Running an independent Arch Linux rebuilder - <AUTHOR> https://lists.reproducible-builds.org/pipermail/rb-general/2020-April/001905.html <comment><USER2> I never got around to submitting my blog to HN. But if people are curious about some technical details of the underlying problems of reproducing Arch Linux packages I wrote something a few months ago.

[https://linderud.dev/blog/reproducible-arch-linux- packages/](https://linderud.dev/blog/reproducible-arch-linux-packages/)

EDIT: I did self-discover I did submit the article when I wrote it. Just forgot. Oh well :)

</comment><comment><USER3> This is fantastic to see. Reproducible builds adds yet another layer of trust on top of open source software. The wiki page is also classic Arch Wiki-style, with all the detail one would expect. Every OSS project should strive to be this helpful.

</comment><comment><USER4> I care more about if maintainers actually audit the contents of packages rather than if their builds are reproducible (though the latter still matters)!

Not just is there obvious malware, but also are there obvious vulnerabilities, is the person that wrote it of good nature / located in a country where they're safe from nation state pressure, is there a lot of history behind the app.

Obviously this is too much work for any individual and requires a chain of trust. I believe fedora and Ubuntu at the very least audit to some extent but I've never seen any doco.

<comment><USER5> Just curious, are you saying there is obvious malware within the Arch official repositories? Are you referring to instead the user repositories (AUR)?

I know Arch has: [https://wiki.archlinux.org/index.php/Arch_Security_Team](https://wiki.archlinux.org/index.php/Arch_Security_Team)

but I'd be really interested to hear that the official packages have obvious malware.

<comment><USER6> I think they intended the phrase as a question; they're proposing that a maintainer should not just ask "is there obvious malware in this package?", but also several other questions (which they list afterwards).

<comment><USER4> This is the correct interpret

</comment></comment></comment></comment><comment><USER7> Debian have done a huge amount of work in this area - [https://wiki.debian.org/ReproducibleBuilds](https://wiki.debian.org/ReproducibleBuilds)

<comment><USER8> I believe the whole reproducible-builds.org project started at Debian [0], the Core Team is still all made of Debian Developers, more information at: [https://reproducible-builds.org/](https://reproducible-builds.org/)

Their documentation has some really good pointers at common issues and how to solve them: [https://reproducible-builds.org/docs/](https://reproducible- builds.org/docs/)

And the diffoscope tool is very useful for debugging.

[0] I believe other projects had similar things going on but the Debian one became the main to serve as an umbrella.

<comment><USER9> Some more reproducible builds history (it has been around since at least the 1990s):

[https://wiki.debian.org/ReproducibleBuilds/History](https://wiki.debian.org/ReproducibleBuilds/History)

</comment></comment></comment><comment><USER10> Based on my reading of this Arch wiki page[0], it looks like this doesn't impact packages in the AUR. Does anyone who is more familiar with this know if that is true? It appears that it does work for community packages though (see the bottom of this page[1]).

[0] [https://wiki.archlinux.org/index.php/Rebuilderd](https://wiki.archlinux.org/index.php/Rebuilderd)

[1] [https://wiki.archlinux.org/index.php/Rebuilderd#Syncing_pack...](https://wiki.archlinux.org/index.php/Rebuilderd#Syncing_packages_to_rebuild)

<comment><USER11> AUR packages are source only so there's no binary package that is distributed to be verified.

<comment><USER12> that's only mostly true.

take for example the aur package for MS fonts; [https://aur.archlinux.org/packages/ttf-ms- fonts/](https://aur.archlinux.org/packages/ttf-ms-fonts/)

all it does is download a ton of microsoft corefont executables to unpack.

another example would be the proprietary driver packages, like the nvidia ones.

<comment><USER13> proprietary drivers from nvidia are provided by the Arch mainline (core) though?

<comment><USER12> right you are, i've been on beta for years and had forgotten.

point still stands, aur does distribute executables once in awhile.

<comment><USER14> > aur does distribute executables once in awhile.

The AUR doesn't distribute those executables; it distributes the instructions for the user (or some software working on behalf of the user) to go fetch the executables themselves. This is an important distinction, because the official Arch repositories _do_ distribute executables, directly to the user.

</comment></comment></comment></comment></comment></comment><comment><USER15> Interesting to see [https://github.com/kpcyrd/rebuilderd](https://github.com/kpcyrd/rebuilderd) in Rust. Is this the first Arch project in Rust?

<comment><USER16> I guess,.. but this FOSDEM we hacked on more Rust based tooling :-)

[https://github.com/archlinux/rebuilder](https://github.com/archlinux/rebuilder) [https://github.com/archlinux/signstar](https://github.com/archlinux/signstar)

</comment></comment><comment><USER17> This is very good news. I was wondering recently just how to do this, as I wanted to build everything with some different compiler configuration.

</comment><comment><USER18> The wiki says:

> a large number of builds are not reproducible yet

<comment><USER2> Yes. But a staggering amount of packages in the main [core] repository is still fully reproducible by independent parties if tools are run.

[https://wiki.archlinux.org/index.php/DeveloperWiki:Reproduci...](https://wiki.archlinux.org/index.php/DeveloperWiki:ReproduciblePackages)

It's still very much a work in progress.</comment></comment>


Official Reddit mobile apps (Android, iOS) - <AUTHOR> https://www.reddit.com/r/announcements/comments/4dqxgt/reddit_mobile_apps/ <comment><USER2> I wonder how the ads will look like after users 3 months of reddit gold expires. I also wonder if the 3rd party reddit clients will also see ads, or we'll see a drastic API change to bring everyone to the official client and gold subscription instead. Hope this won't turn into Twitter API woes.

<comment><USER3> > Hope this won't turn into Twitter API woes.

It will, the motivation behind this app is not improving mobile reddit experience (already very good), it's monetizing quickly growing and currently unmonetizable mobile users. So they will either make people to move to their app or find a way to monetize 3rd party apps.

</comment></comment><comment><USER4> Somewhat related: Does someone know what happened to the official AMA app for Android? It can't be found on the Play store anymore, but I still have it installed. I tried googling for info about it disappearing but came up empty. (It's a bit broken nowadays, questions and answers aren't loading. But I can still see the AMAs.)</comment>


Plastc may file bankruptcy and will cease operations April 20, 2017 - <AUTHOR> We Regret to Inform You...
For the past 3 years, our mission here at Plastc was to build and deliver the most technically ambitious smart card on the planet. After making enormous leaps in development, product innovation and progress towards our goal, Plastc has exhausted all of its options to raise the money it needs to continue.
Plastc, Inc. is exploring options to file Chapter 7 Bankruptcy and will cease operations on April 20, 2017.
While we have fallen short of our goal, we are proud of our team and the effort that went into developing a working Plastc Card. However, without the necessary capital to continue, all employees have been let go, which means that Customer Care and Social Media channels are unmanned or have been shut down.
How We Got Here:
We were expecting to close a $3.5 million Series A funding round on February 28, 2017. There are functioning Plastc Cards, which were demonstrated to our investors and our backers, and the capital was to be allocated for the mass production and shipping of Plastc Cards to pre-order customers. At first, the principal investment group postponed their investment and a couple of weeks later the round fell apart.
After the initial funding was unavailable, Plastc made progress with another investor who offered $6.75 million. This deal was scheduled to close last week and would propel development across the finish line, as well as allow for Plastc Card pre-orders to be shipped and for production to continue into a retail phase.
However, once again at the very last minute, our investor gave us notice that they have decided rescind their investment offer. The round was a signature away from closing and we were extremely caught off guard when they notified us yesterday they were backing out. Our existing investors kept us alive and functioning as long as they could during this fundraising process, but in the end, we needed new outside capital to get into production.
[..abridged..] see https://plastc.com/ for full copy <comment><USER2> Interestingly, from a competitor's web site:

"With the acquisition of Coin by Fitbit, all business operations ceased on June 13, 2016. The company is no longer manufacturing, promoting, or selling any new devices or products."

I think that just leaves Swyp (which isn't launch yet) and Stratos.

