blog/low-latency- switching](https://whispersystems.org/blog/low-latency-switching)), a jitter buffer optimized for mobile data networks ([https://whispersystems.org/blog/client-side-audio- quality](https://whispersystems.org/blog/client-side-audio-quality)), and your normal phone number for addressing rather than a new identifier. It also means that, yes, we can do things like certificate pinning for the signaling channel. This is all obviously oriented towards the average smartphone user, though, so it's sometimes less appealing to the hacker crowd who want to use a SIP identifier or connect through their own SIP server.

2) Silent Circle :: My sense is that Silent Circle is trying to do both. Their stack seems to be based on traditional VoIP protocols (SIP/RTP), and their server-side infrastructure appears to be a FreeSWITCH box in a single Canada datacenter (maybe with a single-DC European presence now or coming soon as well?). However, they are using those desktop protocols to try to create a packaged non-hacker-oriented experience. I'm not sure if that's possible or not, but I'm obviously biased. It does cost a non-trivial amount of money, though, and their client source isn't Free.

<comment><USER4> How hard would it be to do encryption over an actual cell call as opposed to the data connection?

<comment><USER2> You have to own the towers to have real encryption over the cell channel.

If you can encrypt the audio, and play that through the phone, that would be your best chance. Without the telco implementing encryption it's nigh impossible.

</comment></comment></comment></comment><comment><USER5> This is from the Guardian Project, and the source code is available here for the curious:

[https://github.com/guardianproject/ostel](https://github.com/guardianproject/ostel)

I'd like to know what differentiates it from RedPhone, Silent Circle and other similar products.

<comment><USER6> silent circle is closed source and everything goes through their server. Sure they can claim not to store much logs, but when some government entity puts some secret orders on them, who knows what will happen. Remember that having the metadata, who calls who, is already a big win for surveillance entities. RedPhone is owned by twitter, same story, but the client is open source, and maybe they have plans to release the server too, but you would have to compile your clients too since apparently the servers are hardcoded into the client. Both of these are thus not federated.

Ostel is open source client and server side, you can easily set up your own server, and if I understand it correctly it's also federated.

Some reading: [https://github.com/WhisperSystems/RedPhone/issues/63](https://github.com/WhisperSystems/RedPhone/issues/63)

[https://guardianproject.info/2012/07/05/a-network- analysis-o...](https://guardianproject.info/2012/07/05/a-network-analysis-of- encrypted-voice-over-ostn/)

</comment></comment><comment><USER7> > Ostel works great on the Groundwire app. It's a paid app and for $10 you'll > be able to receive encrypted calls. There's an additional $25 in-app > purchase for the ZRTP extension to also place a secure call.

$35 for secure calls on iOS? We can do better than that.

<comment><AUTHOR> Is there a cheap, reliable open-source alternative? I'm sure that, in light of current events, many people would be interested.

<comment><USER8> Not for iPhone unfortunately. You can see our early work analyzing client software options from last year:

[https://guardianproject.info/wiki/OSTN#Client_Software](https://guardianproject.info/wiki/OSTN#Client_Software)

</comment></comment></comment><comment><USER9> FWIW, I prefer Silent Circle, created by the same team behind PGP. Glad to see more choices in the market though. :)

[https://silentcircle.com/](https://silentcircle.com/)

</comment><comment><USER10> Some of the most important information for intelligence agencies is the metadata, i.e. who is calling who. That is often considered more important than the content. As far as I can see this does not address that.

</comment><comment><USER11> I'm going to be a jerk here but I'm having difficulties taking a product seriously with badly photoshopped interfaces into devices that don't even respect basic laws of perspective.

The problem I don't see this solving is the fact that I still need to trust a third party that routes my call not to store and hand over any data on those calls.

<comment><USER8> OStel.co does address this - we are specifically trying to lay out how a privacy-first, security by design VOIP service should be run. We are taking stock, off-the-shelf open-source software, and figuring out the best configuration for it to be run in order to store as little data as possible. We are also thinking about how we can defend against tracking of signaling information - by perhaps running the SIP/TLS portion over Tor.

You can read about this and more on some of our posts on the Guardian Project blog:

[http://guardianproject.info/2013/06/12/carrier-grade- verizon...](http://guardianproject.info/2013/06/12/carrier-grade-verizon-and- the-nsa/)

[http://guardianproject.info/2013/01/31/anonymous-cb-radio- wi...](http://guardianproject.info/2013/01/31/anonymous-cb-radio-with-mumble- and-tor/)

[http://guardianproject.info/2012/12/10/voice-over- tor/](http://guardianproject.info/2012/12/10/voice-over-tor/)

[https://guardianproject.info/2013/02/22/lower-bounds-of- the-...](https://guardianproject.info/2013/02/22/lower-bounds-of-the-narrow- bands/)

</comment></comment><comment><USER12> What is the security model behind this? Which pattern is ostel using?

</comment><comment><USER13> What type of encryption? What key length?

<comment><USER8> It uses ZRTP and SRTP at least for the audio / video streaming portion of the service. The exact ciphers and strength are decided by the two clients making the call, as OStel server itself has no hand in negotiating crypto for that portion. Since we support many different client types (CSipSimple, Jitsi, Groundwire, SFLPhone, etc) this can vary greatly.</comment></comment>


The Weakest Link Is You - <AUTHOR> https://medium.com/tech-talk/280c753b1145

<comment><USER2> Wait? You can reset a facebook password by having 3 friends confirm? What the? First of all getting 3 friends to pull a prank on someone should be fairly easy. Other than that you can just create 3 fake accounts and get the victim to add you as friend. I find that way worse than these security questions, because there's essentialy no way to defend against this.

Well, except by not having facebook (which luckily I don't have).

<comment><USER3> What the original author failed to mention (or likely never bothered to find out) was it's not simply 3 friends, but instead 3 friends from distinct social circles, possibly with a minimum mutual friend requirement or more.

When you choose the you're friend you want to verify, it dramatically limits the choice pool for the next two, meaning you can't pick 3 mutual friends, you need to pick yourself, their friend from back in college you don't know, and their sister. Harder to do than get any three friends to play a prank.

<comment><USER4> I certainly hope they stay my friends, and don't die before I need them.

</comment></comment></comment><comment><USER5> Another proof of the fact that security questions are a really bad idea.

I'd rather have to go through some manual time intensive procedure in the unlikely instance of losing access to my password safe, instead of opening myself that wide to social engineering.

<comment><AUTHOR> I agree. I would prefer to have to ring up a support line and provide ID or something. However, that opens up two problems:

* What if it's a non-critical service? * How do they link an ID to an account without requiring it at launch?

</comment></comment><comment><USER6> Consider this:

The question "What is your pornstar name?" asks for your mothers maiden name and first pets name...

To get your security details.

<comment><USER7> I believe the corresponding joke goes something like this:

"To get your pornstar name, take your mother's maiden name and first pet's na--"

"Let me stop you there. You realise those are both common security questions for authentication if you forget your password, right?"

"Argh! You mean my bank knows my pornstar name?!"

</comment></comment><comment><USER8> Who gives real information as answers to security questions? The approach I took is to use a hardware device with limited login attempts to generate store most of my (random, 16 character) passwords (an IronKey, in my case).

IronKey have a reset mechanism involving security questions; I've never used it, and I don't know the answers I gave; they're on a sheet of paper, in a safe somewhere. Yes, it's going to be inconvenient if I ever need it, but if it happened tomorrow it would be a once-in-ten-years event.

My bank inconveniently REQUIRES security questions in addition to a PIN for online banking; again, the information they have is made up. I remember it because I use it regularly, so that ISN'T written down anywhere.

For almost anything else less important, I've either just ignored the security questions (ie. entered random data) or noted them in the extra account info field on the IronKey.

For email, I run my own mail server in colo. It's maybe overkill, but I don't care. Credentials are again 16 character random passwords that I couldn't tell you, and authentication is only allowed over TLS. I'm toying with going for full client SSL certificates but device support would be the issue. I've already discovered more than I wanted to about incompatible SSL implementations on mobile devices over the years, which is why I'm still building Debian packages from source linking to OpenSSL instead of GnuTLS... And there's no webmail access. Never did find one that wasn't either written in PHP, half-functional or abandoned.

<comment><USER9> _Who gives real information as answers to security questions?_

Most people do. This piece doesn't really point out that people are a "weak link" (though they are) as much as it highlights that these "security questions" do not really add much security in most cases.

<comment><USER10> Well no, the point is not that security questions don't add security, it's that they _greatly subtract from_ security.

Sometimes security questions are used to augment a password, but in many cases, including the one given in the article, they are provided as an _alternative_ to a password, and one that's often much easier to guess.

</comment></comment></comment><comment><USER11> >>>The only thing left between me and winning the bet was the questions. I dropped them both subtly in a conversation, noted down the answers and to my surprise: they were both accepted.

Hoo boy. They should let us create our own security questions that can't be asked in everyday conversations. I never liked "Favorite pet's name" or "Best teacher's name" and the rest of them.

</comment><comment><USER12> Made me think of this social engineering scene from the movie Sneakers: <http://www.anyclip.com/movies/sneakers/passport/>

</comment><comment><USER13> I use gibberish answers to security questions. This way I don't need to worry who all know my mother's maiden name or my first pet's name. Staying safe is easy, if you know how to game the system.

<comment><USER14> I do the same thing. What good does it do me to have a secure password, if the answers to security questions are well known?

Of course, I learned this the hard way. I had an ex that was able to breach my email because she knew personal details to answer my security questions (of course this was back in Hotmail days circa 2001).

</comment></comment><comment> UVB-76 Security 101: Never answer security questions truthfully

<comment><USER15> Not a bad idea, but then you have to create some file with a list of your little lies. Then that file has to be encrypted and you have to remember the password for it. What was your childhood pet's name? _Did I answer this with 'Bob Saget' or 'Nosferatu'? I can't remember!_

<comment><USER16> Yes, I generate them at random, and keep them at my password database, right next to the actual password for the service.

