Why access and API tokens are the new passwords but worse - <AUTHOR> https://emilebosch.com/2018/10/06/why-acess-tokens-are-the-new-passwords-but-worse/ <comment><USER2> > On top of that, passwords are at least hashed in the database and salted. > And most frameworks promote this good behaviour nowadays and have extensive > documentation on how to do this. But for API tokens we're outta luck. We > need them in their current plaint-text form to communicate with the API's so > all we can do is encrypt them at rest and decrypt them when necessary. Alas > for many this practice is not widely communicated nor documented.

Half the reason to hash and salt is to prevent an attacker from obtaining the plaintext (often reused) password, which doesn't apply for API keys.

With that said, there's no reason why a service couldn't send you a plaintext API key but only store the hashed and salted key in their database. I suspect AWS, for example, does just that (you can't obtain your API secret except right after generating it). The API consumer needs a way to store/decrypt the plaintext API key, but that also applies to passwords.

<comment><USER3> > Half the reason to hash and salt is to prevent an attacker from obtaining > the plaintext (often reused) password, which doesn't apply for API keys.

That's more than half of the reason. Do you really want to rely on an attacker only getting the password database from a breach and nothing else and then not spending the time to reverse the hashes?

<comment><USER4> Hm, I might be writing at cross purposes (I think you were addressing passwords?), but:

API keys are quite different from passwords and it makes sense to store and secure them differently.

If your site is generating API keys then you should ensure that they are say 128 bits of high quality entropy and use a fast hash.

Nobody is going to invert that, even if you use a single round of SHA-256 / HMAC / whatever.

It's a good thing too because API keys need to get validated on every request and you wouldn't want to use a heavy function (tens of millis like a decent kdf) on every request.

</comment></comment></comment><comment><USER5> Poor post (not even spellchecked) about an actual but well-known problem.

</comment><comment><USER6> This might be one of the worst things I've read this week. Tokens shouldn't have anything to do with your login and giving out login is so much worse.

<comment><AUTHOR> The post doesn't say you should give out your login. It says you should encrypt your access tokens and explains some security implications of current implementations that use them, like how they often give too broad permissions. When you change your password, you often need to reauth all of your devices, but you don't need to reauth your access tokens.

<comment><USER6> Why would I want the access tokens to be revoked if I change my password, unless I revoke the token it should be valid.

</comment></comment></comment><comment><USER7> That call to action at the bottom is awful.</comment>


The Plane Crash Over the Grand Canyon That Changed Aviation - <AUTHOR> https://timeline.com/when-these-two-planes-collided-over-the-grand-canyon-it-changed-aviation-history-25549ca2ba01#.auw7r1sqb <comment><USER2> It wasn't the first, even at cruise phase of the flight, nor was the last.

You can check a list here: [https://en.wikipedia.org/wiki/Mid- air_collision#List_of_nota...](https://en.wikipedia.org/wiki/Mid- air_collision#List_of_notable_civilian_and_military-civilian_mid- air_collisions)</comment>


Photon: High Performance Image Processing in WebAssembly / Rust - <AUTHOR> https://silvia-odwyer.github.io/photon/ <comment><USER2> Very nice website, it's very well done.

Regarding performance, I don't see what makes this high-performance. I looked into the code for filters and it's a very naive translation of the algorithms.

Naive not in the pejorative way, you can only do so much on images stored as contiguous RGB (arrays of struct), even OpenCV does not really optimize for this.

Non-naive implementations of filters would use tiling, register blocking, register rotation to avoid being bottlenecked by memory which is the main issue with stencil code. I don't think vectorization is straightforward with the RGB layout since you would need both scatter and gather instructions but gather requires AVX2 and scatter is very manual.

Anyway the benchmark should use a reference C or C++ library or even imageflow that is also written in Rust [https://github.com/imazen/imageflow](https://github.com/imazen/imageflow). Bonus point if you benchmark against Halide ([https://halide- lang.org/](https://halide-lang.org/)) or Taichi ([http://taichi.graphics/](http://taichi.graphics/)) and you're only 20 times slower (see their box blur example: [https://github.com/halide/Halide/blob/master/apps/blur/halid...](https://github.com/halide/Halide/blob/master/apps/blur/halide_blur_generator.cpp))

</comment><comment><USER3> Great website. Really love the examples and style in general. I may be doing something wrong but the "start JS" and "Start WASM" demo seems to 1) take longer on wasm most of the time on my machine (latest firefox on latest mac os) and 2) is a little clunky in how the two impls start and stop

</comment><comment><USER4> Looks good. Will check out your transforms first.

Fwiw, Automattic's image optimizer / CDN for WordPress is also called Photon:

[https://developer.wordpress.com/docs/photon/api/](https://developer.wordpress.com/docs/photon/api/)

</comment><comment><USER5> Wow. Pretty cool. Agree that it doesn't compare to high-performance native libs, but still a huge step up for the web and very professionally packaged!</comment>


Ask HN: Is there a startup community in Phoenix/Scottsdale, AZ area? - <AUTHOR>

What's the startup community like in the Phoenix / Scottsdale area?  How can I get involved?  I just launched a startup that's based out of Scottsdale. <comment><USER2> Hey fellow Phoenician! Most of the startup stuff I've seen out here has gone through Gangplank (<http://www.gangplankhq.com/>) but this Quora thread may have more information for you: [http://www.quora.com/Mircea- Goia/Posts/Startup-scene-in-Phoe...](http://www.quora.com/Mircea- Goia/Posts/Startup-scene-in-Phoenix-Arizona-what-I-have-found-since-living- here)

<comment><AUTHOR> Thanks for the links! I wasn't aware of Gangplank. I'm definitely going to swing by some of their upcoming events.</comment></comment>


How is equity distributed in a startup? - <AUTHOR>

<comment><USER2> I suggest you read Paul's essay on this topic:

<http://www.paulgraham.com/startupfunding.html>

</comment><comment><AUTHOR> I'm not sure how equity works if I have a co-founder and I'm giving him "15%." Is this in stock? Or is this annual revenues? Or am I the one who decides? What's typical?

I'm not studying finance at college right now, so keep that in mind. Any sites that might explain this would be helpful. Thanks

<comment><USER3> Equity is ownership of the company. It is everything that that the company is after all debts have been settled. Stock is the way this is represented. So the percent of equity you have is the percent of stock you have.

The only time it translates into money for you is when it is sold or dividends are declared. Generally, the percent of the equity you have is the percent of the cash you get.

I would recommend talking with your cofounders about how you want to split it up. Remember that YC will take a small chunk of it as well. I'm sure if you're accepted there will be help with understanding it all.

If you want a generic recommendation, take a chunk and set it aside then divide the reset evenly amongst the cofounders.</comment></comment>


"Apple has basically deprecated HTTP in iOS 9 and OS X 10.11." - <AUTHOR> https://twitter.com/satefan/status/608093548827664384 <comment><USER2> This is for network connection code in apps, not in the web browser.</comment>


Corporate-Owned City - <AUTHOR> https://boingboing.net/2019/10/30/citizen-scores-eh.html <comment><USER2> Taste the freedom with spacers choice!

<comment><USER3> > It's not the best choice, its Spacer's Choice!

So many lines from that game are a little too real to be truly funny.

Source: Outer Worlds (game)

</comment></comment><comment><USER4> Sometimes government is worse than corporation. And maybe it is not bad idea but there should be some exit plan for people that don't want be part of that city.

<comment><AUTHOR> How do you ensure the Rule of Law if there are multiple States.

Neo-feudalism is coming.

<comment><USER5> Something like this couldn't happen without the tacit approval of an actual sovereign state. No matter what powers this city claims, it has to do so under the authority of and through negotiations with the governments of Toronto and Canada (or wherever future such projects are hosted,) or else attempt to secede and fight a civil war over the matter.</comment></comment></comment>


Learn Coq in Y Minutes - <AUTHOR> https://learnxinyminutes.com/docs/coq <comment><USER2> Are there any good resources (similarly short and informal) about doing proofs in Coq? I don't have anything particular to prove, but I find it interesting and would like to build up intuition for the Curry-Howard Correspondence.

Also, more tangential, but this comment section might attract people who know the answer: any good resources for getting started on type systems more generally?