</comment><comment><USER2> Well that's $155 down the drain.</comment>


Books on setting up a start up step-by-step? - <AUTHOR> Something like startups for dummies? <comment><USER2> In order of personal preference:

1) The Launch Pad: Inside Y Combinator, by Randall Stross

2) The Founder's Dilemmas, by Noam Wasserman

3) The Hard Thing About Hard Things, by Ben Horowitz

4) Zero to One: Notes on Startups, by Peter Thiel, Blake Masters

5) Venture Deals, by Brad Feld, Jason Mendelson (I haven't read, but heard good things about it)

ps: title is missing "ASK HN".</comment>


RadioSumo - <AUTHOR> http://radiosumo.com <comment><USER2> Just giving it a shot, but I'm stuck on 'initializing'. Android 6 (marshmallow) using chrome.

I am curious about your 'making radio relevant again'. Is the target market radio listeners?

I'm thinking a more 'forward looking' appeal may be around podcasts. But without being able to use the app, I can't really judge. Just my 2c, I think radio has already been dead for a long-time, how many people born after 2000 have ever owned or been active radio listeners?

<comment><USER2> Ok, I got it to play, I had to hit the 'skip' button, so it looks like you may have a bug. It sat at initializing for a few minutes doing nothing.

Now that I've heard it - I listened for about 10 seconds - I think this is not usable. I wouldn't want to listen to the automated voice for any more than I did, and it seems it was just giving me headlines. I wouldn't want it to read me an article in that voice.

<comment><AUTHOR> Thanks for the feedback! That's what we're trying to test out - whether the TTS is something you'd trade in exchange for having real-time news read back to you while you drive to/from work.

</comment></comment></comment><comment><AUTHOR> Experimenting with something that makes your drive to/from work a bit more productive. And keeps you safe at the same time. Let me know what you think.</comment>


Orbcontrol is Facebook Smartlists on Steroids - <AUTHOR> http://orbcontrol.com

<comment><USER2> You can actually see the interests that definite each social group. My friends from Poker Night all have "poker" listed in their shared common interests.

</comment><comment><USER3> There's also a table mode, where you can see your smart lists in a table, as opposed to clumps of photograph in space.

<comment><USER4> Being able to move/copy people from smartlist column to another is convenient. Facebook doesn't let you do that.

</comment></comment><comment><USER5> Really cool! I love how you can visualize your social clusters in 2D space, and how they relate to each other.

</comment><comment><USER6> Their newsfeed lets you keep track of what happening in an smart lists, in parallel...convenient!</comment>


Radiotrophic fungus - <AUTHOR> https://en.wikipedia.org/wiki/Radiotrophic_fungus <comment><USER2> > Radiotrophic fungi were discovered in 1991 growing inside and around the > Chernobyl Nuclear Power Plant.[1]

The original study is open access and is worth reading. Here's an interesting little review:

> The literature already contains some indirect evidence for the notion that > radiation can enhance the growth of melanized microorganisms. For example, > the melanotic fungus C. cladosporioides manifests radiotropism by growing in > the direction of radioactive particles and this organism has become widely > distributed in the areas surrounding Chernobyl since the nuclear accident in > 1986 [7]. Both in the laboratory and in the field several other species of > melanized fungi grew towards soil particles contaminated with different > radionuclides, gradually engulfing and destroying those particles [35], > [36]. In addition, there are recent reports that certain life forms can > utilize non-conventional forms of energy - microbes in geothermal vents at > the bottom of the ocean can harvest thermal radiation as an energy source > [37] while some microorganisms living in mines exploit energy from > radiolysis of water [38]. On the basis of these precedents and the results > of this study we cautiously suggest that the ability of melanin to capture > electromagnetic radiation combined with its remarkable oxidation-reduction > properties may confer upon melanotic organisms the ability to harness > radiation for metabolic energy. The enhanced growth of melanotic fungi in > conditions of radiation fluxes suggests the need for additional > investigation to ascertain the mechanism for this effect.

[https://www.ncbi.nlm.nih.gov/pmc/articles/PMC1866175/](https://www.ncbi.nlm.nih.gov/pmc/articles/PMC1866175/)

In particular the part about growing towards contaminated particles, "engulfing and destroying" them, seems like a finding with enormous practical potential.

<comment><USER3> I too was fascinated by that statement. How does it destroy them? Is it extracting energy faster than would be let off in vacuum? Or is it an encapsulation?

<comment><USER4> I presume that the fungi grow toward the source of radioactivity until they engulf it, and it is not destroyed, but instead segregated and more easily separable from the environment by bio-accumulation.

I.e. if you seed radioactive soil with radiotrophic fungi, wait a few years, and then mechanically separate fungus from soil particles, the separated soil would be less radioactive than it had been previously.

<comment><USER5> Presumably, though, other surrounding places will be more radioactive than before?

<comment><USER4> The fungus itself will be more radioactive than background.

I don't believe neutron activation is significant anywhere on Earth outside the containment of a fission reactor, power research facilities, or nuclear bomb tests. So mostly, places slowly become less radioactive over time unless you get radioactive particulates from one of the aforementioned sources, or from a natural concentration, and release them into the environment somewhere.

Bio-accumulation can occur, such as the naturally radioactive potassium in a banana, but that's just shifting around the radioactive materials already present in the environment.

Wherever you dump the fungus, or the ashes of the fungus, will be more radioactive than before. So a bio-remediation plan would likely grow fungus, separate most of it from the soil, and allow the remaining fraction to regrow, repeating as necessary. The separated fungus would be burned, and any radioactive fractions removed from the exhaust gases and dissolved in liquid or crystallized somehow. The ash would be vitrified into glass pellets.

And then it'd probably still be less radioactive than an asphalt parking lot. But okay, seal it all up inside a drum and forget about it for 10000 years anyway.

<comment><USER6> You must have never went to a place with active radon gas venting... Or to the mountains.

Of course significant is in eye of the beholder, but those places do exceed typical background doses a lot.

<comment><USER4> Uranium -> thorium -> radium -> radon -> ... -> lead is a natural decay chain that does not typically activate other atoms to become unstable, so the decay energy between uranium and lead represents all the radioactivity there will ever be from that uranium. You can't predict exactly _when_ it will be released, and because radon is a gas, you can't as easily predict _where_ it will be released, but once you get to stable lead, it's done.

If you tack up a slab of any stable nucleus higher than iron on the nuclear binding energy curve to the inside walls of a neutron chain-reaction reactor, you can probably get it to absorb neutrons of the appropriate speed and become unstable, promising future radioactivity with an amount of energy between its current state and whatever its final decay product may be. That may be less total energy than the difference between uranium and lead, but it probably runs faster from start to finish than billions of years, and is probably more energy than the absorbed neutron.

So aside from natural reactors, which mostly shut down a long time ago, the only increases in radioactive potential are going to be from human-built reactors. The radon is just moving primordial radioactive potential from where the radium is, which is also where the uranium or thorium is, to wherever heavier-than-air gases can accumulate. If you remove the radium, you stop that. If you encapsulate the radium in a glass that traps gas, you stop that.

Mostly, we don't bother trying to remove trace amounts of uranium and other radioactive isotopes from mineral resources, but if a fungus could do it cheaply, it could make coal ash less dangerous to process and store.

</comment></comment></comment></comment></comment></comment></comment><comment><USER7> If you're interested in funghi, I recommend Joe Rogans podcast with Paul Stamets, funghi seem to be able to do many things: [https://www.youtube.com/watch?v=mPqWstVnRjQ](https://www.youtube.com/watch?v=mPqWstVnRjQ)

<comment><USER8> Ammusingly, Paul Stamets is the name of a scientist in the newest star trek series. He is an astro-mycologist and apparently they named him for this real scientist.

<comment><USER9> the character is named after him.

<comment><USER10> The comment you are responding to says that.

<comment><USER11> So long as we're correcting people, no. The comment in question says "apparently" the character was named after him. Someone replied that was in fact the case. Then you came along and shamed the person for confirming it.