That makes them absolutely useless, it's true. And it is the most usefullness you can extract from them. I'd throw them away, but lots of services make you anwser them once in a while.

</comment></comment></comment><comment><USER17> The main problem here is that a large amount of a consumer web service's user base are none technical, "normal", people who will in all likelihood balk at a more complicated authentication process unless they can really see the need for it OR it is implemented really well. Currently the best implementation is the card reader used by banks but that is a pain as you have to have it with you all the time (however it is protected people's money and so a certain level of pain is more tolerable in this instance). As a result most banks only use it for big stuff like sending money to a new account etc. I think only Barclay's use it for logon and it is a real PITA and made me leave them as a bank.

Santander use the "if you don't recognise the picture above then don't login" method which is stupid as if people don't login regularly then they will forget what picture they choose and login anyway.

<comment><AUTHOR> That's a very good point. Two factor authentication is the way to go IMO. It is a pain to have it with you all of the time, but what if it was just a simple little USB that you used to reset the password?

To login you need your password + your phone but to reset your password you need that USB with a unique fingerprint on. That way, I'd just keep it at home in some kind of safe.

<comment><USER18> I tried using google's two factor auth for a while. It was such a pain to have to unlock my phone and load the app every time I wanted to log in that I stopped using it pretty quick. When people are used to just loading their password manager up when they start their computer, sticking their more secure details into that, and then being able to log in to wherever with a click and a very short wait, sticking that sort of extra complexity in seems like a deal killer. Maybe for my debit card but... then it's worth going to a little extra effort for the security.

<comment><AUTHOR> Most accounts remember you've authenticated until you log out. That's never been a problem for me

<comment><USER18> It's cookie based. The system tries to put a cookie on your computer to stop you clearing your cookies at the end of the session. It's not meant to ask you to reauthenticate on every login, if you look at the help, it tells you that clearing the cookies is probably responsible.

More bother than its worth to me under those conditions, ought to be Ip based instead and kept server side.

</comment></comment></comment></comment></comment><comment><USER19> Reading this article, I'd say that the weakest link isn't "you" (or "myself"), but "others", to which the account providers tailor their (in-)security practices, and thus allow easy access to any account.

</comment><comment> guard-of-terra Passwords can't be safe. We have a fundamental problem with passwords that somebody got to fix by replacing passwords with something safe.

</comment><comment><USER20> I think now days you really want to have 3 factor authentication for e-mail. It is a gateway to just about anything you do online!

</comment><comment><USER21> Apple put some effort into fixing the password recovery vulnerability for AppleID's recently (i.e. a few months ago), vs. KBA.

</comment><comment><USER22> Here's a thought with respect to security questions/answers. Even if you designate random, password-like/quality answers, are those answers security hashed?

If not, you're nonetheless one DB dump or other undesirable access away from having your account pwned.</comment>


Angry IT workers: A ticking time bomb? - <AUTHOR> http://www.infoworld.com/article/08/09/22/39FE-IT-management-chasm_1.html

<comment><USER2> _"... It's the Captain Kirk school of management. Scotty says it's going to take 48 hours to fix the warp engines, Kirk says you've got two, and somehow Scotty gets it done. But the real world doesn't work that way' ..."_

In the Captain Kirk school of management there was a common enemy, objective and strict hierarchy of command. Kirk, Bones, Spock, Scotty. As a team they work well. Bones empathises, Scotty the practical, Spock logical and Kirk the emotional who inspires. The one time Spock the logical is left in command all hell brakes loose, cf: Series One, Galileo Seven ~ <http://memory- alpha.org/en/wiki/The_Galileo_Seven_>(episode) or <http://is.gd/2ZeI>

Organisations need leaders like Kirk to take into account the whole picture, the logical and illogical. Someone has to inspire, push and sometimes demand the impossible to hold-off the bunch of Klingon's breathing down their neck. Commercial companies are no different. They have to make profit even if it's Raman-profit. Another reason to be a founder and not a technical follower.</comment>


Yahoo removes dead blogger's site (despite him having pre-paid for hosting) - <AUTHOR> http://mashable.com/2013/08/16/blogger-suicide-60th-birthday/

<comment><USER2> site mirror: [http://www.ussolutions.net/martin/backup/index-2.html](http://www.ussolutions.net/martin/backup/index-2.html)

<comment><AUTHOR> thanks</comment></comment>


O2 (UK) defines unlimited – define:unlimited - <AUTHOR> http://billglover.co.uk/2015/01/04/6103

<comment><USER2> why would google use a telecom as source for a definition?

also, [https://www.google.nl/search?q="3.95GB"+site%3A02.co.uk](https://www.google.nl/search?q="3.95GB"+site%3A02.co.uk) doesn't come up with any results so i find this kind of hard to believe to be honest…

<comment><USER3> It's o2.co.uk not 02.co.uk. There is probably some HTML somewhere on the o2 site, perhaps in some terms and conditions that uses <dl> to define key terms pertinent to the document. It's plausible that GoogleBot simply crawled this, understands the semantics of <dl>, and took this as a definition of unlimited.

</comment></comment><comment><USER4> Hmm, O2 UK doesn't actually offer any unlimited data packages as far as I'm aware: [https://www.o2.co.uk/shop/simplicity](https://www.o2.co.uk/shop/simplicity)

This might still be real, but if it is then it's either based on an old tariff or another country's O2.

</comment><comment><USER5> I'd like all mobile internet adverts to have to specify in minutes the "fair usage".

4Gb is "unlimited" fair usage. That would seem less fair expressed as "35 minutes". *

Packages offering 250MB of 4G would seem pathetic when expressed as "2 1/2 minutes of internet".

*Average 4G speed is apparently around 15Mbps in UK.

<comment><USER6> They could just say "4gb" or "250mb" and reserve the words "unlimited" until they truly are. I'm on Three and use 20-25gb/mo. They say it's unlimited, but it certainly isn't limiting.

<comment><USER7> It can never be "unlimited" because there is always a limit to how much data you can transfer in a month, given a theoretical maximum bandwidth of x Mbps for 4G networks (actual achieveable transfer speed even less). The correct term is "unmetered".

<comment><USER6> Actually, yeah, that would be a better term.

</comment></comment></comment></comment><comment><USER8> In Portugal unlimited means 15GB... Not that we're any beyter for it, mind you. It's really just an arbitrary number.</comment>


NASA has no money for its human-spaceflight plans. The private sector has plenty - <AUTHOR> http://www.economist.com/sciencetechnology/displayStory.cfm?story_id=14401165

<comment><USER2> Personally I'd like to see NASA morph into an agency that supports the private sector somewhat in the vein of the FCC. Because there's another problem out there that no one's really talking about and that's the fact that private investors are working with very little oversight right now. Not a big concern for people yet but the first time a private space craft explodes on national TV it will be (unless we prevent that from happening up front)

NASA has no money but they have a lot of experience and the backing of the Government. The private industry has a lot of money but no experience or backing. So have NASA provide regulations and act as an agent for collaboration between private firms while private industry takes on the expense of actually launching manned space missions.

<comment><USER3> How about more like the FAA?

<comment><USER2> That's what I meant :)

</comment></comment></comment><comment><USER4> I just don't see the point of putting humans in space unless we're going to use them to build something permanent.

Asteroid surveying would be an awesome goal for NASA, something where the unit cost is low, it can serve as testbeds for automation, propulsion, and science, and we may very well hit the jackpot and find rocks with high rare earth contents.

<comment><USER5> _find rocks with high rare earth contents_

It wouldn't matter if you found a mythical space-goose which turned anything they touched into gold, you'd still lose money on the transport costs bringing the goose trash and returning with treasure.

<comment><USER6> Earth -> Space is fundamentally expensive. Space -> Earth is not; there's a lot of tradeoffs available to you to cut down price, mostly in exchange for receiving the goods later. You can bring an moderately sized asteroid to us reasonably easily, if getting to space was easy itself.

(And that is how you do it; bring the resources to us. I don't know what we could do that would involve carting atoms into space, getting them space- blessed, then carting them back to Earth.)

</comment></comment></comment><comment><USER7> But other than tourism and rapid transit (noted above, and not inconsiderable), what does private business have to gain in the short-to- medium term?

I'm thinking of the history of sailing and later aerial travel. It was expensive and risky, but this was considered worthy of investment because there were known destinations and thus opportunities for the procurement of fabulous wealth.

By comparison, space looks rather barren. There is commercial gain in launching satellites which allow us to communicate or observe things on earth more easily, but we've more-or-less automated that. Moving to the moon or Mars would be cool, but the moon is a total desert and Mars and Venus aren't exactly welcoming either - terraforming would be cool but is a truly humongous undertaking. Meantime, it's not like we see lots of asteroids zipping around bulging with desirable rare minerals.

I want to love the idea, but I don't really see where the business model is - the number of people who _need_ the speed offered by suborbital travel is really low, and we're quite a ways off from showing how it would be cheaper than atmospheric flight. Seems to me that a space elevator which did away with the need for expensive rocketry would be a much more attractive investment opportunity.

EDIT: to clarify, I think private sector + space = win. I'm just not sure where the _human_ spaceflight is a really big opportunity. The article seems to suggest that the best return would come from even cheaper satellite launching.

<comment><USER8> I completely agree. I think we're in for a very long wait. We over achieved getting into space and landing on the moon so quickly. (barely 50 years after air travel was a viable technology) I don't see a private industry for space travel unless a few things happen:

1) Earth's resources are depleted to the point where we need to harvest them from another planet. The situation would have to be VERY bad for us to get to that point. More likely than not it would be another dark ages for most of humanity with private space travel extracting valuable resources for the extremely rich & powerful.

2) Contact with intelligent life. It seems certain now this will not be in our own solar system so this raises the bar on the technology private industry would have to develop to travel so far. Very likely it would span the lifetimes of several generations of humans traveling to even a nearby solar system.