<comment><USER3> Software Foundations ([https://softwarefoundations.cis.upenn.edu](https://softwarefoundations.cis.upenn.edu)) is pretty informal and understandable, what it isn't is short. But it's a very useful resource.

The best general introduction is probably still Types and Programming Languages: ([https://www.cis.upenn.edu/~bcpierce/tapl/index.html](https://www.cis.upenn.edu/~bcpierce/tapl/index.html)) It's a great book, but it doesn't get to dependent types.

<comment><USER4> I'm currently in Prof. Pierce's class at UPenn! Can confirm this is a great book, and we literally work through the exercises. Taking this class AFTER using Scala in industry has really put a lot into context. It's so easy to start too - download CoqIDE or ProofGeneral and get to it!

</comment></comment></comment><comment><USER5> I love learnxinyminutes.com: ad-free concise single page reference/tutorials. Such a simple idea, such great execution.

</comment><comment><USER6> If you wonder about the name : [https://fr.m.wikipedia.org/wiki/Coq](https://fr.m.wikipedia.org/wiki/Coq)

And the symbol : [https://en.m.wikipedia.org/wiki/Gallic_rooster](https://en.m.wikipedia.org/wiki/Gallic_rooster)

<comment><USER7> You posted an article in French..

<comment><USER8> It has an image of a chicken, which should help.

</comment></comment></comment><comment><USER9> Hey neat! I wrote this tutorial. Lemme know if you have suggestions for improvement (or you can make a pull request).

</comment><comment><USER10> Can anyone here comment on what kinds of proofs coq is a good tool for, and what kinds of proofs are impractically hard for it to handle? I'm aware that most proofs aren't formalized, and now and again we hear that mathematicians spend a long time trying to assess whether a proof has errors. From that, I infer that there are proof approaches that are challenging to capture in tools like this (or else any proof not obviously correct could be formalised to resolve the issue). What are those hard-to-capture techniques?

<comment><USER9> You may be interested in a recent survey "QED at Large: A Survey of Engineering of Formally Verified Software" [https://www.nowpublishers.com/article/Details/PGL-045](https://www.nowpublishers.com/article/Details/PGL-045) (have to sign up for a free account to access :\ )

<comment><USER11> Hi, signed up for a free account, but access was not granted. Email is in my profile, if you would be so kind to help.

</comment></comment></comment><comment><USER12> Are there benefits in learning Coq for those who work mainly with general purpose programming?

<comment><USER13> It's fun, and it gives you new perspectives about how you might reason about program correctness in other languages as well, even if only informally in your head.

<comment><USER14> Agree with that - I found it makes you write simpler code because you start thinking e.g. "hmm, if I write the algorithm this way, it would take forever to prove correct in Coq so it must be an overly complex approach".

If you find it hard to justify robustly in your head why some code should work it's probably very difficult to prove formally which usually means there's a large surface area for bugs too.

I found a big aspect of proving program correctness was formulating programs in a way first that made them easier to prove. It makes you cringe at mutable state and loops with nontrivial conditions.

</comment></comment></comment><comment><USER15> If you're looking to do some dependently-typed programming and theorem proving, Coq is perhaps the most mature tool to learn. It's actually two different languages, Gallina, which is what is shown in OP, and Ltac, which is the tactic language. I enjoyed Software Foundations[1], which, if you have the time, lets you self-study theorem proving starting from scratch. Somewhat less known is the book Formal Reasoning About Programs[2] which is more advanced but informative as well.

[1] [https://softwarefoundations.cis.upenn.edu/lf- current/index.h...](https://softwarefoundations.cis.upenn.edu/lf- current/index.html)

[2] [http://adam.chlipala.net/frap/](http://adam.chlipala.net/frap/)

</comment><comment><USER16> Ummm, so how is "Coq" pronounced?

<comment><USER17> [https://github.com/coq/coq/wiki/Presentation](https://github.com/coq/coq/wiki/Presentation)

>Did you really need to name it like that?

>Some French computer scientists have a tradition of naming their software as animal species: Caml, Elan, Foc or Phox are examples of this tacit convention. In French, "coq" means rooster, and it sounds like the initials of the Calculus of Constructions CoC on which it is based.

<comment><USER18> The big irony is: "Coq" is for English speaker exactly what "Bit" is in French. No problem when written, and ok spoken between grown up professionals obviously (though I still avoid translating bitwise operator because it becomes "cock to cock operator" when spoken), but elementary school with all the 8/16/32 bits consoles was painful...

</comment></comment></comment><comment><USER19> I wonder, can I define floating point arithmetic w/ this language?

<comment><USER9> As others have mentioned, it's possible and has been done in the FlocQ library. I don't have personal experience using them. I would expect proving properties to be somewhat challenging. There is a book available

[https://www.elsevier.com/books/computer-arithmetic-and- forma...](https://www.elsevier.com/books/computer-arithmetic-and-formal- proofs/boldo/978-1-78548-112-3)

You may also want to look at this thesis

[https://www.lri.fr/~melquion/doc/19-hdr.pdf](https://www.lri.fr/~melquion/doc/19-hdr.pdf)

<comment><USER9> As a side note, I believe native floating point operations are in the works. This is more of a speed benefit though? [http://drops.dagstuhl.de/opus/volltexte/2019/11062/pdf/LIPIc...](http://drops.dagstuhl.de/opus/volltexte/2019/11062/pdf/LIPIcs- ITP-2019-7.pdf)

</comment></comment></comment><comment><USER20> What a great name

<comment><USER21> Presumably its pronounced cock?

<comment><USER22> In French, yes.

<comment><USER7> How is it pronounce it in English lol

<comment><USER23> Yes, Coq is pronounced like "cock" in English. C'est la vie

</comment></comment></comment></comment></comment><comment><USER24> That's what she said

<comment><USER25> Please don't do this here.

</comment></comment><comment><USER7> How do I pronounce Coq?

</comment><comment><USER26> I've been learning my own version of Coq for decades now</comment>


How Play-i Orchestrated Their Big Launch ($130K in one day) - <AUTHOR> http://www.hackthings.com/how-play-i-orchestrated-their-big-launch/

<comment><USER2> It helps that it's a great looking product as well, if I had kids I'd be majorly tempted to buy.

</comment><comment><USER3> IMO, it happened so, not because of their launch strategy but more so solely because of the product and the vision that they are selling. The launch plan is pretty much by the book, extra points for the media kit though, and full marks to the product!

</comment><comment><USER4> Always cool to read stories like this. Crowdfunding seems to easy to pull off, but doing it well requires a lot of planning.</comment>


PenFM: Fall back in love with writing via your terrible friends - <AUTHOR> http://www.indiegogo.com/penfm?a=1665689

<comment><USER2> Novel interface. Get the fanfic authors on board.

A tool like this would be perfect for school English classes or creative writing workshops (and alumni).

As for making the rest of us plebs pick up the pen again... It's a little harder than just giving us nice tools. Many aspiring writers (not all!) like to hide their work away until they are absolutely certain they will get good feedback, while this is like running around naked in the front yard.

Soundcloud has a similar 'get creating' premise and magically minimises that fear of failure factor. I'm not sure how, but it's amazing. The line between supportive and vicious is grey, blurry, narrow. Take care.

</comment><comment><USER3> Using Ayn "Virtue of Selfishness" Rand to advertise your collaborative writing app is like using Donald Trump to advertise hair-care products.

<comment><USER4> And I hear you can support the capitalist system by buying shirts with Che Guevara's face on them. Or perhaps referencing equal parts Ayn Rand, Hemmingway, Poe and Cervantes might be more of an attempt to bring to mind famous authors rather than objectivism?

<comment><USER3> Sure. But it's like using a picture of a circle, a triangle, a square, and a swastika to suggest "geometric shapes".

<comment><USER4> No, it's like using a picture of a circle, a triangle, a square and a swastika to suggest "famous shapes." And of course, Godwin's law and all that on you.

<comment><USER5> Why would you put a swastika on your business in any situation?

Ayn Rand is for Glengary Glen Ross wannabes. Not for your typical creative writer.

<comment><USER4> Unless Ayn Rand murdered a few million people on the side, her face is in no way commensurate with a swastika.

<comment><USER5> Objectivism caused Goldman Sachs, Alan Greenspan, the 2008 crash, countless corporate psychopaths... The death count is more than a few million.