<comment><USER9> for what is worth the parent comment I responded to was: "Ammusingly, Paul Stamets is the name of a scientist in the newest star trek series." The clarification was added afterwards, but who cares. if people want to downvote me, go ahead :)

</comment></comment></comment></comment></comment></comment><comment><USER12> How fast do these fungi grow?

Might they be a future food source? Radioactive materials could be coated in an inert material and made into pellets which would be easy to filter from the final resulting food.

</comment><comment><USER13> Meanwhile we use can use gamma radiation only by converting first to heat.

<comment><USER14> Really

Most of our "energy generation" is still based on 19th century physics

Sure heating stuff and turning water into steam is easy, but it might not be the most efficient way of turning some sources into energy

<comment><USER15> This has always bothered me. To think that we can induce nuclear fission, but then can't actually use the generated energy without boiling water and using it to turn a turbine!

<comment><USER16> Sometimes we just stumble onto a near ideal solution early. A chain on a cog for a bike drive for instance. People keep trying other things but they are all less efficient.

<comment><USER17> This is more efficient:

[https://www.digitaltrends.com/outdoors/ceramicspeed- chainles...](https://www.digitaltrends.com/outdoors/ceramicspeed-chainless- bike-drive/)

It's a shaft with a weird gear at the end. The gear teeth spin on ball bearings.

<comment><USER18> According to whom? The manufacturer?

This company is known for selling snake oil products to amateur cyclists.

When I see this on Tour de France I'll believe it.

<comment><USER19> competitive cycling doesn't let racers use whatever setup they want for their bikes.

if something is too good, like the really aerodynamic handlebars, they won't be allowed

<comment><USER20> Aero is quite regulated. So you can't play with wheel size, or various non- traditional bike designs. But other things seem like fair game, tweaks to geometry, different bearing technologies, new bearing races, electric shifting, disc brakes, etc.

The spirit of racing is that the race should be won largely by the best bicyclist, not the best bicycle. I'd expect a more efficient transmission would certainly be considered.

<comment><USER13> Disc brakes were also banned for pretty long.

<comment><USER20> Right, but aren't now. Progress is being made, fortunately mountain bikers (and their organizations) are much more open to progress.

</comment></comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER21> I wonder if there's any possibility of genetically engineering the fungi and using them to extract more energy from contaminated areas and nuclear waste as a form of biofuel. That would be quite an interesting way to use nuclear waste.

<comment><USER22> If someone does this, _please_ name your gamma radiation absorbing fungi "The Hulk". :)

<comment><USER23> ...with the corresponding scientific name would be "Brucea Banneriolus".

</comment></comment></comment><comment><USER24> On a related note, I wanted to mention "mycoremediation", a "fungi-based technology to decontaminate the environment" [0].

In particular, I learned in the wake of the Fukushima incident that the mycologist Paul Stamets suggests an unusual plan to remove radioactive and other pollutants from soil/land. [1]

[0] [https://en.wikipedia.org/wiki/Mycoremediation](https://en.wikipedia.org/wiki/Mycoremediation)

[1] [https://www.permaculture.co.uk/articles/using-fungi- remediat...](https://www.permaculture.co.uk/articles/using-fungi-remediate- radiation-fukushima)

</comment><comment><USER25> Given the fact there's hardly any such radiation in the wild, does that mean they evolved that ability just within a few decades? If so, that would be quite astonishing as it seems pretty different from other biochemical mechanisms (e.g. photosynthesis).

<comment><USER26> Humans did not invest radioactive decay. We merely discovered it.

<comment><USER25> Of course, but the radiation caused by artificial reactors (and their leftovers) is magnitudes higher than anything in the wild.

</comment></comment></comment><comment><USER27> I'm surprised no one here has mentioned the post-apocalyptic platformer, Mushroom 11. Radiotrophic fungus lends a lot of credence to a game where you guide a mycelial glob through the remains of a nuked landscape.</comment>


Goosh - the unofficial google shell - <AUTHOR> http://www.goosh.org/

<comment><USER2> It is a pretty fascinating idea and I like that it allows you to see a running history of all the things you have searched or queried. I tried using the login feature and it accepted my Google credentials but didn't seem to do anything. Hope I didn't just feed my password to a phishing site.

 _Goes off to change password proactively._

</comment><comment><USER3> So, can I get it merged into my shell somehow?

</comment><comment><USER4> I'm seeing it for the first time and looks nice. I wish I could have it on my command-line though. Is that too complicated.

There was no download, so I'm assuming its something hosted.

</comment><comment><USER5> super interesting. it is a possibility for some people that access the web from a slow conection. All they need is access the shell and enter commands for get the results from web.

</comment><comment><USER6> This is pretty cool too: <http://keyboardr.com>

<comment><USER5> The navigation in the results of search, using keyboard, more specifically, the arrows, is a great idea! it is a simple and easy.

</comment></comment><comment><USER7> kinda old

<comment><USER8> True enough.

<http://news.ycombinator.com/item?id=206683>

</comment></comment><comment><USER9> Fine idea, but using 3rd party cookies limits its compatibility.</comment>


Who Wants a Pre-Owned Space Shuttle? Everyone. - <AUTHOR> http://www.nytimes.com/2011/03/09/science/space/09shuttle.html

<comment><AUTHOR> would be funny if it was someone like Richard Branson or John Carmack vying for these instead... to burn them!</comment>


Porn Set Free: Age Record Keeping Deemed Unconstitutional (Title 18 U.S.C. 2257 Struck Down?) - <AUTHOR> http://www.techcrunch.com/2007/10/24/porn-set-free-age-record-keeping-deemed-unconstitutional/ <comment><USER2> Why does YC not accept applications that have anything to do with porn? Do you find it distasteful, or is it a PR decision?

<comment><USER3> Where do we say that?

<comment><USER2> I remember seeing it in one of your comments Paul. Am I mistaken?</comment></comment></comment>


AVRIS, the USDOT's bold initiative to upgrade roads for self-driving cars - <AUTHOR> https://medium.com/@MarcHoag/avris-the-usdots-bold-initiative-to-upgrade-roads-for-self-driving-cars-7c342cd3a520#.7wk6m1lia <comment><USER2> > ... using solar panel road surfaces, with excess charge stored in giant > capacitors and used to heat the road surface...

 _Ouch_ for anyone with rudimentary EE knowledge. Perhaps with kilometer-thick capacitors under the road... they by far don't have the capacity to do this.

And staying on road with snow-covered markings will be likely solved by relying on GPS, if it's not already.</comment>


Credit Suisse Fund Liquidated, ETFs Halted as Short-Vol Bets Die - <AUTHOR> https://www.bloomberg.com/news/articles/2018-02-06/credit-suisse-is-said-to-consider-redemption-of-volatility-note <comment><USER2> TLDR, a bunch of people lost their money placing a bet on a number that comes out of a complicated formula involving stock prices.

The article's handwringing because their number might have included "novice retail investors" who didn't understand what they were buying, and only bought it because it's been a winning bet for a while.

If you don't fully understand a financial or investment product, you shouldn't buy it. Financial products involving words like "leveraged" or "options" or "cash-settled futures" are quite often more like bets than investments, and you should only trade them if you fully understand the product you're trading and are willing to accept that losing the bet may mean losing all the money you put in.

</comment><comment><USER3> If you're using leverage, and not able to lose more money than the fixed amount of shares you purchased, how else would it work?

These instruments are a way to do fancy portfolio balancing, not bets and speculation. You'll need "real" leverage where you can come out in the negative instead of $0 to do that.

</comment><comment><USER4> Can someone help me understand what this is?

<comment><USER5> TL;DR leverage is dangerous.

"Vol" means "volatility" which is a measure of how much the market moves over some interval of time. If the markets are getting more stable, it goes down, if markets are more choppy or have a higher varianceit goes up. Companies created funds, called ETFs or ETNs that let buyers bet on volatility. These funds are super easy to buy from any brokerage.

These funds were leveraged, which means they are based on bets against the underlying VIX index. This allowed them to move multiples of what the VIX moved, 2x or 3x as much.