3) Over population on Earth becomes such a problem that a massive number of people are driven to taking the huge risk of re-locating to some underground colony on Mars. If you had 100 or 200 million people willing to relocate to Mars there would actually be a viable business model there I bet. (kind of similar to what happened with immigration to America early in the last century. It was expensive, dangerous, and life wasn't really that much better when you got there but the alternative was just so bad people were willing to take the chance)

So realistically I think we're probably hundreds, maybe thousands, of years away from the standard sci-fi dream of accessible human space exploration. LEO flights could be a profitable niche in the short term.

</comment></comment><comment><USER9> NASA should promote spaceflight and bolster technology innovations by offering tremendously huge prizes for companies that can overcome major obstacles, like lowering cost-to-orbit by a factor of a hundred.

They shouldn't be the space police, or the space bureaucracy, or the space experts.

If we were to reduce cost-to-orbit by a factor of a hundred, then you could launch satellites for a couple of hundred thousand dollars. You could have deep space telescopes for the cost of a new luxury airliner. It changes everything.

Whereas if we keep doing these one-off missions where we do this huge development effort and make no major breakthroughs, everything stays expensive for a very long time.

<comment><USER2> I'm not sure I see the incentive here. Follow my logic. A prize is valuable because it's something you couldn't afford yourself. If I offered $1 prize people probably wouldn't be too psyched about it because a dollar is something they could spare out of their own pocket.

The whole point of this article is that NASA doesn't have enough money to overcome the hurdles you refer to. So it stands to reason that companies would have to spend more to overcome the hurdles than the prizes themself would be worth.

Which is why I don't see how prizes would have any positive impact.

<comment><USER9> By offering a prize, a large organization can "pay ahead" the cost of developing, testing, and implementing a new technology.

Look at it this way: let's assume it would cost the government $20 Billion to reduce cost-to-orbit by three-fold, say through the use of hybrid-magnetic launchers or some such. But that $20 Billion would take 20 years and dozens of missions.

Instead the agency could offer a $10 Billion prize for any company that had three successive launches at one-third the cost in the next three years. Each year after that the prize would increase by $1 Billion.

Now, instead of one technology, pursued by one agency, you have a dozen possible solutions pursued by a dozen organizations. At some point the prize money is paid out -- arguably much earlier than 20 years but who knows? It's definitely not going to cost any _more_ money, and now _you've decreased cost- to-orbit of every other mission you ever want to have_. That means for every mission you have after the goal is reached, you've reduced launch costs by two-thirds.

Forever.

In addition, you're likely to end up with 3 or 4 technologies that all can reduce cost-to-orbit, all that are viable.

That's why reducing cost-to-orbit is such a critical goal. It's this huge productivity multiplier. Yes, you spend more now, but it makes all the other decisions easier (eventually). You quickly reach a point where lots of entities have the funds to do multiple missions using lots of new technologies -- a much better situation than continuing to pay more and more money for less and less return.

</comment></comment></comment><comment><USER10> For cargo, yes. But humans? NASA has spent decades trying to make space travel safe, and the shuttle is still one of the most dangerous ways to travel on a per-journey basis. NASA doesn't have to worry about turning a profit either.

It will be interesting to see what happens to space tourism after the first fatal crash...

<comment><USER11> Perhaps the same thing that happens after a fatal airplane or automobile crash.

</comment></comment><comment><USER12> Bill Stone says "I'm going to the moon -- who's with me (TED video):

<http://blog.ted.com/2008/08/archive_bill_st.php></comment>


Intel acquires Itseez, maker of OpenCV - <AUTHOR> https://newsroom.intel.com/editorials/intel-acquires-computer-vision-for-iot-automotive/ <comment><USER2> Congratulations to the team. Intel does not have a track record for excellent software unfortunately, but who knows, they seem to be quite serious about IOT.</comment>


Tech Boom or Bubble? Take a Look at the Data - <AUTHOR> http://feefighters.com/blog/ff_infographic/tech-boom-or-bubble-lets-look-at-the-data/

<comment><USER2> Just going through A Random Walk Through Wall Street right now, and there's no doubt that, by the tone of that book (and specifically Robert Shiller's quote of a "positive feedback loop), we _are_ in a bubble.

The questions really ought to be:

1 When will it burst

2 How hard will it burst (I think this'll be the main difference with the dotcom bubble)

3 Which companies will come out of it</comment>


Do you aim for 80% code coverage? Let me guess which 80% you choose - <AUTHOR> https://dev.to/d_ir/do-you-aim-for-80-code-coverage-let-me-guess-which-80-it-is-1fj9 <comment><USER2> > If you leave the most difficult 20% untested, then you are building a knot > of spaghetti code.

This is backward. You don't leave code untested because you're writing spaghetti. You leave it untested because you _wrote_ spaghetti, past tense. If you're still writing spaghetti then your commits are most likely lowering code coverage, not raising it.

If you're above 80% and climbing, there's a good chance that new code is being written at a higher standard. But as the project grows, a new block of code with 98% coverage does less and less to move the needle.

The main exception being the person who can't seem to realize when they have confused themselves. You know the one. Tries to do everything the hard way and fails because they don't possess enough surplus clever to do things the hard way.

But they are also the sort that manages to somehow get full coverage without asserting anything important.

</comment><comment><USER2> I aim for 85% coverage because everyone I've ever seen try to go from 20% coverage to 100% coverage has been caught lying, either to themselves or to me.

There are many ways to confuse the coverage metric collection. They have gotten much better but they are not perfect.

Code with zero tests is trivial to discover. The task list practically writes itself. You can grab a random one and just start testing it. But once code looks as if it has tests, the cost of discovering that it doesn't is high, either in hours expended, or public discovery by customers.

I'd much, much rather have an honest 82% than a bullshit 99.

And the thing is, you are going to be better at writing tests later than you are now. Why rush to produce all the tests while you are still comparatively lousy at it?

</comment><comment><USER3> I've used this metric but intelligently - I've used tools to SEE what is covered or uncovered.

Simple constructors or accessors that end up not getting coverage are fine, I believe you can see that you have little risk in not writing test for them. If you're shooting for package-level tests and you have no separate tests for POJO's (in Java) - little risk there.

But if you see a big section of exception handling that has not been tested -- that's a sign of a risk. Test that stuff.

</comment><comment><USER4> Disagree. To most companies, maintaining development speed while catching the majority of bugs is more important. Everyone wants 100 percent coverage but it's often a trade off that doesn't make business sense.

</comment><comment><USER5> These are just numbers tech managers throw around to look good to their superiors. Just hire really good engineers and let them decide what's best.</comment>


Ask HN: Looking for info on server that has a phone number and receive call - <AUTHOR>

Here's my requirement: I want to run a server preferably on linux that has a number to which a user can call and talk something and get his message recorded for later use. As I expect my number of users to be high, I want the server to handle multiple number of call connections from different users.<p>Can someone suggest a good way to get this done? Is this what call center softwares are about? <comment><USER2> Unless you have a very, very, very high tolerance for pain, you should be using Twilio. It abstracts away the entire telephony piece of that puzzle and lets you interface with it using, basically, standard web programming tricks, callbacks, and REST APIs. You don't have to worry about phone lines, concurrency (except as relates to a web application), etc.

Acceptable alternatives on the same model include Tropo and Plivo.

If you're dead-set on running your own telephone equipment, then get a book on Asterisk and may God have mercy on your soul.

(Context: I'm a boring ol' systems engineer who runs several hundred users sending thousands of messages a day from an only modestly complicated Rails app which uses Twilio. Up until a few days ago it fit comfortably on a 2 GB VPS. We use Twilio to provide users with numbers that they can call in and record messages on, and then we do interesting things to those recordings and then repurpose them in a scalable fashion.)

<comment><AUTHOR> Wow.. Thanks for the very useful info. I'll look into the Twilio and Plivo. Is the service anyway location-dependent because to my web-app, I'm expecting calls only from India and so, I don't want my users to call an international number. Will it be an issue? I'm assuming the answer to be a no because Twilio runs on AWS which must make it location-independent.

<comment><USER2> You can buy Indian numbers with Twilio and make/receive voice calls and text messages. (See their site.) After the call hits the Twilio infrastructure, it is as location-agnostic as any other application interacting with APIs on the Internet. (One thing I do with Twilio is forward calls made to a US number to a Japanese number after doing trivial processing on them. My app runs on a server which happens to be somewhere in the vicinity of Chicago, not Japan.)

I'd assume things are roughly similar for Plivo/Tropo but I don't use them.

<comment><USER3> All true but you not yet buy India numbers from twilio [https://www.twilio.com/voice/pricing/in](https://www.twilio.com/voice/pricing/in)

So you can call India but not receive calls on a local number

<comment><AUTHOR> Thanks for the info. Actually, I just want to receive a user's call to a number and record his message. So, I guess Twilio is the answer.</comment></comment></comment></comment></comment>


Weight Loss Is Harder Than Rocket Science - <AUTHOR> https://www.wsj.com/articles/weight-loss-is-harder-than-rocket-science-11580396067 <comment><USER2> I didn't find that this article stated much that was worthy of discussion, but here are some random thoughts on the general topic:

A large number of our decisions are based on maximizing convenience while moderating cost. Foods, especially convenient foods, are engineered to sell and addict. It's hard to maintain a healthy weight and body composition in a modern world without some effort. I also think that the body is particularly good at resisting change. It appears that if you've been overweight for a while, the difficultly of losing extra weight increases dramatically. And the toll on your health over time in terms of probability of disease is real.

I have never been particularly overweight, but I am aware of what I eat, and I do weigh myself on a regular basis to ensure I stay within a somewhat arbitrary range. The exercise part of the equation is easy for me to fulfill because I naturally enjoy exercise, though some injuries have tested my ability to stay active at times.

Preventing excessive weight gain is very important to long-term health.

</comment><comment><USER3> Weight loss is hard because it requires deep lifestyle change and deep lifestyle change is most certainly harder than any science.

<comment><USER4> I'd add that lifestyle change is hard(or not) because is subjective to oneself experience of life.