GS alone is responsible for a famine.

Have you ever been to their offices? Copies of Atlas Shrugged on every desk.

Destructive ideologies that advocate fucking the poor and letting them die definitely cause deaths.

<comment><USER4> The logical convolutions you have to go through to make Ayn Rand into Hitler are absurd. Marxism has easily killed ten times that number, many by accident, many intentionally, yet few hold Marx personally responsible or would find his face a repugnant symbol of death.

You're allowing your opinion of an ideology to turn it into nazism, but in so doing you must overlook what makes nazism unique: that it does indeed advocate murdering people simply for being different as a solution to problems—and that it actually did murder millions of people directly. Ayn Rand did not do any of that. At worst, she advanced a philosophy whose overzealous application by unscrupulous people with power led to deaths. If that's enough to make you Hitler, nearly every philosopher or novelist is, or would be if they were simply famous enough.

In short: calm down. She's included in the image because her novels are in the 100 Most Influential List put out by some non-profit. Not because she was a saint.

<comment><USER5> >yet few hold Marx personally responsible or would find his face a repugnant symbol of death.

You obviously don't live in America!

By the way, telling someone to "calm down" makes you a douchebag.

And strawmen don't help either.

And let's not kid ourselves: she's in the image because someone in that company is an Ayn Rand fan. There is no shortage of Randists among tech people. Quite a bit fewer among literary types for obvious reasons.

<comment><USER4> Yes, clearly it's a conspiracy to promulgate Objectivism, and not a simple collection of four author's faces. The world must be so interesting to you.

<comment><USER5> Newsflash: Individuals who create stuff put their favorite things in the stuff they create.

It says a lot about your intelligence that you immediately jump to a worldwide conspiracy theory from a single instance of a single individual putting his personal favorite author in a logo for a writing website.

</comment></comment></comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER6> I just watched the video. It shows a few people typing with each other online (in this case working together on a collaborative story), a picture being dropped down near the end, and then it being posted to Facebook.

I understand that the product is the software that allows them to do this but it's not clear to me what unique features are being offered that make it superior to the IM programs and forums people have already been writing collaboratively on for years. What am I missing?

<comment><USER7> Yeah, the video was designed in a way to capture the experience rather than the tech. What isn't fully exposed:

\- what you see is what you get. whenever you want, you can download the story in epub, mobi, or pdf format. while you might have to pay initially, you keep the story itself for any future download at each stage of its development in any format.

\- writing is in realtime. you can see what others write, google doc style.

\- content discovery is an enormous sell point here. you can write in gdocs all you want, but will just anyone be able to find and read and comment on it? we make stories accessible to the entire future pen.fm community to share and enjoy.

\- we can update you on stories that you've subscribed to, to let you know anything from the fact that it's updated, or the section added itself.

\- does anyone really enough shuffling back and forth between word/gdocs, chat, and forums?

\- and more. hope that's good for now. :)

<comment><USER6> Thanks for that, I get it better now. Writing with this isn't something that interests me personally, but I hope it is funded because I reckon watching other people do it in a "spectator" mode would be pretty entertaining!

</comment></comment></comment><comment><USER7> Thanks for posting this, edwardog! Glad someone felt compelled to.

I'm the guy behind PenFM. AMA.

<comment><USER8> Okay. Why ".FM" domain?

<comment><USER7> Because when you're bootstrapped and can't buy a 3 letter dotCom for $55/year, FM doesn't look so bad. So we're working with it, and kind of playing with the slogan "broadcast lit".

<comment><USER8> Broadcast lit can actually work for what you're wanting to sell this as, so I'll give you that point. But where are you looking that ended up with a $55/yr TLD? Unless you're bootstrapping from absolutely nothing, that's an investment worth making imo.

Not dismissing your product here, as a journalism nerd I think it's a novel concept and approach.

<comment><USER7> Indeed I am bootstrapping from basically nothing. I have this horrible tendency to leave a job right when I have just a few months of runway. It really puts my feet to the fire :)

pen.com is going to fet a pretty penny, I imagine in the higher 10,000s if not more. With funding, it becomes feasible. And to correct myself, FM domains cost $79/year not 55, so that's where I am. Got lucky in finding the short name.

</comment></comment></comment></comment></comment><comment><USER9> Not all of my friends are terrible, though - so I'm somewhat conflicted.

</comment><comment><USER7> [http://www.pen.fm/read/A-Chance-Autumn-Encounter- PNefec68b4f...](http://www.pen.fm/read/A-Chance-Autumn-Encounter- PNefec68b4f051c443)

Demo of our reading experience

</comment><comment><USER10> Darn, for a moment I thought that this was a site that encourages people to write with a real pen: fall __back __in love (PenFM).

</comment><comment><USER11> This is really popular in China ;-)

</comment><comment><USER12> Other then the export features to epub, how is this different then just using google docs?

<comment><USER7> For one, google docs has a free-form dynamic that doesn't really prevent people from cannibalizing each other's work. PenFM, like its predecessor Neovella, enforces a turn-based writing collaboration. But that's entirely just in terms of how it differs from GDocs in the sense of sharing the production of content.

Collaboration in PenFM happens in another, more powerful way: the ability to react to parts of a story with simple likes and more thorough commenting. Imagine having written a story, and now you have to send it out to friends & peers to review and give feedback on. Would you really rather have a back-and- forth over IM, constantly having to find the part they're referring to? On PenFM, they just click the section, type a comment, and you get notified to go take a look at what they wrote. It's asynchronous.

<comment><USER8> _For one, google docs has a free-form dynamic that doesn't really prevent people from cannibalizing each other's work._

Not sure what you mean by "prevent people from cannibalizing each other's work", given you can very easily share docs and disable edit features at the user and group level but still allow people to read changes as they happen

</comment></comment></comment><comment><USER13> I have a similar project called "Social Typist". <https://github.com/jeswin/socialtypist>

Definitely something worth exploring. Best of luck.

Edit: last line.

</comment><comment><USER14> An online writers' workshop--not the same as Google Docs. There are online subscription systems that support such activities, such as <http://sff.onlinewritingworkshop.com/> Getting decent feedback is a problem. Perhaps there is a workable system that would compensate good reviewers. Most writers aren't rich, but they might be willing to pay other writers (who aren't rich) to review their work.

<comment><USER15> My website, Scribophile, has been doing this successfully for about 5 years now. It looks like it's solving a different problem than pen.fm though. While Scribophile concentrates entirely on craft and workshopping, it looks like pen.fm is more of a marketing/publishing/writing platform.</comment></comment>


Five-figure bonuses stun employees  - <AUTHOR> http://www.msnbc.msn.com/id/27958458/ <comment><USER2> I was afraid this was going to be some story about top-level management cutting jobs in the harsh economic climate, and then rewarding themselves (only somewhat handsomely) with bonuses. I'm glad to see an uplifting story instead.

From the perspective of the purchasing company, I wonder what effect it would have on employee retention. The article mentions that life hasn't changed much in the interim, but it was also unexpected. Some employees may find this a good opportunity to strike out on their own, or retire just a bit earlier.

I would be curious to see if the aggregate effect is one of employee loyalty or loss.

<comment><USER3> It's a somewhat hard life being a financier because your pay is so variable. You might mock the I-banker who got "only" a 5-figure bonus, but what if he took out a mortgage in 2004 with his new wife on the premise that he would be making six figures? Variation is a cost of the lifestyle, and a stressful one at that. It is hard to make any long-term plans. On that note, it's rare to find bankers without family trouble, due to both the work hours and the financial issues.

<comment><USER4> Plenty of people with highly variable pay save most of their income in the good times to deal with this. Dumping 80% of that 100k bonus into savings might not feel glamorous, but it's going to help your home life more than you might think. And down the road you can transition to a lest intense job and have enough savings to top off your lifestyle.

PS: Then again spending more than you make seems is far more common among the highly compensated.

</comment></comment></comment><comment><USER5> My grandfather did a similar thing!

He had an independent uranium geology/prospecting/speculating business in the 70s -- with a bunch of young roughneck employees he would go out with a drill rig to the middle of nowhere on private land, trading a new well to the landowner for the opportunity to take a core sample.