The markets have been super calm so people were buying these funds that returned a lot of money if the market stayed calm. All of the sudden on Monday the market moved a LOT. The DOW dropped something like 1500 points and then bounced back 700 points within something like 15 minutes.

This caused the leveraged "short vol" funds - funds that were designed to move opposite multiples of the VIX (VIX moving not much made the value rise, VIX moving a lot made them fall) - to lose so much money so fast that the companies had to close them down. Billions of dollars lost in tens of minutes.

Hope that helps. I'm not an expert but that's how I understand it.

<comment><USER6> I think is more like "tl;dr read the fine print"; not about the leverage. I think the rules of that particular note stipulate that 80% drop in value (it dropped more than that) triggers liquidation event. So you can't wait out the plunge. If I understand correctly Credit Suisse walks away, closes down their hedges, most likely loses nothing. And your shares go to 0.

<comment><AUTHOR> And they charge you expense for 8 years, which is how they make money.

</comment></comment></comment></comment><comment><USER7> Stock twits co-founder is mad about this [https://twitter.com/howardlindzon/status/961094748151918592](https://twitter.com/howardlindzon/status/961094748151918592)</comment>


Ask HN: Is there a reason why coronavirus isnt showing up in Google suggestions? - <AUTHOR> https://i.imgur.com/kaTQUdI.png <comment><AUTHOR> I just saw this on Reddit while looking at information regarding the virus. I was like no way that's a thing. I just tried it myself and it isn't there.

</comment><comment><USER2> Google is an advertising firm and there probably aren't a whole lot of people buying coronavirus related advertisements. Try a different search engine.</comment>


HackerOne breach lets outside hacker read customers' private bug reports - louis-paul https://arstechnica.com/information-technology/2019/12/hackerone-breach-lets-outside-hacker-read-customers-private-bug-reports/ <comment><AUTHOR> if a platform which stores information about current 0days in their system get's pwned by an OWASP top-10 it should be considered gross negligence on their part. this isn't the security researchers fault but HackerOne trying to spin the story to their advantage. Absolutely disgusting, but I wouldn't expect anything else from them.

We should agree to a system that auto-pwns (takes offline) anything that has an OWASP top-10 in it. janit0r had the right idea when s/he/they took all those IoT devices offline. The Japanese did something similar (iirc in 2018).

the top comment in the article nails it:

 _> I'm not a fan of a vulnerability reporting platform giving someone grief for finding a vuln in THEIR platform. Of all orgs, HackerOne should understand the optics of how they communicate with a reporting party.

Interrogating your voluntary reporting party with things like "why did you access so much data, you didn't need to" is just stupid, that's common exposure assessment practice for most in the industry.

Your vuln was found and exploited either way. Your choices are two:

1\. Honorable guy validates scope of access and reports it. 2\. Less honorable guy pwns your shit.

Come on, HackerOne._

EDIT: there is so much we could do (programmatically) using _.well-known /security.txt_ to drive automation for all kinds of things in addition to mere providing of a contact point to report vulns to.

<comment><USER2> You should read the actual report [0]. HackerOne repeatedly thanks the hacker for the report and awards a 20k bounty.

> Thank you for confirming you no longer have unauthorized access. As part of > our investigation, we also want to make sure we have all the relevant > information from you to ensure we're capturing everything, even as we review > our own logs / audit records. As such, we would appreciate your answers to a > few questions to assist us.

HackerOne ask a bunch of questions about what was accessed.

> Again, thank you so much for responsibly reporting this issue to us. We > really do appreciate it, and we thank you for your assistance with our > investigation.

Then later after awarding a 20k bounty:

>To make it clear on how we believe these situations should be handled by hackers, we've added a clarifying section to our policy. We urge you to review this section, which will reduce the blast radius going forward. We'd like for you to continue to be a valuable member of the community and our top hacker, but for that, we require you to be mindful of the access that particular vulnerabilities give you. Being responsible and understanding the potential consequences of your actions is very important in this field. We hope you understand and will take this into consideration going forward.

[0] [https://hackerone.com/reports/745324](https://hackerone.com/reports/745324)

<comment><USER3> Not sure what exactly that changes. It's still a relatively basic vulnerability and they still school the reporter after changing ("clarifying") their policy [0]. I realize it's worded to not come across as a threat but I'm not sure why that was necessary either. It might have been out of scope according to some H1 guideline the reporter wasn't aware of but what the reporter did wasn't really out of the ordinary.

[https://hackerone.com/security/policy_versions?change=362468...](https://hackerone.com/security/policy_versions?change=3624684)

<comment><USER2> > Not sure what exactly that changes.

Tone and how you treat your reporters matters. The comment quoted by the person I responded to was edited to include this after they read the full report:

>> Edit: This comment was based on an incomplete understanding of the specifics of the communication between H1 and the reporter. This assessment wasn't the most fair, and I probably should have read the full report before passing judgment. [0]

You say:

>I'm not sure why that was necessary either. It might have been out of scope according to some H1 guideline the reporter wasn't aware of but what the reporter did wasn't really out of the ordinary.

Isn't it exactly the commonness of that practice that makes it clear it is important to take the time to educate your reporters and improve your policy? The amount of sensitive data was accessed increased the severity of the breach. HackerOne specifically acknowledges this as one of their planned courses of action to improve things going forward:

>> As the community grows, HackerOne needs to ensure that HackerOne is reinforcing the best practices in bug bounty hunting. The HackerOne Community team will look to increase hacker education around delivering proof of critical severity vulnerabilities in case sensitive information has been accessed by the hacker.

[0] [https://arstechnica.com/information- technology/2019/12/hacke...](https://arstechnica.com/information- technology/2019/12/hackerone-breach-lets-outside-hacker-read-customers- private-bug-reports/?comments=1&post=38352571#comment-38352571)

<comment><USER3> Fair enough. I find it rather patronizing but I also kind of get your point. H1's gamification requires them to educate their users to some degree, sure. Although I find that far more problematic than some common practice. I'd prefer policy that reflects reality. "If you see usernames or reports, stop and report it" might help with the part of the user base that bought into the gamification but I'm really not sure how that helps responsible disclosure in general.

If you're not a paid external security researcherm, of course you click on at least one report to confirm that the vulnerability is actually working and has meaningful impact. Plus, they're still working with curious humans here, not OWASP top 10 scanners.

That's just like all those bug bounty programs including some phrase disallowing automated tools. Even for active participants of the platform that's completely unrealistic and introduces unnecessary uncertainty.

<comment><USER4> > That's just like all those bug bounty programs including some phrase > disallowing automated tools. Even for active participants of the platform > that's completely unrealistic and introduces unnecessary uncertainty.

I was a report triager on HackerOne for over a year. There is a good reason for that clause, and I would definitely recommend any program that didn't already have it (which is only programs new to bug bounties) to adopt it.

What's disallowed is filing a report consisting of the output of an automated tool. Look at Uber's scope statement ( [https://hackerone.com/uber](https://hackerone.com/uber) ):

> Out-of-Scope

>> Negligible security impact

>>> Vulnerabilities as reported by automated tools without additional analysis as to how they're an issue

>>> Reports from automated web vulnerability scanners (Acunetix, Vega, etc.) that have not been validated

This prevents a denial-of-service attack on Uber's bug bounty team. It's very, very common for someone to run an automated tool against one of your domains, copy the output into a HackerOne report, and walk away. In nearly all cases, that output is a scary-looking false positive. It doesn't make sense to investigate reports like this, because they are almost always spurious -- so they are placed out of scope. If you file a report _consisting solely of automated output_ , your report will be closed without investigation per the company's policy. The only problem being addressed by the clause is that reports like this are a waste of our valuable time.

Automated tools themselves are not disallowed. (How would we know?) The requirement is that you investigate the bug yourself, and provide a writeup that indicates that you did so and substantiated that there really was a security issue.

> If you're not a paid external security researcher, of course you click on at > least one report to confirm that the vulnerability is actually working and > has meaningful impact. Plus, they're still working with curious humans here, > not OWASP top 10 scanners.