</comment></comment><comment><USER5> It's simple in theory: Eat less than you need.

But the problems that can arise are manifold.

I don't know if there really is a maximum of calories your body can use per day, but I read the number of 65000 kcal once.

This means, a "cheat day" or simply loosing control one day a week, can destroy all your progress.

A calorie delta that is too high can easily lead to such losses of control, especially if you are easily stressed.h

So you try to get a delta of around 500kcal a day, maybe 1000kcal if you can handle this. But how do you know what you're using a day? There are many methods to find out and they can be off more than 500kcal, so it could very well be that your actual delta is much higher or lower than you think. So you're either making really slow progress or can't keep it up for the months you'd need to.

</comment><comment><USER6> I don't know where I read it but this to me is the crux of the whole situation:

"If you hate having to burn off those extra calories, don't put them in your body in the first place."

By having a rough idea of what burning off off (say) 300 Calories takes in physical exercise, and what the Calorie-content of your foods are, you'll find it easier think of what you're eating in terms of hard work. A sushi roll is roughly 200 Calories, or 30 minutes hard work.

The choice then becomes - "Would you rather have that sushi roll? Or would you rather have to work out strenuously for 30 minutes? Choose now!"

</comment><comment><USER7> If you are interested in a simple primer on the chemistry and biochemistry of weight loss, check out this episode of ABC (Australia) Catalyst:

[https://www.abc.net.au/catalyst/where-does-fat- go/11015048](https://www.abc.net.au/catalyst/where-does-fat-go/11015048)

The overall balanced equation is quite simple, showing fat molecules convert to CO2 and H2O. It shows quite clearly that you have to breathe oxygen in and carbon dioxide out in order to lose weight. I guess this is why high intensity exercise or endurance exercise aid in weight loss - in both cases you are elevating your breathing while at the same time exhausting your muscle glycogen stores.

</comment><comment><USER8> If weight is proportional to volume and not area, then it should be a function of height cubed, not height squared. This is why I came up with CBMI -- the cubic body mass index. Just take your height in feet (expressed as a decimal, so that 5'6" = 5.5') and cube it. That's your ideal weight. Much simpler and much more forgiving than BMI.

</comment><comment><USER9> Surprising it doesn't mention waist to height ratio which is more accurate to me. I had a normal bmi but I was clearly overweight using the waist to height ratio. Not perfect but better in my opinion than bmi [http://www.bmi- calculator.net/waist-to-height-ratio-calculat...](http://www.bmi- calculator.net/waist-to-height-ratio-calculator/)

<comment><USER10> How about just body fat percentage?

<comment><USER11> It is difficult/expensive to calculate accurately.

</comment></comment></comment><comment><USER12> You can get a "Resting Metabolic Rate Test" that takes 15 minutes. That will tell you the base calories you need to maintain current body weight by measuring the amount of oxygen your body burns while breathing. I think I paid less than $100 for this.

You can also get a Dexta scan that tells you your body body composition, how much fat, how much muscle mass. I think I pay $70 every scan and get one a couple of times a year. You can use this data also to calculate estimated required calories, body composition, are you loosing fat/muscle and gives data to change diet accordingly.

You only need to be in a small 300 cal deficit to loose weight. If you want to maintain muscle mass and drop body fat it's better to be in the smallest deficit possible and this will also reduce hunger.

If you want to loose body weight quickly and maintain muscle that's hard! That does require a bigger calorie deficit by reducing food, and increasing activity (cardio) to burn more while getting macros exactly right to hold on to as much muscle as possible although you will loose muscle. Bodybuilders are experts at this, they pile on weight during the off season so they are in a calorie surplus so they can gain muscle then diet down to single digit body fat percentages trying to hold as much muscle as possible.

Everyone talks about loosing weight but you can not weigh much and be fat aka skinny fat and unfit. Alot of 'slim' people will fit in to this category unless they have an active lifestyle.

The modern normalized diet is terrible. It's carb / sugar heavy. There's nothing wrong with carbs you need them but people are eating far to many of them while not burning them and everything is sugar heavy which your body naturally wants to eat more of.

My girlfriend has mental health issues and over the past few years has become morbidly obese which causes bigger and bigger issues as I eat my veg, carbs, protein mainly whole foods. I weigh the quantities, look good, in great health medically etc. I eat well, 3500+cal a day as I burn it off with lifting weights and doing cardio.

On the other end she eats complete rubbish, sugary comfort foods, lots of fruit as it's good (high sugar), lots of full fat milk as it's good, lot's of olive oil as it's good for you, and now morbidly obese and still gaining, high cholesterol, deteriorating mental health yet somehow I'm the one with the eating issue as I watch what I eat as I eat mainly for performance, going to the gym after work most evenings isn't normal and shouldn't have to do it. She wants to loose weight but doesn't want to put in the work, she sees the stuff she's eating as normal, doesn't want to sacrifice them and sees going to the gym as abnormal. She's right the gym is abnormal in the sense it's replacing the active activity we used to do before sedate lifestyles but it's not abnormal to make your body exercise it in a way no longer doing sat at desks all day.

</comment><comment><USER13> Anyone got a non-paywall link? Incognito mode doesn't seem to work.

<comment><USER14> Paste this into the console. It will redirect you to Facebook and then back to WSJ without the paywall.

(Remove the space after ".com", kept link shortening without it)

javascript:window.location.href='[https://m.facebook.com](https://m.facebook.com) /l.php?u='+encodeURIComponent(window.location.href);

</comment></comment><comment><USER15> A preview of coming attractions in this thread:

\- Weight loss isn't hard, just eat fewer calories than you burn.

\- Keto will obviously make you lose weight!

\- I lost N lbs by meditation and intermittent fasting!

\- Being hungry sucks.

\- Anybody can do it, this one trainer put on 100 lbs, and then took it all off again!

\- Being fat is just another sign that you're lazy.

\- It's sugar's fault! (Alternatively: It's artificial sweetener's fault!)

\- A vegan diet will make you lose weight.

I'll get us started: Being in a caloric deficiency for weeks or months is one of the most miserable experiences you can have. Constant hunger, no energy, always hangry... Yeah. Being hungry sucks.

<comment><USER16> Weight loss might be hard, but it absolutely is not complicated. Perhaps the metabolic processes are, but it does really boil down to calories in/calories out, and absolutely no amount of contrivance can change that.

Life is also typically full of adversity and hardship, and managing weight is a hardship that all people share, regardless of their status. Perhaps "lazy" is a bit reductive, and everybody's circumstance are different, but if somebody is overweight, the solution is simply to put in the effort that somebody who is not overweight puts in every day.

<comment><USER17> > Life is also typically full of adversity and hardship, and managing weight > is a hardship that all people share, regardless of their status. Perhaps > "lazy" is a bit reductive, and everybody's circumstance are different, but > if somebody is overweight, the solution is simply to put in the effort that > somebody who is not overweight puts in every day.

"Effort" isn't quite enough here: a huge factor is lifestyle related and many people have significant barriers which are hard to change: moving to a neighborhood which makes walking/biking/transit viable is often an expensive choice and almost always disruptive. Most of the 20th century was spent getting people to sit in cars, at desks, etc. and it's not trivial to change that.

<comment><USER16> > moving to a neighborhood which makes walking/biking/transit viable is often > an expensive choice and almost always disruptive

Pretty weak excuse tbh. You don't need a gym membership or a scenic park across the street to get enough exercise into your day. There are valid reasons to reserve judgement, but this isn't one of them. Mental health arguably is. Poverty can be in a couple of ways. The cheapest food is often very unhealthy, and if you're working for 16 hours a day then you likely have less opportunity to eat healthily (for example look at how ~60% of nurses are overweight, compared to ~40% of the general population). But for most cases, the key personality difference between an overweight person and a healthy weight person is laziness.

</comment></comment></comment></comment><comment><USER18> "But rocket science is arguably simpler than weight loss, in the sense that it involves less unpredictability and variation. We control how rockets are made, and they don't change their material composition over time."

The composition of rockets _do_ change over time. Small fractures, corrosion, wear-and-tear from reuse, and manufacturing defects can have catastrophic consequences. The exposure of O-rings to extreme cold, leading to the Challenger disaster, is one example.</comment>


The Anatomy of a Monster Truck (2003) - <AUTHOR> https://www.thefabricator.com/article/tubepipefabrication/the-anatomy-of-a-monster-truck <comment><USER2> My son would love to learn about this.</comment>


Australia's Atlassian – a startup headed for a billion dollar IPO - <AUTHOR> http://www.businessinsider.com.au/atlassian-the-untold-story-how-two-australian-young-guns-built-a-company-headed-for-a-billion-dollar-ipo-2014-2

<comment><USER2> It's interesting that their top value is "Create useful products that people lust after"

I've never particularly liked any of their products. My experience with Jira & Confluence made me want to scratch my eyes out and I only use Bitbucket because their free unlimited private repositories was what I needed as a freelance developer.

</comment><comment><USER3> How is Atlassian a "startup"? They've been around for a while now. I think people need to rethink the term startup.</comment>


Facebook forces user to use messenger on mobile site - <AUTHOR> WTF is wrong with the world. I don't want to install Facebook app and I don't want to install their messenger.
I just want to use it in my browser. I know it's 100% possible because it used to work.
Is that too much to ask for? <comment><USER2> It would be interesting to know why this seems, from Facebook's point of view, too much to ask for. Are they collecting data directly from the phone that they otherwise wouldn't be able to? Is there some other kind of integration with payment services that they're planning?

I know that I've been getting a lot of "So-and-so has invited you to Facebook Messenger." I installed Messenger the other day on my iPhone. It asked me for all my contacts, and I deleted it then, straight away. It looks like you install it, grant it permission, and then it spams everyone you know. That's not cool.

</comment><comment> sebastian-heinz you can switch to 'desktop view' in most android browsers, allowing you to use the fb web messenger. i know its super annoying but the only way around tho.

<comment><USER3> That's what I have to do. Super annoying indeed.