He was making decent money in mining claims, then Three Mile Island happened, and uranium prices dropped through the floor, killing all cash flow. A bunch of the employees effectively became family, practically living with them on little pay.

When uranium prices bounced back in the 90s, my grandfather sold a number of claims (the business's previously-worthless assets), and his old loyal employees who had eventually moved on to paying work got _really late_ 5-figure+ bonuses.

</comment><comment><USER6> I think that is a very kind and generous thing those employers have done. Had it been me, I would have considered it even more kind and generous to structure the bonus such that it was not lump-sum.

Sudden wealth, even sudden relative wealth, destroys a lot of people who are not used to dealing with it.

Heck, banking on the power of defaults (90% of employees choose the default contribution for their IRA, 90% choose the default withholding, 90% choose ...), you could probably have accomplished as much good by giving everyone a letter saying:

"Thank you for your service. You are being given a large bonus this year. You have two options for receiving it: less money now or more money later. If you want to receive more money later, do nothing. If you want to receive less money now, fill out the attached form and hand it to your supervisor by Christmas."

<comment><USER7> I wonder, given the circumstances surrounding the bonus (the company was sold), if this wouldn't be an option.

<comment><USER6> If you've got $6.5 million to give away I'm fairly sure you can pay some lawyer $10k to set up a trust. (Heck, just give him a slice of the interest on the trust -- half a percent should cover his expenses nicely.)

</comment></comment></comment><comment><USER8> It's about time people working for companies making real, actual things were rewarded for the wealth they create in the same style as mere symbol- manipulators.

<comment><USER9> Sure - it's an awesome story and more should do it, but you give the impression that manufacturing is more noble or meaningful than "mere symbol manipulation". Is software a "real, actual thing"? Is cancer research a "real, actual thing"? We can't all work in the industrial sector - nor should we.

<comment><USER8> It was a dig at the Wall Street types who manipulate symbols of value (i.e. money) without creating real wealth themselves.

Of course manipulating symbols in the wider sense can create wealth - we're hackers, right? ;-)

<comment><USER10> If the stock market doesn't create real wealth, then why is it so successful? Is it merely siphoning real wealth away to the pockets of parasites?

The stock market is about giving money to those who will use it most effectively, so, when done right, it can be seen as very efficient resource allocation.

<comment><USER11> At best, the market's the place where funding originates. It helps others create wealth. At worst, it's merely a middleman, pocketing a cut of other people's transactions. This is accepted as it's useful to have a "market for money", but I would not say it creates wealth in the same way as something that processes ideas to sellable code or raw materials to finished product.

<comment><USER10> Both code and the market create value by processing information. Code can break too, but that's not an argument against writing code. So, I'm not seeing a strong argument that the market is essentially different than any other sort of value creating information processing we do.

</comment></comment></comment></comment></comment></comment><comment><USER12> If all companies worked like this, trickle down economics would actually work. Till then...

</comment><comment><USER13> I think this is great. It is the right thing to do.</comment>


Ask HN:  Top 3 tips Advice on selling enterprise SaaS - <AUTHOR>

What are your top 3 tips on selling software to the enterprise?
I'm launching a SaaS startup and need a little advice on how to approach big companies.
Advice is appreciated.
Cheers. <comment><USER2> Starting as well at the moment, I can tell you about my strategies and tips:

* Find somebody who already did work with big companies. Make her your test customer.

* I teamed up with an 'old' guy. He is an very experienced businessman and has already a sales infrastructure in some countries. I can focus on development. He makes sure that guys with ties run around and do the selling.

* Prepare to shift from SaaS to shipping hardware.

* Be sure that integration into existing infrastructure is painless.

* Try to talk to the people who would use your software first. With that knowledge go to the person in power to purchase.

* Sort through your friends list and check their companies. Some of my friends are currently calculating how much their boss would save if they could use my product.

* Know your targets. Which person will do the decision? Who reports to and influences this person? (If you would want to sell something technical to my 'old' guy... I would be one of the filters you would go through.)

Unfortunately my landing page is not ready yet. The plan is to divide the information into 'for business people' and 'for technical people'.

Business guys will see how my products saves them money and helps them look good. I will put up some kind of animation to show some use cases.

The technical people can read about the technical concept and how to do integration. As one of the keys in my product is easy integration, I have a ton of examples ready. Although coding is not necessary most of the times, I included some samples in different languages on how to extend the default package.

Hope that helps a bit. Good luck and have fun.

<comment><USER3> I find your points interesting, especially "Prepare to shift from SaaS to shipping hardware". Can you elaborate on this? As in why and the situation that causes it? thanks

<comment><USER2> Those few bigger companies that I have talked to, just do not like the idea of having their sensitive data or parts of their critical infrastructure in the hands of an other company or accessible via internet. I can perfectly understand that.

In Germany for example some laws make it hard to outsource data processing especially if customer information is included. One example would be the fud about whether German websites can use 'google analytics' without breaking certain privacy laws.

Some of my clients are based in third world countries. Although they have satellite based internet, the latency is annoying enough to want something local.

</comment></comment></comment><comment><USER4> The best way so far would be to have (or seem to have) a generic version of the product, and let the clients find you.

This is unfortunate for me because in practice most SaaS I make turns out being completely custom and rather expensive (for my corner of the world at least, somewhere between $100 - $600 per month). So the "generic" version, which I assume is what people usually think of when they say SaaS, tends to remain rather unused and gather dust.

</comment><comment><USER5> We've been successfully selling to medium-to-large businesses for a year now.

1) B2B sales is hard and takes a lot longer than in takes Get used to it now and be patient.

2) For us, only two metrics matter. MCRR (monthly committed recurring revenue) and cashflow. Focus obsessively on cashflow because it's easy to confuse booked sales with cashflow. Money comes in a lot later than you expect.

3) In an early stage startup, the CEO should be selling. A sales guy can't replace the passion and product knowledge that a CEO has.

Just my opinions and lessons learned from the past year. Ping me anytime for specific advice.</comment>


Crying on the job? You're not alone, with 8 in 10 workers shedding tears - <AUTHOR> https://www.cbsnews.com/news/crying-on-the-job-youre-not-alone-with-8-in-10-workers-shedding-tears/ <comment><USER2> I've never shed a tear at work. But I wish I did, because I typicaly feel better after I do.

Instead I am left with a much more crushing and anxious feeling that is only partially remedied after arriving home and laying down, wiped out from a day of sitting.

And then we repeat this 20 times per month or so.

<comment><USER3> If you don't mind, could you tell what kind of situations have led you to feel crushed?

<comment><USER4> From personal experience. Many things. Watching your teammates get laid off one-by-one over several months because the stock price crashed 70%, while the CEO gets a 30 mil dollar bonus. All those team members got a one-day notice they were being laid off so you're constantly on edge that any little thing you say or do could get you downsized. Watching the product you've been working on for a year slowly get shuttered and you're powerless to do anything. It's at the whim of the 'leaders'. Watching more and more of the work go to outsourcing and low cost centers that are so low cost it's not even competitive in India. The boss that hired you getting pushed out and the new boss hiring his best friend whose not even a developer and excluding you from meaningful work. No one caring about your ideas or values you. You're just tolerated. Etcc.. I could go on. Capitalism can suck.

</comment></comment></comment><comment><USER5> The nine to five grind sounds pretty normal and healthy to me!</comment>


Ask HN: How should a startup handle a security breach? - <AUTHOR>

Imagine you have a startup. You are working few last months incredibly hard every day. Things are going well. The press noticed you and they love your startup. Your user acquisition is crazy high and they love you.
First scenario: In one very nice day you will receive an email that someone downloaded all your users data and he will publish everything if you will not pay.
What would you do? Will you pay? Will you call authorities? If he will share this information with the press they will eat you alive.
Second scenario: You just noticed something weird in your system. Someone else was logging on your servers as a root. You are freaking out. Asking everybody in your company, if they know the IP address. Unfortunately, nobody was loggin in from Washington, because everybody lives in California.
What would you do? Should you inform users? What will you tell them?
I'm just curious, because almost nobody talks about security in startups and what to do if something really bad will happen. <comment><USER2> Yikes... i don't know what i'd do. I hope with enough preventative measures i'll never have to deal with something like that.