I have a lot more sympathy for you here. I have personally seen the same company pay out thousands of dollars more for the same security issue just because one of the reports alleged a bigger potential problem. (In this case, "you might be able to write to the database" as opposed to "you can read from the database".) This makes it hard for me to recommend "stop as soon as you know an issue is present", even though that is definitely the preferred policy of the companies.

<comment><USER3> First off, I have to admit to a bit of snark when writing that up yesterday tbh and completely forgot about folks reporting some Nessus output etc. I'm absolutely with you when it comes to that type of automated tool and reporting, thanks for separating that.

The Uber one is actually a great example of wording I can appreciate. I was thinking of one like Verizon Media's ( [https://hackerone.com/verizonmedia](https://hackerone.com/verizonmedia) ).

> Do not use automated scanners/tools - these tools include payloads that > could trigger state changes or damage production systems and/or data.

Unlike Uber's that's just a blanket statement and while I'm sure nobody wants to use it in that way (I actually like H1 acting as proxies for that alone, they surely mean something very similar to the example you posted), it's unrealistic and could make pretty much any attack ineligible.

All that being said, at least the change to H1s own policy let's people know where they draw the line. Maybe I should change my mind, not every program has to be relevant to everybody at the end of the day.

</comment></comment></comment></comment></comment></comment></comment><comment><USER5> This isn't very interesting, at least no more interesting than any other disclosure that goes through H1.

If you're not familiar with disclosures and communication via H1 maybe this all feels very odd or bad or something, idk. Looks fairly standard to me.

Ultimately, to me, someone found a vulnerability, reported the vuln, and it was remediated within ~3 hours. There was no "breach", unless you consider every H1 report a breach?

Having a repository of vulns is quite a scary thing though. I often wonder, with all of the "wontfix" and "too low impact to care" bugs chained together, how easy is it to own many of these customers?

<comment><USER6> It used to be that wontfix / low impact stuff would still be publically disclosed. Responsible disclosure was the key principle.

There shouldn't be a gap between "won't fix" and "Too bad to be made public".

If a company is happy not to fix something, they shouldn't complain if it's published.

</comment></comment><comment><USER7> Original ticket, the article is a waste of time: [https://hackerone.com/reports/745324](https://hackerone.com/reports/745324)

<comment><USER8> I agree, this is not a great article, tries to make a lot of drama out of what appears to be a really simple event, manages to contain less information than the actual HackerOne report, and has that weird coda of Katie Moussouris and the DoD program, which has nothing to do with this story.

<comment><USER9> Do you have any thoughts on their mitigations? I would like to protect against attacks like this, but their mitigations seem to have big drawbacks:

> Bind Sessions to IP Addresses

As they admit, "IPs... change for legitimate reasons", so it seems like most sites wouldn't want to roll out this protection, because it would randomly logout their users. I haven't tested this, but it seems like this would be pretty common on mobile networks from some googling.

> Bind Sessions to Devices

They say they will "investigate binding the session to a specific device"; is there a known good way to do this? I could imagine attempts to do this breaking legitimate use cases like Apple's Handoff between iOS and Mac, or just not adding much security.

My instinct is that the admin functionality could be put run behind a VPN, and that would be a good defense against a HackerOne employee's credentials or sessions cookie being leaked.

<comment><USER10> For such a highly valuable website like hackerone, IP binding should be done, the extra security is worth the slight annoyance at having to relog when your IP changes.

</comment></comment></comment></comment><comment><USER11> >>> As haxta4ok00 suggested, one step was to bind authentication cookies to the IP address of the user it was issued to.

Do NOT bind session cookies to an IP. It breaks usability on mobiles, they change networks quite often.

What you can try to do instead is to associate the cookie to the country is user currently is in. It's available in the CF-IPCountry header if you use CloudFlare. This may also cause usability issues for frequent travelers or border workers.

[https://support.cloudflare.com/hc/en- us/articles/200168236-C...](https://support.cloudflare.com/hc/en- us/articles/200168236-Configuring-Cloudflare-IP-Geolocation)

<comment><USER12> Locking sessions to countries doesn't offer any security benefit - an attacker can quite trivially connect from an IP in any target country.

<comment><USER11> Lock out the login page too so users can't login from countries you don't do business with, especially the actively hostiles ones (CN, RU, T1).

It's simple and it's extremely effective. It benefits security immensely.

<comment><USER12> I don't understand how it's anything beyond a minimal defense-in-depth measure.

      1. Target leaks session cookie
      2. Attacker uses VPN to connect from target's country with the leaked session cookie
      3. Attacker's session is deemed valid

<comment><USER11> Attackers usually don't know the country of the user. Even if they do, it's not as easy as it sounds to find a VPN or an open proxy in any country.

If you're thinking of Tor, Tor is trivial to detect and block.

I've been working in fintech companies and e-commerce, handling real money or wallets that could be stolen or emptied by a successful attacker. If you don't do defense in depth, users lose. One trivial example, the days after a new breach is published on Hacker News, there will be bots on the door attempting to brute force login with all these new email and password combinations.

Any other question? I feel like I have a context to start writing a blog post on that.

<comment><USER12> > Attackers usually don't know the country of the user

Nothing a little recon or social engineering can't solve.

> it's not as easy as it sounds to find a VPN or an open proxy in any country

Only for some small/niche countries perhaps. Worst case, an attacker can rent a VPS in the target country.

Perhaps a city-based lock would be more effective.

<comment><USER11> Most attacks are opportunistic, trying credentials that were leaked online or brute forcing simple passwords. It's also heavily weighted from russia, china, tor, open proxy, non-reputable hosting and cheap VPS. Each of these can be detected and blocked.

Attacker do not maintain proxies, especially not proxies across tens of developers countries, and if they that would be organized crime and it's a whole new level. By the way, banking trojans evolved to operate from the browser of the victim specifically to evade these protections.

Should I cover all these in a blog post if it's something you're interested in?

<comment><USER12> I think you're deviating from the topic of protecting against the vulnerability HackerOne encountered: using a leaked session cookie.

In their case, let's say the victim analyst was based in the United States, and they have implemented your proposed session country-lock. I also happen to reside in the US, so the country-lock protection is worthless.

For other cases, you can _try_ to block proxies, VPNs, TOR, VPSs... but that in itself is perhaps a usability fail.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER13> Feels like they are trying to have it both ways.

Complaining that the finder poked around too much while asserting that he had access to very little.

<comment><USER14> Lots of bug bounty policies expressly state you should not access other customer information. E.g.:

[https://www.google.com/about/appsecurity/reward- program/#rep...](https://www.google.com/about/appsecurity/reward- program/#reporting)

Sometimes that's not easy but slurping tons of data to demonstrate the scope of the vulnerability is rarely necessary from a technical perspective. That said, if your report is being ignored it becomes a very tempting avenue to get priority.

<comment><USER15> With our bug bounty program we also state that researchers should not access customer data or interrupt normal operation of the services. If their testing is believed to impede normal operation we can provide separate servers for testing purposes.

We also provide a test account upon which researchers can use if they wish to attempt to modify or read private information. They should stick to that data and I'd encourage other bug bounty programs to do similar.

In my eyes this researcher should've stopped as soon as they started seeing private data and reported it, it sounds as though they continued to read private information well after they realized it was private data they were viewing.

I realize not every bug bounty program plays fair. We look specifically at our bug bounty triage team (via the platform we use) to make sure we are treating researchers fairly and that researchers are obeying the agreed upon rules. They're the neutral third party in our eyes. They keep us honest and researchers honest. At least that's how I approach it all.

<comment><USER14> That's cool. It's so important for bounty programs to have a systematic way to approach awards. The security researcher community overall is very cool, but there are definitely some assholes and bottom feeders out there that can get under your skin and introduce bias in your decisions.

</comment></comment></comment></comment><comment><USER16> It's stunning that HackerOne staff use their production credentials to reproduce security reports. Is there no internal instance of the HackerOne platform they can run their tests on?