</comment></comment><comment><USER4> Messenger view on mobile has unexpectedly started working for me over the past week or so. No changes that I'm aware of, I'm not in desktop mode, and it was definitely redirecting to the app store before.

Has anyone else noticed this too? Any speculation on what might've changed?

</comment><comment><USER5> It's not the answer you are looking for but you can install Slimsocial for Facebook - where it works.

</comment><comment><USER6> It has been like this for me for months. I just stopped using it except at a Desktop.</comment>


Ask HN: Do you plan on investing in Facebook? - <AUTHOR>

I've read a variety of perspectives on Facebook's IPO but I'm curious to hear the mindset of the HackerNews community.  Do you plan on participating in the Facebook IPO, or to buy their stock in the days following the initial offering? <comment><USER2> $100 billion valuation on $4 billion/year revenue(not profit)? No thanks, I'll pass. For perspective, Apple's $570 billion value is with $100 billion/year revenue

<comment><USER3> Growth in revenue is actually more important. If the p/e ratio is 20 and the growth in revenue is 25% each year, then its fine! (Source: Peter Lynch)

"The profit was $1 billion in 2011 and $606 million in 2010. The p/e-ration is then about 75 to 100. Peter Lynch once said that one should buy a stock if the p/e-ratio is lower than the growth in profit. The growth in profit for Facebook was 65 percent from 2010 to 2011. So the valuation is a little bit high"

</comment></comment><comment><USER4> no way. it's gonna be the second myspace.</comment>


13,500 Vivo Smartphones found running on same IMEI number - <AUTHOR> https://androidrookies.com/a-whopping-13500-vivo-smartphones-found-running-on-same-imei-number/ <comment><USER2> This is actually good. IMEI is a unique number that can identify each device. And is huge privacy issue as it can be used against the user, can individually track each user.

IMEI is not required when placing calls or transferring data since this is securely managed by the GSM chip.

<comment><USER3> Are you sure this would not cause problems if two devices with the same IMEI were on the same tower, or even same provider? It might look fishy having multiple dups floating around on your network.

If one of these devices gets IMEI blacklisted, now all 13.5K devices are blacklisted... Not so good.

<comment><USER4> Providers issue SIM (subscriber identity module) cards to uniquely authenticate subscribers to their network. Why do you need something that is constant across SIM cards? It's superfluous identifying information (GDPR wants a word!).

<comment><USER5> Anti-theft. The device itself needs an identifier, so that if someone steals _your_ device—immediately turning it off, re-flashing the OS, and putting _their_ SIM in it, before booting it back up—then the network will still have some identifier to recognize the device itself by, so that it can say "nope, that's stolen" and refuse to let it onto the network (thus disincentivizing stealing cellphones in the first place.)

I believe network-IMEI-registration isn't the primary mechanism by which modern phone anti-theft works by, though, since the device-owner is free to change the phone's _network-reported_ IMEI (much like you can change an Ethernet controller's _network-reported_ MAC address.) I might be wrong here, though; the phone's baseband _might_ come up with its burned-in IMEI and check for validity with the server, _before_ switching to any application-processor- requested IMEI. (You can get around _that_ by just booting up the phone in a Faraday cage—but having to do that every time would definitely decrease the black-market resale value.)

For iOS, at least, I think the anti-theft works by getting onto wi-fi each time the SIM changes and asking some activation server about the validity of [some other internal static device-ID that can't be tampered with in this way]. Not so sure what, if anything, Android does (Android's case is harder, since for phones with an unlocked bootloader, you can always flash an altered firmware that _has_ no anti-theft logic.)

<comment><USER6> The same anti-theft argument could be used to justify building surveillance tech into any object, and yet our society seems to function just fine without it. I've never had my phone stolen, and I don't know anybody who has even just _lost_ their phone more than once. Yet we all get tracked _every single day_ due to this user-hostile design.

Also for most phones it's trivial to change the IMEI to resell the phone, or simply part it out. Which sure, are more things manufacturers see as bugs, to the frustration of legitimate activity - hence Right to Repair. The majority of the world is honest. Let's not build ourselves into a prison just to fallaciously protect against the few who aren't.

<comment><USER5> > I've never had my phone stolen, and I don't know anybody who has even just > lost their phone more than once.

Errr, to be clear, the _reason_ that phones don't get stolen is that there _are_ anti-theft measures in place.

People steal similar types of item (e.g. car stereos, game consoles, Blu-ray players) _all the time_. There's no reason _other than anti-theft measures_ that phones as a type of item would be stolen any _less_ than these other categories. (They'd actually be stolen _far more_ , since they're small/easy to slip into one's clothes/not a weird thing to be carrying around; and are often found just left on tables at cafes or hanging out of people's back pockets. They're like cash, basically.)

It's the same reason that people steal bicycles more often than they steal cars. Bicycles, despite being worth much less, are just _much easier to steal_.

> The majority of the world is honest.

Do you live in a city? I've had my bicycle stolen _five times now_. I've also been mugged twice. I've never had my phone stolen, though—because it's worthless to the sort of dumb criminals who steal things just to hawk them on the street, rather than to fence them.

It doesn't require a large fraction of the world to be dishonest, to result in most people in the world having crimes committed against them. A thief will steal from far more than one person in their thieving career. Especially in regimes where the computed ROI for going after certain types of thief (e.g. homeless, drug-addicted thieves) is negative (i.e. their prison housing costs society more than their thieving does, apparently), and so they're never held for more than a day or two.

<comment><USER7> Trust me, the #1 reason why phones don't get stolen is because they are physically difficult to steal. If a well-connected thief steals your phone (and there are a lot of well-connected thieves), they will not have much of an issue getting them sold. Then the phone will either be parted out or flashed out of any anti-theft, depending on market demand.

<comment><USER5> There are two types of thieves: thieves that operate as part of a professional thieving ring; and thieves that operate alone, intending to directly hawk/pawn/trade/use what they've stolen.

 _Most_ thefts are committed by thieves who operate alone. (This is verifiable at least for my own country; I asked a crime-statistics analyst friend of mine.) Thus, most deterrence is focused on deterring the thieves who act alone.

This is the same reason that "security locks" aren't actually proof against professional thieves. They're not _meant_ to deter thieving rings; they're just meant to deter the thieves who are acting alone. Such thieves might have watched a tutorial or two on YouTube on lock-picking, and they might have picked up a lock-picking set from AliExpress; but they don't have (and aren't willing/able to invest in) the sort of lock-picking skills/tools that professionals have (e.g. slide-hammers, impact drivers, etc.) so an average security lock will be enough to stymie them.

Same with clubs on cars: no proof against professional thieving rings, but good enough to make a thief acting alone look elsewhere.

Just like there is a qualitative difference in how people treat things that are "free" vs. "$0.01", there is a qualitative difference in theft rates between "no security" and "trivial security." Most property crimes are spur- of-the-moment, committed by people who didn't come prepared to steal something, but just see an opportunity to take something and feel the need to have it. Put a trivial barrier in the way of taking things, and those spur-of- the-moment crimes committed by "amateur thieves" go away.

<comment><USER7> Sure. But in my experience, all it takes is for you to know a guy that knows a guy and it's done. The type of people in the socio-economic situation that makes it so that they would steal phones often leads them to have that kind of contact.

In any case, maybe that is not so much the case in the US. But this certainly is the case in Europe; a very, very large percentage of stolen phones are sent to facilities that will part them out or unlock them.

It also is true that someone selling a locked phone on Kijiji is likely to end up selling it to someone who has the skill or who knows someone that can unlock it.

<comment><USER5> > a very, very large percentage of stolen phones are sent to facilities that > will part them out or unlock them.

But again, that's post-hoc statistics. You're looking at the world that already _has_ the trivial disincentive against amateur thieving. So of course you'll see most stolen phones being stolen by professionals—the amateur thieves are already not bothering, so if a phone is being stolen at this point, it's being stolen by a professional thief!

In a world _without_ that disincentive, the statistics would skew very differently.

I again compare to the market for stolen bicycles. Yes, there are professional thieves with "bicycle chop shops" et al. But there are also crackheads carrying around bolt-cutters who just want to take a bike they walk by, ride it back to the ghetto, and then sell it for $20 to a street passerby to buy their next fix. Most cities have a large bike-theft problem, and it's mostly from _this_ kind of thief, not from professional thieves. Any "security bike lock"—i.e. any bike lock you can't just snip through with bolt cutters—stops this kind of thief.

Look at New York City, for example. There are two types of bikes in NYC: those with security locks, and those that get stolen the instant they're left alone for ten minutes. The security lock wouldn't deter a professional thief—but a professional thief _prioritizes_ , stealing fancy bikes from e.g. university sports department bike parkades, and won't bother with your average commuter bike. The crackhead does not prioritize. They just want $20, and your bike is probably worth $20.

<comment><USER7> If you are a crackhead, the economics of stealing a cellphone are already very poor. It is much more profitable to steal peoples' bicycles or even copper tubes than it is to steal a cellphone, because stealing a cellphone is a pain in the ass since it's almost always in your pocket.

The selection process for phones is already there: unless you are a _very good_ thief, you're not stealing cellphones. That's because realistically your two ways of stealing a cellphone is either skillful pick- pocketing/misdirection, or muggings. Now if you're a crackhead, mugging people is not a very good idea for obvious reasons, and the subtler ways of stealing a cellphone _already select for experienced thieves_.

The number one reason why bikes are stolen so much is not because they are easy to steal, it is because there is essentially no risk of getting caught. No one will give a shit if you're stealing a bike, and so even professional bike thieves will simply pop your lock with a Ramset gun without a care in the world and be on their merry way hours before you even notice. Whereas stealing a cellphone, unless very skillful, requires direct confrontation, which is not an issue.

>But again, that's post-hoc statistics. You're looking at the world that already has the trivial disincentive against amateur thieving. So of course you'll see most stolen phones being stolen by professionals—the amateur thieves are already not bothering, so if a phone is being stolen at this point, it's being stolen by a professional thief!