First scenario: First priority is to branch and patch the hole asap. There's no point dealing with this if someone else is going to put you back in this position a month later. Make sure everyone in the company is on the same page, and then unfortunately i'd probably attempt to verify that the request was legitimate, and ask for proof with the pretence of being willing to pay.. Try and think of some way to make the information useless to the perpetrator, but in the end, i probably would pay up (under some contract) and maybe offer employment as well.

Could possibly whip up a bug reporting program, with well-defined rewards in the vicinity of what was being asked, and give the perpetrator a nondescript shrug toward it. That way the perpetrator gets an easy, moral way out, which is almost as important.

Second scenario: Security audit, change all passwords, IP restrict logins, re- encrypt all user passwords on login. Hopefully there was no sensitive data - then i would wait it out to see if it turns into scenario one. It would be embarassing to send out apologies + service credits if it wasn't malicious (not just e.g. the hosting provider doing maintenance, someone using a proxy, someone working out at a client's site, a contractor's ip you've overlooked, etc)

It always feels like someone's done the right thing when you read stories about services notifying all their users, forcing password changes, and so on. But you have to keep up your business, and it's not like you can just shut everything down, rewind time and never program again. Damage control and move on.

<comment><USER3> You would actually offer employment to someone who just blackmailed you?

<comment><USER2> Maybe? I don't know. It's important to act reasonably and not to spook them into releasing all the data. My company could probably do with an extra pair of hands, especially someone who's proven they know their way around debian / SQL (probable attack vectors), and now they have the DB schema to study, so... not the worst candidate... Plus, the company would by now be busy with the task of patching all the exploits.

You almost have to look at it from their point of view. Their options are (a) sign NDA, take employment, money, an honourable way out of a difficult situation, or (b) go on the offensive, release the data for little or no personal gain, and suffer through a police investigation and potentially jail- time or a permanent criminal record. Option (A) works out better for your company, your product, and for them, so you might as well aim for that.

I think this is a pretty common approach. Although, it's been used in stings in the past, where a fake offer of employment is enough to get the person in the flesh where the police can take over. There's one very interesting story from Valve about the leak of the Half-Life 2 beta[1] - and of course, Owen Walker[2] found employment after a high-profile hacking case.

It would be interesting to see what other companies in similar situations ended up considering...

__________________________

1\. <http://www.theregister.co.uk/2008/11/14/half_life_sting/>

2\. [https://secure.wikimedia.org/wikipedia/en/wiki/Owen_Thor_Wal...](https://secure.wikimedia.org/wikipedia/en/wiki/Owen_Thor_Walker)

</comment></comment></comment><comment><USER4> I have worked in a startup myself as the lone IT & Sec guy for quite sometime. Generally the attitude towards securing one's IP, Infrastructure, etc is lax atleast in the beginning days and comes into focus if something nasty happens.

My inputs wrt second scenario. 1\. Try and figure out from the log as to what changes were made.

2\. Take a backup

3\. Ask your employees if anyone indeed logged in from that suspicious remote IP (You never know if any of your employees used a proxy, etc.....)

4\. Review the permissions given and harden as necessary. Change Credentials

5\. If cost is a constraint, there are plenty of open source utilities/applications that can be used for relatively lower costs than the ones from the big companies

6\. If something as important as Intellectual Property, Sensitive information is stolen, I guess you are obligated to inform LEA & make a disclosure.

7\. Mistakes happen!

8\. Document everything!!! I had an experience where a rogue dhcp server popped into our LAN from nowhere! Fortunately I had documented every systems MAC address in our LANs previously and was able to identify the rogue machine and also created a blog post on the same. you can read here:

[http://virtualthoughts.org/2006/best-practices-network- outag...](http://virtualthoughts.org/2006/best-practices-network-outages-and- resolutions/)

</comment><comment><USER5> I wrote about this yesterday... <http://jnorthrop.me/2012/04/7/preparing-data- breach/>

The short answer is call the authorities, then get a lawyer to help you understand all of the legal obligations. Then expect to notify your customers, third-party services and the credit bureaus.

</comment><comment><USER6> I guess it depends on the nature of the data ... if it can be used against me / my users then I'd call the FBI and start sending apologies.

I wouldn't bother emailing the bad person in any case.</comment>


RunRoute: autogenerated running routes - <AUTHOR> http://www.runrouteapp.com

<comment><USER2> I have to ask, how is this on the front page when it's nothing but a signup page, with less content than any of the 'Show HN' posts in the queue?

</comment><comment><USER3> This is a great idea. That's why we built it already.

RandomRun for iOS generates random routes for running (or walking / cycling).

[https://itunes.apple.com/us/app/id938354170](https://itunes.apple.com/us/app/id938354170)

<comment><AUTHOR> Cool. This is why lean testing and continually asking for feedback is also a great idea.

</comment></comment><comment><USER4> Okay, before I get on the mailing list of a nonexistent app, tell me more about the idea, because this page is really light on details even for a teaser.

How does it generate its routes? Does it have some information about which routes are good for running, which routes are in sketchy areas that are better to avoid, and which routes take you to busy intersections with a long wait for the signal?

<comment><AUTHOR> Hi rspeer.

Built into the app is an algorithm that takes into account a randomly selected bearing and how far you want to run.

Eventually we'd like to be able to direct runners on more scenic routes, fewer busy roads, etc, depending on their preferences.

There won't be any e-mails going out to the mailing list until the app is released, unless you indicate that you're happy to provide feedback during its development.

<comment><USER5> It would be nice if you could include elevation with the option to choose how flat the route shall be.

<comment><AUTHOR> Yes, that's a great idea. Thank you.

</comment></comment></comment></comment><comment><USER6> Great idea, but i'd adjust the plans. The standard plan covers probably 99% of runners out there who would use this app.

I'd go for the following:

Free plan -pre-generated routes in your local area -5km max -can't save

Standard plan -current feature set -price about £1.99 ish

<comment><AUTHOR> Thanks for the ideas, benlaplanche.

</comment></comment><comment><USER7> imho its an app. You should start giving it for free, get some traction, learn why/how ppl are using it and what they love about it before introducing monetization.

Currently the pricing page is deterring potential users...

<comment><AUTHOR> The plans page is to see whether the app is something that people would consider paying for in the future. Any initial release would be completely free.

Thank you for the feedback.

</comment></comment><comment><USER8> Any plans to extend this for cycling? Been looking for something like this.

<comment><USER9> Try [https://www.komoot.de](https://www.komoot.de). They are creating routes based on popular tracks in various gps portals (like gpsies.com etc.).</comment></comment>


Cook: 'This Is Not What Should Be Happening in This Country' - <AUTHOR> https://www.onthewire.io/cook-this-is-not-what-should-be-happening-in-this-country/ <comment><USER3> The thing I think should be emphasized is that while the majority of the people may now trust the FBI, the NSA, and the US Government in general to do the right thing, this is the same FBI that just a generation ago investigated Dr. Martin Luther King, Jr. as a <strike>terrorist</strike> communist and apparently tried blackmailing him into committing suicide[0]. (The communist threat at that time filled the same place in the American psyche as does the terrorist threat today.) The NSA recently spied on their congressional oversight committee. Without strong controls on government investigative powers, we're just one Herbert Hoover away from a completely unchecked and out of control security apparatus.

It's not about trusting the American government to do the right thing. It's about trusting this government and all future American governments to do the right thing.

EDIT: Also, at least one legal expert estimates that the average American accidentally commits three felonies per day, meaning that most of us are mistaken when we think we don't have anything to hide.[1]

[0] [https://en.wikipedia.org/wiki/COINTELPRO](https://en.wikipedia.org/wiki/COINTELPRO)

[1] [https://en.wikipedia.org/wiki/Harvey_A._Silverglate](https://en.wikipedia.org/wiki/Harvey_A._Silverglate)

<comment><USER4> >It's not about trusting the American government to do the right thing. It's about trusting this government and all future American governments to do the right thing.

But you don't have to trust the FBI or today or tomorrow. The court order doesn't require the FBI have access to the modified software.

Apple doesn't have to trust the FBI at all.

<comment><USER5> What's preventing them (or other government organization) from issuing a second court order to obtain the software?

<comment><USER4> 1) They'd still need the Apple signing key otherwise you can't update the phone. The software, without the key, is totally useless.