</comment><comment><USER17> This title is misleading. It _let_ an outside attacker do this – past tense – due to a token leak; this isn't an ongoing thing, and the token was revoked so even _that_ attacker can't do anything now.

</comment><comment><USER18> Do they have a bug bounty program?</comment>


Court May Order Google to Censor 'Torrent,' 'RapidShare' and 'Megaupload' - <AUTHOR> http://torrentfreak.com/court-may-order-google-to-censor-torrent-rapidshare-and-megaupload-120718/

<comment><USER2> _...from its Instant and Autocomplete services._

Still bad but not quite so bad. Actually, I'm a little worried about filtering Instant since that's effectively filtering all of search for many people.

And why bother with filtering Megaupload? It is dead.

<comment><USER3> When something is "censored" from Instant, it just says "Press enter to search" rather than loading it automatically. Nobody who bothered to put "torrent" in the search box is going to be dissuaded by having to press one extra key to see the results.

<comment><USER2> Thank you for clarifying, I just assumed search results would be missing. Which now that I think about it doesn't make much sense.

</comment></comment></comment><comment><USER4> I wonder if I had a business that sold legal torrents, would I be able to sue because they are being anti-competitive towards my business?

<comment><USER3> No, Google is under no legal obligation whatsoever to link to your site, let alone promote your site/topic using keyword autocompletion or instant searches. There's more to the legal definition of "anti-competitive behavior" than "anything that hurts someone else's business", although it's vague enough that I can understand the confusion.

<comment><USER4> I was actually suggesting suing the government for forcing Google to remove my legal business from the index.

<comment><USER3> Did you read the article? This is about autocompletion and automatic Google Instant searches, not removing anyone from the index. As with the huge list of terms that are currently "censored" (including every adult-oriented term they could think of), you just have to type the word without autocomplete and press enter to see the results.

In any case, suing the government for anti-competitive behavior doesn't really make any sense. Governments have much wider powers of regulation than businesses do, and for good reason. You could try a free speech lawsuit, but it'd depend on your country's free speech laws. One potential snag is that in the scenario you described, it's not really YOUR speech that's being restrained, but Google's.

</comment></comment></comment></comment><comment><USER5> And people just change the names and the whole circus starts all over again.

I'm 100% against copyright infringement but this is energy in the wrong direction.

</comment><comment><USER6> Interesting, so since the FBI seized the megaupload domain at the start of the year. Now apparently it is to be blocked by google thru a court order. Can the FBI be trusted to look after your domain you do have to wonder.

Will make for some interesting stories and legal angles down the line.

</comment><comment><USER7> What about legitimate uses like "ubuntu torrent" or "centos torrent"?

</comment><comment><USER8> ...in France.</comment>


Show HN: Docker launcher for common databases - <AUTHOR> https://github.com/thestonefox/docker-databases

<comment><USER2> Cool! If you are interested in docker and databases, my company is working on an oss project to simplify the deployment and migration of databases and their volumes: [https://github.com/ClusterHQ/flocker](https://github.com/ClusterHQ/flocker) It's aimed more at production use cases where things like moving volumes around for db upgrades are a requirement, but you might find it useful. Its open source so would love your feedback and involvement.

</comment><comment><USER3> Have you seen Dock? [https://github.com/bripkens/dock](https://github.com/bripkens/dock)

<comment><AUTHOR> No I hadn't looks good though, thanks for the link :)

</comment></comment><comment><AUTHOR> Feedback greatly appreciated</comment>


What it's like to house-hunt in Silicon Valley, the nation's priciest market - <AUTHOR> https://www.washingtonpost.com/business/economy/what-its-like-to-house-hunt-in-silicon-valley-the-nations-priciest-market/2015/12/31/920c5b02-9dcf-11e5-bce4-708fe33e3288_story.html?hpid=hp_hp-more-top-stories_tech-housing-1005pm%3Ahomepage%2Fstory <comment><USER3> The Bay Area is real estate insane. Prop 13 driven NIMBY-ism prevents any reasonable density housing from being built.

After living there for 2 years and paying insane rent (more than $5K/mo on a 1200sqft house), I now telecommute for a Bay Area company, and live in central VA in a 3000sqft house in a good school district with a community pool, etc, which cost less than $400K. I telecommute most of the time, and I fly to CA 5-6 times per year (on the company's dime). My quality of life is so much better. I mostly miss the weather and the food, but not the traffic & the crowds and the prices.

Not to mention that I'm using one of my 5 bedrooms as a private office, which is so, so, so much better than a low-walled cube in an open office environment.

<comment><USER4> Did you have to take a salary cut when you moved to VA? (e.g.: so your salary would be more in line with VA norms than silicon valley norms?)

That is the big problem with telecommuting for me - it seems hard to find companies which are willing to pay silicon valley level salaries to people living outside silicon valley, and if you take a pay cut, the savings in rent diminishes drastically.

I suppose it is different when you start in silicon valley and move elsewhere while staying in the same company, rather than just starting out elsewhere. But that is still an concern since your salary gets reset if you ever change companies without moving back to silicon valley.

<comment><USER5> Not the poster you're replying to, but I manage both remote employees and local devs. We do adjust salaries based on location, but the adjustment data we use seems skewed in favor of remote employees. As an example, an employee in Florida gets $140k which is only $30k less than we'd pay him if he were local.

> But that is still an concern since your salary gets reset if you ever change > companies without moving back to silicon valley.

I'm not sure if this is true. If you're going to work for another SV company and remote, it's quite common for you to be able to quote a number higher than you got from your previous remote job and negotiate your way down to at or just above where you actually were in the previous job. The only time where I'd see you needing to adjust your salary down is if you took a job with a non-SV company in the interim. Just be aware that the salary data used by each company may be different.

But it is probably helpful to come to SV/SF at some point in the beginning and transition to remote work initially because hiring out here is somewhat incestuous and having a well-known SV employer on your CV will help with getting past HR filters and ensure you get the necessary LI touches.

</comment></comment></comment><comment><USER6> I went through this but was lucky enough to do it 3 years ago. Our price point wasn't above a million but was around 600-700k. For good schools that pushed us out to the Tri-Valley area of the east bay where we finally bought a house.

We looked for 18 months. It got to the point where I'd leave work if a house came on the market on a Thursday so we could have our offer in on Friday. We were out-bid 12 times for all cash offers, mostly from overseas investors I was told.

We finally found a house where an older lady was selling the house where she raised her kids in and after I saw it I went back the next day and knocked on her door and showed her some pictures of my family and almost begged her to pick our offer. We ended up having to bid +45k over asking.

The funny part is if I sold the house right now, I wouldn't be able to afford to buy it back.

<comment><USER7> > We were out-bid 12 times for all cash offers, mostly from overseas investors > I was told.

I understand this is the case, but I don't know why it's better for the seller if the buyer pays cash: say the buyer takes out a mortgage to buy their house, doesn't the buyer's bank pay the seller in cash?

<comment><USER8> Things tend to go faster with cash buyers. In particular, no risk the bank will decline them for a mortgage. I suppose there's less difference if they're preapproved.

<comment><USER9> Even preapprovals can fall through as the bank can decline to fund when they see the home in question or the valuation comes in lower than the sale price.

In a hot market cash is king as it removes 2 of 3 most common contingencies people have. For the seller this is two less weeks where things can fall through.

</comment></comment></comment></comment><comment><USER10> Two days ago I just closed on my second house. Brand new, gorgeous 3500 square feet house for $363k. Great schools and good commute. The company I work has over 10,000 IT workers world wide with four major hub offices in the US. None of the hubs are in SV because of reasons like this.