I seriously disagree for the reasons I outlined above. The kind of people that would steal phones are the kind of people that know how to offload it. Again, maybe this is different in the US, but _anyone_ with shady friends here could figure out how to fence a stolen phone. It's really not nearly as exclusive as you might think. I personally know two people I could offload a stolen phone (that I entered into contact via my elementary school of all places), and I am very, very, very far from being the kind of person that needs to steal phones in order to subsist. The hardest crime I ever did was to give my friend a USB key with mp3s of Akon in 2011.

And even if it wasn't the case, do you really think a crackhead would not try to steal a phone anyways? Of course they would, and they could probably figure out a way to fence it for 20$ or so. They just don't want to because stealing something that is either in your pocket or in your hands 24/7 is way too much risk for way too little reward.

</comment></comment></comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER8> Well, probably this was the result of some corruption in a parameter in the flash. On the early days of the Samsung Galaxy phones if you broke part of the efs partition the modem couldn't read the IMEI and would fall back to a generic one. This looks quite the same

Though with 13000 devices affected either it was a problem in manufacturing or someone in the Service Center was not doing the job too well...

<comment><USER9> I've done "First Articles of Inspection" (FAI) for Pixel phones at the factory where they're being made. Basically take the very first handful of devices off the line after software provisioning and run them through a litany of software checks, including that the IMEIs are unique. Then we do this for another bunch of random samples. The factories are unique experiences.

Hard to imagine for me how this could have happened. I don't know precisely how IMEIs are provisioned or stored, but I suspect they can be changed in software.

Trying to sell a used phone on line is tricky. Legitimate buyers may want the IMEI to check it's not a reported stolen phone. Illegitimate buyers may want a known good one to replace one on a reported stolen phone.

Carriers can blacklist IMEIs from their network (that's a threat they use for certification; they want to make sure families of devices are well behaved).

One of my phones was blacklisted from a carrier a few years ago. They said it was reported stolen. I brought them the receipt; I bought it new in box. They said it was reported stolen by a carrier in a foreign country. I'd been there, maybe ten years earlier, and never with that phone. The local carrier I was a customer of said they couldn't remove the block, since it was reported stolen by a foreign carrier. Seems fishy how carriers work together to ban IMEIs but do nothing to verify reports of stolen devices.

I'm not sure carriers would ban this IMEI if it's tied to 13.5k phones, but I'm sure they're not happy.

</comment></comment><comment><USER10> If you buy cheap Bluetooth OBD-II dongles, you'll find they all have the same addresses. That's why you can't buy two dongles and use them in two cars without re-associating each time, for instance.

If you buy the $150 dongles, they have valid addresses like you would expect.

</comment><comment><USER11> Picking a fight with a national telecom regulatory authority from a country other than your own seems like a poor business choice. Their customs people will seize all your products and Boston Tea Party them. They'll probably keep doing that even after you fix the problem.

I wonder: is there a dialect of English in India in which this post follows rules of grammar? I found it uncanny-valley hard to read.

<comment><USER12> Nah It's just poor grammar.

</comment></comment><comment><USER6> Very nice! I presume the phones still work too, otherwise this would have been caught much sooner. The existence of the IMEI is, at this point, a deliberate security flaw that has been pushed onto us by governmental standards bodies, and cemented into law. A secure mobile protocol would not have fixed identifiers, and would instead identify endpoints with a nonce that rotated over time and base station.

<comment><USER7> Indeed. There is no valid technical reason for IMEIs to be unique, except for already very tenuous anti-theft perpetuation which is really a very minor factor.

<comment><USER13> Not to forget the surveillance stingrays. They (and dragnet data fishing) become useless with rotating device identifiers.

<comment><USER14> Stingrays tend to capture both IMEI and IMSI. This is GSM, which is used by 99% of the world.

IMSI then can be taken to the carrier and the account holder details will be released by a warrant.

An IMEI (which in most countries it will be illegal to change/clone) only identifies the hardware.

So swapping SIMs between phones don't help to do anything apart from identifying a number of phones that you have access to.

3/4/5G phones will always drop back to 2G if it sees a 2G service whilst 3/4/5G frequencies are jammed.

So you need to realise that phones by design are tracking devices, and stock up on those burner phones and never switch them on near your home :)

<comment><USER7> In truth though, it is not very difficult to get a hold of an IMSI that does not refer to you, via an anonymous SIM cards you can get a hold of a few different ways. And it is not very difficult to find the maintenance service menu of your phone and disable everything except 4G and 5G either. However, it is much simpler to just leave your SIM card at home and use other means of access :)

<comment><USER14> Not all phones have access to baseband controls, and I've never seen a "turn off 2G" option, but yes you can turn off 3/4G.

It's easy to get a burner phone in some countries, but many you need a passport or government-issued ID to even get a prepaid SIM! Let alone a phone!

Governments really don't like citizenry to be anonymous.

<comment><USER7> For example on my LG V30, I can go to the dialer and enter :

        *#*#4636#*#*

I can then go into "Phone info" and set the radio to "LTE only" or "LTE/WCDMA", and if there is no 2G/3G/etc... I will not be have any service. [1]

This also works for most android phones, with small exceptions.

[1] : [https://ibb.co/JvZVHXF](https://ibb.co/JvZVHXF)

<comment><USER14> Also there's other ways of leaking your IMSIs, EAP-SIM and carrier wifi for example.

No idea yet how widespread the implementation is as I'm teaching myself all of this in my spare time!

<comment><USER7> EAP-SIM and Carrier WiFi is also not very difficult to disable. In any case, an IMSI leak is not as bad as an IMEI leak.

<comment><USER14> Also ... define "not difficult to disable" when it's not exposed in the UI.

A *# code doesn't count here also ;)

<comment><USER7> For me, not difficult to disable means that it takes less than 15 minutes to do so. difficult to disable would take hours and require specific knowledge.

</comment></comment></comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER15> Isn't that some high level kind of fraud? At the same time, I think it would easily be caught, so I'm a little confused if it's incompetence or maybe a mistake?

Does that mean they bribed somebody working at a factory? I'm not sure what could be gained by this. Having an "untraceable", replaceable phone? Wouldn't those be easily blacklisted once it's discovered?

</comment><comment><USER16> Soo what happens if someone reports this IMEI as stolen? Does it take down 15300 phones?

</comment><comment><USER17> Do we really need IMEI or SIM Cards? \- Some countries use IMEI for tracking & disallowing certain phones bought in some other country \- SIM Card also seem to just create problems to people.

<comment><USER18> IMEI is only needed if you want to track hardware. Physicals SIMs are not needed (and eSIM is a thing now) but some form of the "Subscriber Identity" part of SIM is needed unless you are operating the carrier for free to all with a phone.

</comment></comment><comment><USER19> Not surprising; This isn't the first time a hardware manufacturer has screwed this up.

At a mobile game dev company we had a hardcoded list of bogus IMEI numbers. If a device returned an IMEI that was on the blacklist, we'd use another method to identify the device.

</comment><comment><USER20> another programming assumption gone.</comment>


Notes board - <AUTHOR> http://boardtastic.com/

<comment><USER2> Interesting. But I was a little sad when I realized it was Flash.</comment>


Type I and Type II Errors: The Inevitable Errors in Optimization Experiments - <AUTHOR> https://utm.io/uuIl <comment><USER2> I'm reminded of this apt tweet [1]

> _If a Type I error is a false positive, a Type II error is a false negative, > and a Type III error is getting the right answer to the wrong question, is a > Type IV error GIVING IMPORTANT CONCEPTS NUMBERS INSTEAD OF NAMES FOR NO > GODDAMN REASON AND CONFUSING GENERATIONS OF STUDENTS_

Also, I find the Confusion Matrix[2] to be a helpful reference, especially the multi-colored table with formulae for each condition.

[1] [https://twitter.com/mjskay/status/1201380151356989440](https://twitter.com/mjskay/status/1201380151356989440)

[2] [https://en.wikipedia.org/wiki/Confusion_matrix](https://en.wikipedia.org/wiki/Confusion_matrix)

<comment><USER3> To highlight the persistence of the confusion compare the confusion matrix in two wikipedia articles: [1] and [2].

[1] [https://en.wikipedia.org/wiki/Confusion_matrix](https://en.wikipedia.org/wiki/Confusion_matrix)

[2] [https://en.wikipedia.org/wiki/Pre-_and_post- test_probability...](https://en.wikipedia.org/wiki/Pre-_and_post- test_probability#By_predictive_values)

(In case edits are made one way or the other: both articles display similar confusion matrices but disagree on the names of the off-diagonal elements. In [1] false positives are called "type I errors" and false negatives are called "type II errors". In [2] false positives are called "type II errors" and false negatives are called "type I errors".)

(Edit: layout)

<comment><USER4> I _hate_ the number naming system. I have no idea why anyone would find it preferable to use them for literally any reason. Specificity and Sensitivity already almost mean the right things in common language already, they are perfect words for this. The only use for these is to confuse people so they don't realise you have no idea what you are talking about.

I think some people struggle to grasp that these are actually strict mathematical concepts. But personally, that makes me feel comfortable with them. It is a lot easier to get a math concept consitently right than some of the fuzzier concepts in epidemiology.

</comment></comment></comment><comment><USER5> It is funny that although I have published peer-reviewed papers about evaluation of ML models and could probably discuss with you about many nuances of the process if you woke me at 3 AM, I always find it difficult to remember which of [Type I, Type II] is false positive and which is a false negative. If I have this problem I suppose almost everyone has it.

I wish people stopped using [Type I, Type II] when we can use clearly superior terminology. This feels to me very similar to amateur software engineers using non-descriptive variable names.

<comment><USER6> This is exactly my experience. I have never known what type the error I was talking about was...

Imagine calling (for instance) type I groups those which are abelian and type II those which are not... And then not being a professional mathematician. So is xy=yx here? Mmmmhhh type I says yes or was it no?