2) The same thing that prevents the FBI from subpoenaing Apple's key. There isn't a good legal basis for it. It's almost definitely unduly burdensome for apple to give out their key.

If the FBI were to win a case like that, it doesn't matter what happens in this situation.

</comment></comment></comment></comment><comment><USER6> I think that if the government was asking gun manufacturers to install an electronic lock on guns that would allow the FBI to disable any gun if the suspected the person might be about to commit a terrorist act, there would be a completely different reaction.

<comment><USER7> Those things aren't really comparable. One is a pre-emptive action taken by government before the commission of a crime, the other is a reactive investigation tool. I also suspect your gun example might actually generate more outrage at governmental overreach.

<comment><USER8> Software and hardware are fundamentally different so it's hard to find a close analogy, but if Apple creates this tool (that can be applied to any phone (or at least a large subset of their phones)), it's essentially the same as if the decryption tool were present in every phone, even ones sold before the commission of a crime.

The closest parallel I can think of is the Gun Microstamping law (which would require that bullet casings be stamped with a mark identifying the gun it was shot with). This has (as you might expect) generated a lot of controversy and lawsuits.

[https://en.wikipedia.org/wiki/Microstamping](https://en.wikipedia.org/wiki/Microstamping)

<comment> martin-adams >> but if Apple creates this tool (that can be applied to any phone (or at least a large subset of their phones)), it's essentially the same as if the decryption tool were present in every phone, even ones sold before the commission of a crime.

This concept I find interesting. If Apple did have the _ability_ to create this tool, then is there much of a difference?

I guess the difference is whether Apple were to give such a tool to the FBI, rather than creating it, extracting the data and deleting the tool. But who is to say that some clever individual can't create their own tool to achieve the same thing.

Until Apple deliver on their desire to create phones you can't decrypt, I would therefore consider all iphones vulnerable.

<comment><USER9> Third parties can't do anything because iPhones accept software only if signed by Apple. So Apple is the only one that can create a software that lower its protection level to allow for bruteforce.

And Apple can't decrypt the phone: it can remove the bruteforce counter and/or exponential delay, both of which are paramount parts of the security architecture that requires users to be able to unlock the phone using a 6-digit code (4-digits for non Touch ID phones like that in discussion), which in turn is an important UX compromise to allow to reach the goal of having 90% of 1B iOS devices with passcode lock activated.

Allowing for a remote bruteforce is basically undermining the whole security architecture.

To make a phone that is not bruteforcable, you need to give up on the 6-digit concept, which is already an option (I turned it on on my phone) but it's strongly unlikely to gain widespread acceptance

<comment> martin-adams Thank you, the bit I didn't appreciate was the signing of Apple's software to do this. So yes, only Apple can (but wont) do this, thus making it secure provided Apple don't or aren't forced to change their mind.

<comment><USER8> Once the government can force apple to create software against their will, why do you think they won't also force Apple to hand over signing keys that will let them target any phone they want? I don't see how the slippery slope can end at one phone (and that slope is already sliding to encompass dozens of phones - when it reaches hundreds or thousands of phones, the government is going to decide that they need to be able to target phones on their own, without Apple in the way)

</comment></comment></comment></comment></comment></comment></comment><comment><USER10> I think the FBI might have made a mistake in picking a privacy fight with a gay, middle-aged Alabaman who controls the (2nd) most valuable company on Earth.

<comment><USER11> You forgot to add:

"and whose brand has taken a strong market stance on privacy and security."

I think people expect Microsoft and Google to cave given how cavalier they've been with user data, particularly of late, so seeing them back this is a bit two-faced.

However for Apple, this could have a significant impact on how their brand is perceived in the market depending on how high of a priority the "privacy/security" aspect is with their customer-base. They will fight this as hard as they can because those dollars aren't just wasted legal costs, they are building trust in the brand since they are putting their money where their mouth is.

<comment><USER12> Former Apple employee here. My impression is that Tim and other high level management are really committed to user privacy in a very Jobsian way. It isn't something that's being driven by some marketing person (although they are clearly using it that way). Honestly, I doubt their business would suffer if they caved. It's their philosophy. I saw it at all levels within the company. I think their stance on user privacy is a natural outcome of the need-to-know company culture within Apple.

<comment><USER11> Great point. And I think my comment may have implied more of a "this is a marketing play" message than I intended.

Everything Apple has done over the past few years have really cemented their stance on privacy/security as a top priority, even when it means sacrificing some obvious revenue in the short-term.

A more accurate way to phrase this is I feel privacy and security are now a part of Apple's DNA much like design has been historically. It isn't just what the leadership stands for, it is what the company stands for. So when the question arises internally of "how far do we fight this," I'm left with the distinct impression that the immediate response is "as far as we need to in order to win."

</comment></comment></comment></comment><comment><USER13> Rather this is what should be happening. Principals set forth their arguments, congress steps in and sets the rules which then the courts interpret and settle.

Government and manufacturer and service provider along with the constituency coming to a decision on what should and should not be allowable.

As I understand it, the gov, is setting up a commission to investigate this question, as it should [1].

As for mr Cook, I agree, what he speculates to should not happen, and as far as I know is not happening. He's essentially setting up a strawperson argument when he states: "If a court can ask us to write this software, think about what else they could ask us to write. Maybe it's an operating system for surveillance, maybe the ability for law enforcement to turn on the camera."

[1][http://www.buzzfeed.com/hamzashaban/lawmakers-in-congress- in...](http://www.buzzfeed.com/hamzashaban/lawmakers-in-congress-introduce- bill-to-create-special-commi#)

<comment><USER14> No, the enforcement arms of the government should obey the law and leave making laws to Congress and the constituency. CALEA specifically prohibits government agents from ordering private companies to adopt "any specific design of equipment, facilities, services, features, or system configuration". Congress considered this authority and decided not to grant it to the police.

<comment><USER13> Precisely and this is what is beginning to happen. The congress is now taking up the issue as it should[1]. Mr Cook on the other hand engages in speculation to bolster his case --which is fine but he should also be called out on it.

[1][http://www.buzzfeed.com/hamzashaban/lawmakers-in-congress- in...](http://www.buzzfeed.com/hamzashaban/lawmakers-in-congress-introduce- bill-to-create-special-commi#)

<comment><USER15> I think it's pretty obvious that Cook's statement is speculation. Why "call him out" on it? I think his speculation is actually fairly plausible, but even if I didn't, it's certainly not out of place there.

<comment><USER13> Because it's not all that different from people who speculate that data valuable to the terrorism investigation is on that and other phones. Maybe there is maybe there isn't, but we should not make policy based on speculation.

We should leave policy to policymakers and courts as well of course as constituents' input into the congress.

The question for people, congress and the courts is, should phones be different from other mediums of communications as well as data repositories where warrants cannot be executed to reveal or discover data in the course of a criminal investigation. Will people, the congress and courts decide that data should remain dark or can be revealed by court order. It's rather a basic question.

</comment></comment></comment></comment></comment><comment><USER16> Conspiracy theory warning: might I ask, is there a remote possibility that this is a coordinated attempt by both parties at making the world feel safe about iOS, while this backdoor already exists? Like the allies and decrypted enigma data during ww2, used only in strategic occasions to prevent suspicion? Should we trust a closed-source handset?

<comment><USER17> That would be quite a coordination. I doubt it, because the debate will inform the public about encryption, and there are people watching Apple's moves here who are prepared to call them out if they give anything but the best security in future versions of the iPhone.

Personally I track the software Snowmen endorses and use that as a gauge. You can google that and compare the security features of software out there. The ones snowden uses are open source and have the most security features.

That doesn't say anything about Apple, but the idea that it is coordinated, given Cook's private life and his stance on privacy, seems slim to me. Note also that Apple was the last major company to be forceably joined into the Prism program. They've always been resistant.

</comment></comment><comment><USER18> I now live in America but I know little about laws. Let's forget about Apple and technology.

Let's say that the gunman had a safe in his apartment. FBI can't open it without destroying its content.

FBI (like in others countries) can ask the Company who made the safe for help to open it and that company should help them to do so at its best.

If that company is unable to open the safe, is it admissible (under the current laws) to ask the Company to make a master key?

<comment><USER19> It's unclear if you're trolling, but assuming you're not, the analogy doesn't work because digital things and physical things behave in fundamentally different ways.