<comment><USER11> Is being brand new a good thing in houses in the US? In the UK few people would prioritise a new house as it means no period features, no fireplaces, no history, almost invariably thinner walls, no established garden etc

<comment><USER10> Pros and cons, that's for sure. My current house is from 1974 - it's built very well. There's a comment below about new houses being built poorly - <USER2> are builders that cut huge corners but still stay within code. The new builders will clear cut pristine forest areas, build houses and plant little twigs called 'trees'. My current house...I had to cut down an oak tree as it was getting a disease..I counted the rings and it was 90 years old. Same for all the houses around my old neighborhood. The houses are about 40+ years old but you can tell the trees are older than. Builders, and people cared back then. I love walking in my old neighborhood...tons of trees, you don't even feel like you're in a big city but I'm 15 minutes away from downtown Atlanta.

The new house is a open floor plan, 2 story foyer/family room, tall ceilings etc, 50% larger more square footage. The outside looks beautiful.The funny thing is, the price of my current house and new house are very similar...old is valued at $330k, old was purchased a $363k. But my old house is closer to the city in a nice area.

I am moving to a newer part of town. It's closer to work for both me and my wife. All houses around there are no more than 20 years old...most are within 10 with new construction everywhere.

</comment></comment></comment><comment><USER12> This is mind-numbingly inefficient. We really need to build up.

<comment><USER13> No, that doesn't help much either: see New York city. Besides the point of buying a house is to have a yard and not have neighbors bouncing on your ceilings or leaving trash in the hallways or stealing your bike.

What's actually needed is more remote working and a departure of the colocation mentality for businesses that don't actually need colocated employees.

Software engineers rarely ever need to be in an office. A hardware engineer almost certainly does. SaaS sales people: no need for an office. Customer support -- no office needed there either.

Even many lawyers don't need an office (by office, I mean a traditional office, not a home office.) I was a plaintiff in a lawsuit and never once did I even see my attorney face-to-face.. And it was complex litigation.. And we won.

Doctors obviously do, content marketers obviously do not. Accountants.. Definitely not.

My point is that the problem isn't housing, it's the density of tech companies that seem to think physical proximity to Sand Hill Road actually matters. The problem is also that Sand Hill Road also seems to think it matters. But it doesn't. Cases in point Basecamp and Github.

Commuting to an office only to use Slack as the primary day-to-day communication. THAT'S mind numbingly inefficient. Commuting to an office only to stand in a circle for standup and then going back to a desk to work all day.. That's inefficient. Marissa Mayer is wrong.

<comment><USER14> > No, that doesn't help much either: see New York city.

NYC manages to have cheaper housing than SF despite having radically more demand, thanks mostly to the ability to add supply at a reasonable rate.

<comment><USER15> I think the point is already lost if NYC is an example of affordable housing. Houston is probably a better example if you want to talk about affordable housing in a major city. But commutes in Houston are getting pretty crazy even.

<comment><USER14> > I think the point is already lost if NYC is an example of affordable > housing.

NYC is actually quite affordable though. If you're willing to have a ~30 minute commute, you can easily live in some affordable places.

There are even more affordable options internationally though. Berlin, for example.

</comment></comment></comment></comment></comment><comment><USER16> Sidenote: Eichler homes look very modern. Definitely better looking than your standard SV brick-and-wood-paneling matchboxes.

</comment><comment><USER17> Compared to central London SV is cheaper and London does' not pay as well for techies.

Id love to live in say fitzrovia or one of the lovely Georgian houses in the city near st pauls - but unless I win the lottery that's not going to happen.

</comment><comment><USER18> There is no doubt Silicon Valley real estate is expensive. But this article is extreme.

For starters, Los Gatos is an upscale city nestled down at the bottom of SV. Bentleys and Ferraris are everywhere and the Tesla Model S is a downright common car. It's not representative.

If you look around in San Jose, Campbell, Mountain View, Sunnyvale, etc, the prices come down and quality goes up. No, they don't approach the national average, not even close. But 1.5 million for a fixer upper is ridiculous.

</comment><comment><USER19> What is the market like in the East (Oakland) or North Bay (Sausalito and north?</comment>


The CXX Debate - <AUTHOR> https://steveklabnik.com/blog/the-cxx-debate <comment><USER2> "we know that we can pass any u32 to this function, and it's safe"

What happens if you pass in 0xFFFFFFFF?

<comment><AUTHOR> This is a great point; I was thinking purely of Rust's semantics, where this is safe, and ends up turning into a panic or a zero. I'll add something here, thank you.

EDIT: wait, since this is unsigned, it is the same semantics as Rust. Well, it wraps no matter the optimization level, but it's not UB.

<comment><USER2> I haven't quite wrapped my head around Rust but I know that anything that moves the possibility of UB towards 0 is a godsend. Just ask the folks at ESA who worked on the first Ariane 5 launch.

<comment><AUTHOR> Rust's semantics are:

* in debug builds, you get a panic on overflow

* otherwise, you may choose to panic, but if you do not, it is two's compliment wrapping

It is defined this way so that someday if checks get cheap enough we can enable them in release builds too, but at least it's not UB!</comment></comment></comment></comment>


Why the Success of The New York Times May Be Bad News for Journalism - <AUTHOR> https://www.nytimes.com/2020/03/01/business/media/ben-smith-journalism-news-publishers-local.html <comment><USER2> Huh. This doesn't hit home for me at all. The New York Times has a long history of bold investigative journalism and, compared to a lot of other news outlets, caution and strong adherence to verifiable facts. If they're succeeding these days, that only makes me more hopeful for the future.

I'd love to see more news outlets do as well as the times does at reporting honestly and courageously. But BuzzFeed? Gawker? What are the great contributions these entities make, such that we should worry about their having staff poached away, or getting bought entirely?

<comment><USER3> On their podcast a bit back, they had a somewhat surprising retrospective on their role as a news agency during issues such as the Clinton email incident, Trumps rise to power, and other events where they make the statement they might have to be more careful in the future about what they say and how they say it.

Though I'm still somewhat skeptical this is done from an entirely neutral/altruistic perspective

<comment><USER2> Skeptical that what is done from an entirely neutral/altruistic perspective?

<comment><USER3> Internal policy changes regarding how they report the news. I somehow doubt they would care enough to report how they are changing internally if anyone but Trump had won the election.

<comment><USER4> If they had sincere regrets they'd have had their bulb light up after the build-up to Iraq.

</comment></comment></comment></comment></comment><comment><USER5> "The Times so dominates the news business that it has absorbed many of the people who once threatened it: The former top editors of Gawker, Recode, and Quartz are all at The Times, as are many of the reporters who first made Politico a must-read in Washington."

It's the double-edge sword of our new world. As our world is moving faster than laws, there's this tangential excuse that all these companies use as competitors for why their once markets, are completely evaporating. Sure Ben's argument isn't the greatest (listicles had to happen to pay for the News division). I'm just disheartening that for the time being it just seems the nature of the game. The room is either niche or a oversized conglomerate of algorithm-based decision making...and not always the good kind.

</comment><comment><USER6> Every democracy needs a state funded but independent news organization. Just as it needs a state funded but independent judiciary and statistics organization. It's not the NYT's fault that the US does not have such an news organization.</comment>


Show HN: easyAB.js - A/B and Multivariate testing made easy - <AUTHOR> http://srom.github.io/easyAB/index.html

<comment><AUTHOR> OP here. I just came by the announcement of the Content Experiment API [1] through Analytics' newsletter (and I'm not the only one around here), and I'm very excited because my plugin appears to be complementary with it. Support for this API pushed up in the priority queue and will be available soon. In the meantime, use the good old custom variables and events to track your changes.

[1] [http://analytics.blogspot.fr/2013/06/google-analytics- become...](http://analytics.blogspot.fr/2013/06/google-analytics-becomes- robust-testing.html)</comment>


A Game of Tricks IV – Stylized normal mapping - <AUTHOR> http://www.alkemi-games.com/a-game-of-tricks-iv-stylized-normal-mapping/ <comment><USER2> Whoosh.

Related: I really need to learn more graphics-oriented programming.

I sometimes am flabbergasted as I look out the window of my office and see the sunset. The skies flawlessly gradient from blue to red, the lighting of the clouds is perfect. Nature's artistry is effortless.