<comment><USER7> I have the same problem with specificity and sensitivity. Always have to look up the damned terms even though I've used them countless of times.

<comment><USER4> They mean what they would mean in common english.

Specificity because "how specific is the test? Does it measure the true positives correctly without getting a whole heap of false positives as well?" You might ask someone to be "more specific" about something so they aren't including irrelevant things in their discussion.

Sensitivity because "how sensitive is the test? Does it detect the needle in the haystack you need to find? How many does it miss." In common english you might complain that your car brakes are too sensitive - they are too quick to register the pressure from your foot.

Don't forget these are actually strict mathematical concepts. Hope this helps clarify :)

<comment><USER8> I think the issue people have with these names is that their English meanings (as you described) make sense when the positive class is not as prevalent as the negative class. If they are equally probable (or worse, if it's the opposite), then the English meanings quickly become out-of-context

</comment></comment></comment></comment></comment><comment><USER9> If I accidentally swap "Type I" and "Type II" in my mind, is that a Type I or Type II error?

<comment><AUTHOR> You've just made a Type I error because you've lacked 'specificity' in your mind by swapping the two! :O

</comment></comment><comment><USER10> Just to mix things up:

[https://statmodeling.stat.columbia.edu/2019/03/12/r-package-...](https://statmodeling.stat.columbia.edu/2019/03/12/r-package- for-type-m-and-type-s-errors/)

</comment><comment><USER11> What's with the shortened URL?</comment>


Real-Time APIs with RethinkDB and LoopBack - <AUTHOR> https://strongloop.com/strongblog/rethinkdb-connector-loopback-node-js-framework/

<comment><USER2> Curious to know if anyone is using RethinkDB for an IoT project (more interested in home use)...

</comment><comment><USER3> Does this combination make sense if I have an Angular front end that currently uses MongoDB?

<comment><USER4> RethinkDB works _really_ well with Angular and lets you build realtime experiences very easily. Check out this screencast -- [http://knowthen.com/episode-10-building-realtime- application...](http://knowthen.com/episode-10-building-realtime-applications- just-got-easy/).</comment></comment>


Text to Image Synthesis Using Thought Vectors - <AUTHOR> https://github.com/paarthneekhara/text-to-image <comment><USER2> It's a little tricky getting this to work because you need two separate models working together, but I tried it out. Here's some of the samples I generated:

[https://imgur.com/Uwp1wfu](https://imgur.com/Uwp1wfu)

[https://imgur.com/yuW9Yre](https://imgur.com/yuW9Yre)

[https://imgur.com/oZ4wzdC](https://imgur.com/oZ4wzdC) some definite weaknesses in the natural language embedding

[https://imgur.com/MAupphr](https://imgur.com/MAupphr) roses in general don't seem to work well. must not have been many in the dataset

You can see that it works better than one would expect, but there are definitely limits to the understanding. The flower and COCO datasets are, ultimately, not that big. What would be exciting is if you could train it on some extremely large and well-annotated dataset like Danbooru.

<comment><USER3> One possible improvement can be training the text embeddings along with the entire model (Instead of using the pretrained embeddings like skip-thought- vectors). It is on my to-do list, I'll try it out.

</comment></comment><comment><USER4> I think the idea is interesting but I'm not convinced it really "synthesizes ideas" so much as treats the neural network like a database of images that it mixes.

Now, I could be wrong, but because of the way the results are presented it doesn't tell me that it's any good at picking up the meaning of the phrase. The results show a single phrase and a set of images it generates. White flower with yellow center, and a bunch of images of white flowers.

But if it can synthesize the idea properly, one should be able to generate a flower of a variety of descriptions. Yellow flower with blue center. Red flower with yellow center. Blue flower with black edges and black center. etc..

From the way they describe the functionality it should be able to do these things so in a way I don't doubt it, but I want to see how it performs on phrases that induce combinations of ideas that are well outside of the training set yet refer to individual ideas within the training set.

<comment><USER5> How do you "synthesize ideas" if not by combining parts of your own personal database of images/concepts? Even in your example of "X flower with Y center [and Z features]" you start with a mental picture of a flower you've seen (or a generalisation from many flowers you've seen) and then modify it with your mental picture of colours X and Y and features Z.

<comment><USER6> >How do you "synthesize ideas" if not by combining parts of your own personal database of images/concepts?

Procedural generation can be far more complex than just linear blending, which is all that a shallow net can do. For example, consider the full generative process which creates a frame from the game No Man's Sky. It is enormously more complex than a simple shallow net that can just do linear blends of previous examples - many many nonlinear processing steps to go from a small random seed to intermediate databases for terrain and objects and finally down to pixels.

If you look at the actual net design used here, it's only a few layers deep, and not very big. Much much closer to 'linear blending' than what our brains do (which is presumably vaguely closer to what no man's sky does).

</comment></comment></comment><comment><USER7> This is lovely. As a lazy programmer, I would appreciate this as a web service. Instead of googling for an image to steal as placeholder art, I could request a uniquely generated image.

<comment><USER8> I think few have grasped how much of future output will be machine generated from existing work, and yet rather than violate copyright, almost be a necessity to ensure a copyright somewhere is not broken.

<comment><USER7> That's an interesting angle that I hadn't considered. I was discussing with a coworker who is into machine learning about overfitting: where the output could perfectly match the input in a flawed implementation.

<comment><USER9> I'm literally working on this now as a side project. If the avenue I'm exploring is successful the concept of hiring artists will be completely changed.

</comment></comment></comment></comment><comment><USER10> I can see this being useful for police sketch artists.

<comment><USER3> There is still a long way to go, to be able to do that. The model currently generates 64 X 64 pictures and is trained on a very specific flowers image dataset. Nevertheless, it would be a great idea to experiment with such a dataset (of sketches and descriptions) if available.

<comment><USER5> But the thing about machine learning is that once it works at all, "a long way to go" generally means "add more training data" rather than "we require significant conceptual breakthroughs".

<comment><USER6> That is not generally true. For example, GANs work great on MNIST, pretty well on the flower dataset, and ok on bedrooms.

But the same techniques currently fail on ImageNet - which actually is a much larger dataset. "Add more training data" is not a magic solution that overcomes limitations of your model.

In particular if you look at the generative models these GANs map to, it makes sense that they can learn 2D shapes and texture patterns, but rendering a complex 3D scene with significant depth complexity and lighting interactions is an entirely different beast. That problem has been studied deeply in 3D computer graphics and the generative programs successful there are vastly more complex than current GANs.

<comment><USER11> seen this? [https://arxiv.org/abs/1605.09304](https://arxiv.org/abs/1605.09304) awesome generated images, from imagenet

</comment></comment></comment></comment></comment><comment><USER12> It would be cool to implement text to pizza image synthesis.

<comment><USER5> Hey, if you're gonna go in that direction why not just implement text-to-pizza synthesis where you say "I want a mushroom and jalapeno pizza with sundried tomatoes" and then it makes one for you.

</comment></comment><comment><USER13> What GPU was used to train this model?

<comment><USER3> I trained it on an AWS instance with grid k520 gpu.</comment></comment>


Many people are getting rare cancers in a small Georgia town - <AUTHOR> https://www.atlantamagazine.com/great-reads/why-are-rare-cancers-killing-so-many-people-in-a-small-georgia-town/ <comment><USER2> Zooming out from this specific town and article, it's kind of interesting to look at regional differences in cancer incidence. Like, I get that people live very different lives in different places, and that states have different resources to bring to public health problems, but the areas of red in the midwest, northeast and gulf coast are quite striking.

[https://statecancerprofiles.cancer.gov/map/map.withimage.php...](https://statecancerprofiles.cancer.gov/map/map.withimage.php?99&001&001&00&0&01&0&1&5&0#results)

<comment><USER3> Beware of the sample size issue. The Midwest has lots of low-population counties, for which a single cancer case plus or minus makes a great difference in the incidence rate.

See also: Bayesian Data Analysis, Gelman et al., 2nd edition, section 2.8.

<comment><USER4> Wyoming and Idaho should have the same problem but appear pretty blue.

<comment><USER5> That's the plus _or minus_ part.

</comment></comment></comment></comment><comment><USER6> As always, it's important to remember that even in the absence of environmental factors, the probability of a particular town of this size having cancer rates this high might be very low, but the probability of there existing such a town in the U.S. might actually be high. This is simply due to variance.

<comment><USER7> "Variance" does not give people cancer. But pollution does. The nuance is lost in your comment, and what you might more accurately say is "statistics/variance predicts that there is a high probability that somewhere in the US there is a town that has enough pollution (or other cause) to create cancer rates this high. It happens to be Waycross, GA"

<comment><USER8> No, that's not what "statistics/variance predicts". What statistics predicts is that even if there was no pollution whatsoever in the entire country we would still see some towns with increased cancer rates.

That said, I didn't do the math and it's entirely possible that the rates in Waycross are way above what one might expect by chance.

<comment><USER9> Your original comment was still valuable though because it makes people consider another, and important angle. Someone will probably do the math and show that even after considering statistical variance, this is still an outlier, but I feel like I have a more complete view with your comment.

</comment></comment></comment></comment><comment><USER10> The answer to the clickbait headline is "pollution," and the town is Waycross, GA. Here's your "money" paragraph:

> In late 2015, the Georgia Department of Public Health said it could find no > link among the children's cancer cases. Then it backtracked and said more > investigation was needed. In December, the federal government stepped in. > The Agency for Toxic Substances and Disease Registry, an arm of the Centers > for Disease Control and Prevention, said it would work alongside state > officials in evaluating contamination at the railroad yard as well as an > Atlanta Gas Light property that once held a power plant, which was torn down > after closing 60 years ago.

<comment><USER11> Added nuance: A government-sponsored investigation using a narrow data set generated by a company responsible for the cleanup of a single site, of which Waycross has multiple under investigation, decided there was no conclusive evidence of Waycross having abnormally high levels of cancer, excluding diagnoises of cancer that occured outside of the town even if the diagnosises were on town residents.