In the physical example, according to the FBI's "just this one iPhone" claim, one would reasonably expect that the company could then destroy the hypothetical master key as soon as it's used. This makes sense in a physical world, but the analogy breaks down completely in a digital world. [Returning your spider doesn't solve the problem]([http://www.27bslash6.com/overdue.html](http://www.27bslash6.com/overdue.html)).

In the digital world, you can't guarantee that the key hasn't been copied, and you can't guarantee that destroying the "original instance" of the key destroys all others.

The custom OS that the FBI is asking Apple to build will also take development time, and likely take more than one person to develop, meaning that if there's a security breach during the OS's development, any number of intermediate builds may also be stolen _during development_ , before the FBI can even access the particular phone in question.

<comment><USER4> >In the physical example, according to the FBI's "just this one iPhone" claim, one would reasonably expect that the company could then destroy the hypothetical master key as soon as it's used. This makes sense in a physical world, but the analogy breaks down completely in a digital world.

Why not? Can't apple just delete it?

>In the digital world, you can't guarantee that the key hasn't been copied, and you can't guarantee that destroying the "original instance" of the key destroys all others.

You can't do that in the physical world either. But you can be pretty damn certain that it isn't done.

>The custom OS that the FBI is asking Apple to build will also take development time, and likely take more than one person to develop, meaning that if there's a security breach during the OS's development, any number of intermediate builds may also be stolen during development, before the FBI can even access the particular phone in question.

Apple already takes this risk with every since iOS release.

<comment><USER19> Yes, but leaks of pre-release iOS software can't be installed on locked phones as a means of unlocking them, so the risk is not nearly the same.

If you really want to carry this analogy to term, fine, I'll concede that you can't be 100% sure that a physical key wasn't copied before you destroy it, but then you must take into consideration the complexity of manufacture and duplication - if the complexity of duplication is high, and you only make one, and guard it at all times, you can have a fairly high confidence (barring ridiculous film plots) that the key you're destroying is the only one.

With digital things, the complexity of duplication is beyond trivial. One copy leaks, and instantly there are tens of thousands, if not millions of copies in all corners of the internet. Physical objects simply do not behave this way.

</comment></comment></comment></comment><comment><USER20> So far there is only one person in Silicon Vally who has completely nailed it: [http://video.cnbc.com/gallery/?video=3000495767](http://video.cnbc.com/gallery/?video=3000495767) (Scott McNealy on CNBC this week)

<comment><USER21> about ten years ago, Scott McNealy got in a lot of crap on slashdot for that comment.

it sucks that he was right.

<comment><USER20> Right, but the headline is not the main point of the interview.

</comment></comment></comment><comment><USER22> There's this man-on-the-street video where people at an organic vegetable market are asked to sign a petition outlawing Di-Hydrogen Monoxide. Many do, as they are advised it so corrosive that it cuts through rock!

I'm starting to think gov't spying is the techie's equivalent boogieman. I fear this is born out of a shallow understanding of dystopian surveillance state sci-fi.

Currently, law enforcement can already intercept your calls and emails - <USER2> that means compelling your teleco provider with extra work. They can already come into your house and take anything they want: read any document, open any safe. All provided they have a court order. If they do any of this without a court order then _they_ go to jail. And all the evidence collected illegally gets thrown out from being used against you.

Because we have standards for what can be used as evidence in a trial, we continue to have liberty, not because law enforcement has been kept in the dark technologically speaking. In fact, it's some of the least technologically advanced societies - like N. Korea and Afghanistan (under Taliban i.e. banned music) that come to resemble sci-fi surveillance states.

Finally: your smartphone's logs, your DNA, public surveillance video are far far far likelier to exonerate you if you're innocent than wrongfully convict you. We're thinking about this issue all wrong and technology will continue to play a role of helping the traditionally disenfranchised resist police over- reach - think what portable cameras have done to police interactions already.

</comment><comment><USER23> Remember Steve Job's vision for Apple has always been a closed system end to end... He was security minded before the net. It is a shame that the government has taken the low road by trying this case in the court of public opinion after they permanently locked themselves out of the iphone! The worse part is using the grieving victim's families to make Apple look like the bad guys. I kind of wish Job's was alive for this fight! Tim Cook can't say it, but 14 people killed by some kooks vs millions of people's safety being intentionally compromised is not a bargain. 14 people die in mass shooting Damn near every month! What happened to good police work? Doesn't the NSA have everyone's communication data on a server somewhere anyway? If the government in the business of ordering businesses to work against their interest for the sake of public safety, where is the court order for tobacco companies to permanently stop selling cigarettes. Cigarettes kill hundreds of thousands of people each year. Luckily Apple is sitting on enough cash to fight this... I just hope their stock price and future aren't hurt by this deliberate attempt to assassinate their brand.

<comment><USER17> > the government has taken the low road by trying this case in the court of > public opinion

But they're not.. They're trying the case in front of unelected justices. The court of public opinion would be to create a law with Congress, and give us a chance to elect people who will represent our views.

</comment></comment><comment><USER24> Security is a huge for advancement and social progress as well as business secrecy for innovation and market timing.

This hits the broad political spectrum and I can't believe our War on Terror has led us here. We now (legally somehow?) have internal systems that attack our own freedoms much greater than any terror attack could, it is the legislation after the fact that has taken our freedoms.

We are here now, where a company has to go public to get back to the old real freedom ways of the Fourth Amendment, to be secure in your papers (data). That was written for a reason at a time when people might try to take advantage of powers to protect people. This is a frontline battle.

Thank you Apple, the new killer feature is security...

 _The right of the people to be secure in their persons, houses, papers, and effects, against unreasonable searches and seizures, shall not be violated, and no Warrants shall issue, but upon probable cause, supported by Oath or affirmation, and particularly describing the place to be searched, and the persons or things to be seized._

</comment><comment><USER25> Here's how I see it:

Unless congress is willing to outlaw the ability of Apple (or any OEM) to securely architect their phone hardware such that it is _impossible_ for them (the OEM) to be helpful to law enforcement, this issue will soon solve itself. These OEMs simply do not want to be in the middle of these investigations.

</comment><comment><USER26> Tim Cook has the future of technology on his side. His opposition is tilting at windmills.

</comment><comment><USER27> It isn't a strawman, though. That's what they were trying to enforce.

</comment><comment><USER17> The article doesn't tell the complete story of Cook's position.

I would instead summarize by saying that Tim is not afraid to call out the government on their lack of communication skills, and he admits his discomfort of the position he is in.

Here are some relevant excerpts from the interview [1]

\</comment><comment></comment><comment></comment><comment>----

15:12

David Muir: You have talked to the President before on these issues [yes] of privacy and security. Are you disappointed there wasn't more of a dialog with the administration before this swift action from the justice department?

Tim Cook: Yes.

David Muir: You wish there was more done?

Tim Cook: Yes. And I think there should've been... We found out about the filing from the press. And, I don't think that's the way it should be run. And I don't think that something so important to this country should be handled in this way.

\</comment><comment></comment><comment></comment><comment>---

26:00

David Muir: I'm curious Tim. Did you ever think that you would find yourself at the center of such a crucial national debate?

Tim Cook: No. This is not a position that we would like to be in. It is a very uncomfortable position. To oppose your government on something doesn't feel good. And to oppose it on something where we are advocating for civil liberties which they are supposed to protect, it is incredibly ironic. But this is where we find ourselves. So for all of those people who want to have a voice, but they're afraid, we are standing up. And we are standing up for our customers because protecting them, we view, is our job. And I hope, and I think, I'm very optimistic, I think we will come together. I don't know what will happen. But I think we will come together and there will be one path forward. The US always comes out of these things well. I feel very good that the debate is going on. Even when people disagree with us, it is good that the debate is happening. That's what makes this country so special.

David Muir: And for you, personally, has this been the biggest challenge in being CEO of Apple that you've faced?

Tim Cook: I've faced a lot of challenges. But I've never felt, sort of the government apparatus. And so yes I would say this is right up there. But it's not my sole focus by any means. We're focused on making great products.

David Muir: ... Are you prepared to take this all the way to the supreme court?

Tim Cook: We would be prepared to take this issue all the way, yes. Because I think it's that important for America. This should not be decided court by court by court. If you decide that it's okay to force a company to do something that they think is bad for hundreds of millions of people. Then, think about this for a minute. This case is an awful case. There is no worse case than this case. But there may be a judge in a different district that feels that this case should apply to a divorce case. There may be one in the next state over that thinks it should apply to tax case. Another state over it might apply to a robbery. And so you begin to say, wait a minute, this isn't how this should happen. If there is going to be a law, then it should be done out in the open for people so their voices are heard through their representatives in congress.

David Weir: And if congress decided that there's this small category, this was a terrorist's iPhone. If congress decided that, if the American people signed off on that, you'd entertain it.

Tim Cook: Now let me be clear. At the end of the day, we have to follow the law. Just like everybody else, we have to follow the law. What is going on right now is we're having our voices be heard. And I would encourage everyone who wants to have a voice and wants to have an opinion to make sure that their voice is heard.

[1] [http://abcnews.go.com/WNT/video/exclusive-apple-ceo-tim- cook...](http://abcnews.go.com/WNT/video/exclusive-apple-ceo-tim-cook-sits- david-muir-37174976)

</comment><comment><USER28> If Tim Cook wants this not to happen in this country (or anywhere), then he needs to ensure that future Apple products are sufficiently secure that he can say, "there's nothing I do to help - this device cannot be broken into by any method we know of."

<comment><USER29> That doesn't actually prevent the government from issuing orders with dire consequences for violation to manufacturers to break into devices on behalf of the government, it just means that such orders will leave manufacturers no choice but to accept the dire consequences -- and, if they can't, to stop manufacturing devices that they can't break into.

<comment><USER28> True.

But if you accept that evolution of the internet in this direction in inevitable and a natural process of history, then this is like saying that "there's nothing stopping the government from issuing orders that gravity be temporarily disabled."

<comment><USER29> > But if you accept that evolution of the internet in this direction in > inevitable

I don't accept that the evolution of the internet in the direction of consumer devices with manufacturer-unbreakable security is inevitable, _particularly_ in the face of governments actively punishing manufacturers for failing to break into devices at the governments' demand.

In fact, I would argue that such an evolution is _quite_ evitable.

<comment><USER28> We'll see. :-)

</comment></comment></comment></comment></comment><comment><USER30> Do you think this would be happening if this was an IBM product and Cook was in charge of IBM instead of Apple? I think the corporation itself brings out some real politico-cultural prejudices in people.

<comment><USER17> Different companies have different values which foster different cultures and attract different people to work there. Apple's credo is think different. I've no idea what IBM's was or if they were friendly with the government in their heydays but it's an interesting question whether or not they were friendly with the government back then on intelligence matters.

</comment></comment><comment><USER31> After the Arab spring does anyone believe that internet freedom will continue as it did before anywhere?

</comment><comment><USER32> Cook should play the card he has: Cook is known to be gay. What if "being gay" was illegal and then the government wanted to "find all the gays and round them up".

He should use that card as his last straw. THAT should help people understand the nefariousness of this matter.

<comment><USER33> I imagine that the subset of people who are in the "save lives, stop helping the terrorists" camp are generally not in the "worry about gay people under a hypothetical future government" camp.

<comment><USER32> Hahaha I'm sure you're correct. Too back Tim Cook isn't Jewish.

</comment></comment></comment><comment><USER34> [https://www.youtube.com/watch?v=T4YtgA2jnu4](https://www.youtube.com/watch?v=T4YtgA2jnu4)

America is undergoing subversive actions by foreign government agent influencing America's corporate elites.

</comment><comment><USER32> The ABC interviewer is a fucking shill.

"Dont you think this phone could save lives??"

That guy is literally asking questions written by the USG.

It is completely transparent that ABC is shilling for the USG.

</comment><comment><USER35> Apple to FBI: "Here's an ELI5 on how the All Writ's Act is supposed to work"

</comment><comment><USER36> Hopefully Trump doesn't get into power and sends Tim to Guantanamo!

</comment><comment><USER37> I'm still not convinced Cook is right. This phone may very well contain information which could save a lot of lives.

According to the article, the ballpark is 2 weeks of engineering, so it is probably done in less time.

Why so quickly? Because the user used an extremely weak password.

Security is also the responsibility of the user, not only the tech companies. If you are really concerned with your own privacy, than you shouldn't encrypt your data with a 4 digit passphrase which is relatively easy to crack.

Considering the commited crime, and the relative ease of cracking the phone I'm in favor of the FBI. As long as the firmware is not handed over to them, but that should be possible I presume.

People worrying about Apple engineers smuggling the software outside should be worried everyday. People with access to the codebase can do this probably allready.

<comment><USER38> It obviously is not about this particular phone, but if you are still convinced that is the case nothing I will say will make you move.

The real reason is the millions of other phones out there. If there was any indication that this couple was acting as the vanguard of a large number of others acting in a similar way what exactly do you think the chances are that that data would be left on a phone when they took the effort of destroying their other phone?

This is the prelude to a large number of fishing expeditions and it seems the FBI made this particular effort possible by first _ordering_ a third party to make it impossible to reach the data in any other way. If they actually cared about that data you'd think they had contacted Apple right away about the best possible way to get it out without bringing this to a head over a terrorist case where lots of panicky people would make the wrong decision out of fear.

If you really are concerned about your privacy: don't store your important stuff in a phone or a computer for that matter.

Ironically, terrorists on a suicide mission don't need ironclad encryption. They just need to stay ahead of the law long enough to do their deed and to make sure the data flows in only one direction through their organization without leaving a source address for any transmissions. So for actual terrorists that are even remotely looking at their operational security they could be transmitting at the same level within their cell in plain text using a few silly code words and you'd only know what they were up to when the ambulances arrived.

<comment><USER37> If I understand you correctly, you think the FBI deliberately got the phone in a worse state, so there was a necessity to get new firmware?

<comment><USER38> No, I'm not saying that. I'm saying that they caused the situation to exist in the first place, whether or not it is deliberate is anybody's guess at this point in time.</comment></comment></comment></comment>


Nokia Prototype Generates Power from Ambient Radiation - <AUTHOR> http://wap.dailytech.com/mobile/Article.aspx?newsid=15382

<comment><USER2> pacemaker batteries that last forever and never need replacement

<comment><USER3> I would think a pacemaker battery could be charged off the body itself better and more efficiently than via ambient radiation, but I'm no expert in the field.</comment></comment>


Steve Cohen Said to Eye Computers to Model Top Traders' Thinking - <AUTHOR> https://www.bloomberg.com/news/articles/2017-03-15/steve-cohen-said-to-eye-computers-to-model-top-traders-thinking <comment><USER2> This makes me think of Liars Poker. There may not be anything special about what the traders are doing. They could just be in the right place at the right time.</comment>


Complex Behavior from Simple SubAgents - <AUTHOR> https://www.lesswrong.com/posts/3pKXC62C98EgCeZc4/complex-behavior-from-simple-sub-agents <comment><USER2> I did not enjoy this read; drawing conclusions about humans from simple systems is most often as true as an exercise in astrology.

>I don't personally think humans explicitly look ahead very often. We give ourselves credit as the "thinking, planning animal", but we generally just make whichever choice corresponds to the highest expected valence in the current moment.

Really? Do you clean your teeth? work a job you hate? pay your taxes?

<comment><USER3> A fair point, but I do think theres a limit- from the few years I spent in retail I came to the realization that a majority of people have near zero critical-thinking or problem solving skills.

For instance, we had these kiosks where someone could sit down and order printouts of photos on their phone. There is a touch screen with _very_ clear instructions: "touch here to begin", "plug in your phone with the appropriate usb cable below", "tap the button that has the photo choice you want". Without fail, I would say near 80% of customers would sit down, look at the screen, and call an employee over asking "what do I do?" for every step, even if they've come in before and been shown already. It was mostly older folk, but there was still a good portion that were younger.</comment></comment>


20 years in the making, Visual Studio 2017 is faster, leaner, devops-ier - <AUTHOR> https://arstechnica.com/information-technology/2017/03/20-years-in-the-making-visual-studio-2017-is-faster-leaner-devops-ier/ <comment><USER2> Visual Studio 97 also had Visual Interdev to make ASP pages. It also used Visual Source Safe for version control.</comment>