Also: A town newspaper did not cover this, and the head editor as well as the mayor believes this is a case of "Facebook moms" and overly-concerned parents using personal griefs to wreck Waycross's tenuous economic bounce back.

<comment><USER10> > excluding diagnoises of cancer that occured outside of the town even if the > diagnosises were on town residents.

That's a pretty big exclusion. It's not as if pollution gives a damn about political boundaries.

<comment><USER12> it's also clearly irrelevant from a medical standpoint where the diagnosis was made... unless there's local bribing of doctors going on!

so why insist on only counting local diagnoses?

EDIT: perhaps there are regulations that mandate doctors to diagnose similar percentages, to prevent overdiagnosis... and perhaps this is being weaponized against discovering localized exposure to carcinogens?

<comment><USER13> > "On the cancer cluster question, ATSDR cites data from the Georgia > Comprehensive Cancer Registry to make the case that there isn't one. GCCR > data from the past decade shows childhood cancer incidence has been below > the state average here. GCCR's Waycross-area data, however, "doesn't include > people who are diagnosed at hospitals in other cities", as Lexi, Harris, > Gage, and Raylee all were."

Charitably, I guess the researchers just don't have resources to locate patients more accurately than by their diagnosing hospitals location. It's a huge amount of noise on top of patients actual location history, which would seem to make their survey only capable of detecting persistent hotspots that span the location of many hospitals.

<comment><USER12> >"On the cancer cluster question,"

Either it's on the cancer cluster question, but then you contact and ascertain the accurate patient location history.

Or the data never was on the cancer cluster question...

</comment></comment></comment></comment></comment></comment><comment><USER14> For the same reason "all the best schools are small" but aren't really [1]. It's the "Law of small numbers" that is: scale-dependency of variance. It's much easier to get an large variance if you sample in small sets.

[1] [https://marginalrevolution.com/marginalrevolution/2010/09/th...](https://marginalrevolution.com/marginalrevolution/2010/09/the- small-schools-myth.html)

</comment><comment><USER15> This is a reminder that coal, operating under regulation releases more radioactive material over a few decades than a Nuclear power plants worst failure mode.

<comment><USER16> The coal/natural gas plant near me was burning what appears to be some nasty coal just yesterday (bright yellow smoke)... is the smoke color a good indicator of it's toxicity? (most of the time, the smoke is white, not sure if it is because they were burning natural gas at that time)

<comment><USER17> Yellow would mean coal high in sulfur.

<comment><USER18> Ahhh, just what the lungs need!

</comment></comment></comment></comment><comment><USER19> The CDC ruled that there isn't a cancer cluster in the town.

> On the cancer cluster question, ATSDR cites data from the Georgia > Comprehensive Cancer Registry to make the case that there isn't one. GCCR > data from the past decade shows childhood cancer incidence has been below > the state average here. GCCR's Waycross-area data, however, doesn't include > people who are diagnosed at hospitals in other cities, as Lexi, Harris, > Gage, and Raylee all were.

My blood boils.

</comment><comment><USER20> Here's a good point near the end of the article.

>On the cancer cluster question, ATSDR cites data from the Georgia Comprehensive Cancer Registry to make the case that there isn't one. GCCR data from the past decade shows childhood cancer incidence has been below the state average here. GCCR's Waycross-area data, however, doesn't include people who are diagnosed at hospitals in other cities, as Lexi, Harris, Gage, and Raylee all were.

I'm a Georgia native but from Atlanta. I've never been to Waycross. I lived in South Georgia for about a year a couple hours away.

For anyone who read the Vidalia Onion article on the front page it's about 1.5 hours north of here. There's a beautiful college in Valdosta an hour away. The region is nice because it transitions into more of a Florida type of landscape.

<comment><USER21> > Florida type of landscape

So flat as a pancake and hotter than Hades? :) The Gulf cloudscapes, though, are something to behold.

<comment> grayed-down Hey, c'mon now... [https://en.wikipedia.org/wiki/List_of_Florida%27s_highest_po...](https://en.wikipedia.org/wiki/List_of_Florida%27s_highest_points)

And compared to say Venus, FL's pretty comfortable!

</comment></comment></comment><comment><USER22> My uncle who grew up and in his Kate years moved back to a tiny town right next to waycross. He also died of a strange, quick and rare cancer.

I wonder how much of these findings are liability protection for large lobbying corporations that operate in these towns.

<comment><USER23> It probably goes the other way: the responsible company's legal team determined they can't avoid liability any more, so they get some favorable studies to mitigate the consequences/reduce the size of the potential class action.

</comment></comment><comment><USER24> When we lived there, a very large drainage canal ran along our property. Certainly needed it for summer rainstorms. Never occurred to me that it could be carrying dangerous toxins too.

</comment><comment><USER25> I _have_ to bring up Erin Brokovich here, very relevant for this situation and one of my favorite movies.

</comment><comment><USER26> Is it the same as the radon map?

</comment><comment><USER27> Even without the pollution, I'll never understand why people in dead towns don't just move.</comment>


Site is being hosted and served by a Macintosh SE/30 running macOS 7.5.5 - <AUTHOR> http://www.rhyal.com/ <comment><USER2> This is my site and Mac - I hope you all get a kick out of this!

</comment><comment><USER3> The best part is that it loads here in Vietnam over a VPN to Chicago about 10x faster than most sites I visit. If Atlasssian Cloud would load this fast I would pay twice as much for it.

<comment><USER4> I'm using free EU roaming on a T-Mobile USA SIM card, so I am limited to 2G data speeds. OP site loads more than 10x faster than the rest of the web aside from HN and tildes.net.

</comment></comment><comment><USER5> SE/30 was really pretty good at running A/UX. And, you could build any kind of modern server to run on A/UX. MacOS 7.5 is an interesting choice. (I still have one, with 8M of RAM. Haven't booted it lately.)

I guess I am most impressed that the power supply has worked this long.

<comment><USER6> Might want to look into replacing the metal can capacitors if you'd like to continue to have a working one.

</comment></comment><comment><USER7> I thought it was fun to run a web, dns and ftp server on a PowerMac in 1997. But I had the sense to start learning Linux and finally get one in 1999.

I was using then-current actual Mac software for this. On classic Mac OS.

The box was not very stable. I had an AppleScript to reboot the mac four times per day.

</comment><comment><USER8> Not wanting to be a party pooper, but I guess I'll be the one to point out that the image is hotlinked from imgur. All of the HTML content seems to be hosted from the SE/30 though.

Still a cool project!

<comment><USER9> I'm setting up a small site and have converted my limited number of images to base64 which I can then embed in the html. Keeps the number of external links to a minimum.

</comment></comment><comment><USER10> But isn't that energy inefficient due to high Watts/hour usage?

<comment><USER11> Given that it loads nearly instantly, as opposed to a new web page which needs to send off 1000 requests to pull in 0.5GB of media and ads that I didn't request -- I say it's pretty energy efficient.

Just look at energy per _useful_ data transferred (define "useful" in some sane way). That high energy efficiency is why I favor HN over many other websites.</comment></comment>


Ask HN: Who is hiring high schoolers? - <AUTHOR> Most companies don't really consider hiring high schoolers as interns, making it hard for us to get real world experience in a company at this age. Who is? <comment><USER2> Pick out some local companies you would be interested in working as an intern at? Stop by see if you can get a tour, make connections, inquire if they have an internship program.

Most fun/tech companies love helping kids. We coach a lego robotics team and have gotten lots of tours, demos and even a meeting space for our team at a local startup.

All by calling, stopping by, following up and asking politely.

An internship would be a little different, but if you get to know people at a company it makes it much easier.

<comment><USER3> As an extension of that, make sure you figure out your pitch!

\- What have you learned on your own?

\- What excites / interests you?

\- What do you hope to learn?

\- Why is [company] the right fit for you?

\- What does success look like at the end of your internship?

\- How much time can you commit to an internship?

\- What sort of compensation, if any, do you need?

<comment><AUTHOR> Thanks! (to you and GP) I've been putting off actually calling companies for a while now; I'll definitely try it soon.

</comment></comment></comment><comment><USER4> It's not just about school. Age 18 is a magic number in our law. Without that, a contract with you is pretty sketchy. Being under 18 also limits your hours, work environment, job duties, and so on.

Businesses that typically employ under-18 people are prepared to deal with all that. Other places don't want the bother and the risk, even if there wouldn't actually be any trouble.

</comment><comment><USER5> What are your skillz? Please tell us you are already have some programming chops :-)

<comment><AUTHOR> I'm currently pretty familiar with webapp backend development with Python, Flask, and a bunch of its plugins (SQLA, WTF, Jinja, etc) and Python in general. I'm also exploring Rust and am beginning to feel comfortable in it. I have experience with all sorts of miscellaneous stuff, but these two are the ones I'm most involved in at the moment.

I'm currently working on a CMS-ish style scheduling platform for CTF competitions, an ptrace-based application sandbox in Rust, an online judge system (like a programming assignment grader), and an IRC server in Rust with Tokio and futures.

I have a good amount of experience with cybersecurity and algorithms and data structures too despite a lack of formal education in them ;)

Website (just some links): [http://chaosagent.io](http://chaosagent.io) CV: [http://chaosagent.io/resume.pdf](http://chaosagent.io/resume.pdf)</comment></comment>


New in Chrome 79 - <AUTHOR> https://developers.google.com/web/updates/2019/12/nic79 <comment><USER2> Blegh, now they remove the flags to show the full URL in the address bar. Took them a year [0] Whatever. I'm looking forward to what option they remove in the next release.

Interestingly, there's still this extension by Google that makes the address bar show the full URL [1]

[0] [https://news.ycombinator.com/item?id=17927972](https://news.ycombinator.com/item?id=17927972)

[1] [https://chrome.google.com/webstore/detail/suspicious-site- re...](https://chrome.google.com/webstore/detail/suspicious-site- reporter/jknemblkbdhdcpllfgbfekkdciegfboi)</comment>