To reproduce that on a screen -- or even a close approximation of that view! -- takes an incredible amount of artistry and know-how. As a more technically- minded person, I'm amazed at how much thought and energy goes into things like this, and how little I know of it.

Very cool read.

<comment><USER3> Game dev here. Just remember we cheat like crazy. If you are never going to see the backside of something it likely has never been shaded (or even modeled).

Just as a couple examples: once we needed to show a which way enemies would move for a tower defense game so we made a custom skin that looked like arrows that moved along a path but was really just a mostly transparent image on a plane that was slowly being offset.

Another time we needed to make it look like you were in space, but to make that realistic you need thousands of individual stars - so we pre-rendered the six space images needed for the sides of a cube and just made the code that projects 3D images down to a 2D plane (ie your screen) always put it behind everything else, even if it was technically on a 1x1 box around the camera.

These days, sadly, I do 2D which means fewer tricks.

<comment><USER2> Even the cheats are impressive, though. Like, you have to think of them first... :)</comment></comment></comment>


Geoff Hinton Dismissed the Need for Explainable AI - <AUTHOR> https://www.forbes.com/sites/cognitiveworld/2018/12/20/geoff-hinton-dismissed-the-need-for-explainable-ai-8-experts-explain-why-hes-wrong/ <comment><USER2> Split brain patients will often have one half of their brain invent explanations for why the other half did something. The explaining half believes these explanations to be true. Which suggests pretty heavily that even the decisions that humans make aren't as explainable as they seem.

Imo, this whole explainability thing is an incorrect human intuition that we're imposing on AI. If you want unbiased AI, explainability isn't the way to do it. Instead judge its performance against explicit criteria for what counts as bias. If those criteria don't exist or can't be agreed on then the problem is hopeless from the outset.

<comment><USER3> I think it depends on the what area. Criminal Judgement probably shouldn't be a "black box" your going to jail. why? the machine said so.

mathematical proofs. My algorithm solved xyz conjecture. it's true. how? I don't know it's a black box.

Also, from a diagnosis/debgugging problems it can be a problem. Oh, no the was a huge mistake and the system just catastrophically failed. how do we fix it? don't know. Should be keep using it? don't know.

Not saying there aren't places where a black box is perfectly fine.

</comment></comment><comment><USER4> This is cribbed from [https://www.wired.com/story/googles-ai-guru-computers- think-...](https://www.wired.com/story/googles-ai-guru-computers-think-more- like-brains/).</comment>


Paper that Self-Erases After 24 Hours invented by PARC scientists - <AUTHOR> http://www.treehugger.com/files/2008/10/wired-nextfest-2008-chicago-xerox-erasable-paper.php

<comment><USER2> > _The "a-ha" moment came from developing compounds that change color when > they absorb a certain wavelength of light but then will gradually > disappear._

How about everything but the "disappear" part (by time or heat)? I'd like to never buy another ink or toner cartridge again.

<comment><USER3> _I'd like to never buy another ink or toner cartridge again._

Funny you mention that. Zink ( <http://www.zink.com/how-ZINK-works> ) is working on just that. It was even discussed here in other posts (<http://searchyc.com/zink> ).

</comment></comment><comment><USER4> My first thought was "great, they've invented a way to make paper as dubious a backup medium as hard drives".

But, in fact, this is a pretty interesting idea.

<comment><USER5> I had a similar experience, except that I was imagining Professor Bunsen Honeydew saying, "Welcome again, folks, to Muppet Labs, where the future is being made today."

More on-topic, it seems like there's a sliding scale that goes from "print with ink on disposable paper" up to "download onto eBook-type reader." I wonder where the sweet spot is (if there is one) in terms of creating a product for what would have to be termed 'mobile (probably static) media?'

For example, if the number of times you can reprint the same page increases, at some point you have to start thinking of a more durable substrate than paper, and the up-front cost goes up. And then, how much more is an A-size reader, say 1/4" thick but not flexible? Then how much more for a flexible one? And then a 1/2 to 1" thick reader that could hold the library of congress?

Maybe eBook readers aren't so much a solution to book reading as they are to the paperless office problem?</comment></comment>


A Guide to Natural Language Processing - <AUTHOR> https://tomassetti.me/guide-natural-language-processing/ <comment><USER2> > Essentially, when dealing with natural languages hacking a solution is the > suggested way of doing things, since nobody can figure out how to do it > properly.

That's really the TL;DR I also got from the computational linguistic courses I attended.

There's probably the Pareto principle at works. Having no solution is worse than having an 80% solution that works well enough when the 100% solution is much harder to achieve (and some of the problems not even humans would be able to solve properly).

<comment><USER3> Couldn't agree more!

Recently I wrote a web-extension for Firefox that displays funny "Deep thought" quotes.

I wanted to analyse the quote text and fetch relevant images to animate in the background of the quote text. After reading several NLP tutorials, guess what I did as a first PoC - Pick the 3 longest words in a quote text and run an image search with those 3 words.

6 lines of plain javascript code that can be run anywhere almost instantly [https://github.com/TheCodeArtist/deep-thought- tabs/blob/mast...](https://github.com/TheCodeArtist/deep-thought- tabs/blob/master/addon-src/deepThoughts.js#L87)

I get relevant images in the search results 99/100 times. The quirks of searching often result in the image adding to the funny-ness of the "Deep Thought" on display.

Its so effective that i ended up publishing the "Deep Thought Tabs" web- extension with this approach itself: [https://addons.mozilla.org/en- US/android/addon/deep-thought-...](https://addons.mozilla.org/en- US/android/addon/deep-thought-tabs/)

Later I tried using the nlp-compromise js library to identify "topics" of interest within a quote text - typically nouns, verbs, and adjectives. Comparing the results with my "3-longest-words" approach, I found that the longest words were anyways almost always the "topic" words that NLP identified for any given quote text.

<comment><USER4> That's pretty awesome.

Back in games we'd do all sorts of tricks in networking to make it look like things were happening(sound effects, decals, etc) in response to local events until we could have the server provide the definitive call on some game state.

Most players thought we had a much higher fidelity sim then we actually did. It's a pretty common technique across a lot of games. You can get away with quite a bit by being smart about what you "fake" and what you actually make work end-to-end.

</comment></comment></comment><comment><USER5> Ha, there's a whole section on clones of the summarizer from Classifier4J.

I wrote that in 2003 (I think?) based on @pg's "A plan for spam" essay, and then "invented" the summarization approach (I'm sure others had done similar, but I thought it up myself anyway).

Turns out it was rather well tuned. The 2003 implementation, presumably downloaded from sourceforge(!) still wins comparisons on datasets which didn't even exist when I wrote it[1].

I much prefer the Python implementation though[2], which I hadn't seen before.

Also, Textacy on top of Spacy is awesome for any kind of text work.

[1] [https://dl.acm.org/citation.cfm?id=2797081](https://dl.acm.org/citation.cfm?id=2797081)

[2] [https://github.com/thavelick/summarize/blob/master/summarize...](https://github.com/thavelick/summarize/blob/master/summarize.py)

</comment><comment><USER6> There are a few applications missing:

\- Answering a question by returning a search result from a large body of texts. E.g. "How do I change the background color of a page in Javascript?"

\- Improving the readability of a text. The article only mentions "understanding how difficult to read is a text".

\- Establishing relationships between entities in a body of text. E.g. we could build a fact-graph from sentences like "Burning coal increases CO2", and "CO2 increase induces global warming". Useful also in medical literature where there are millions of pathways.

\- Answering a question, using a large body of facts. Like search, but now it gives a precise answer.

\- Finding and correcting spelling/grammatical errors.

<comment><USER7> > \- Establishing relationships between entities in a body of text. E.g. we > could build a fact-graph from sentences like "Burning coal increases CO2", > and "CO2 increase induces global warming". Useful also in medical literature > where there are millions of pathways.

That's a simple example because with 'CO2' you at least have the same string that can serve as a keyword connecting those two facts. Usually in natural language we make frequent use of anaphora to refer to people, objects and concepts previously mentioned in the text by name.

Anaphora resolution is one of the really hard problems not only in NLP but in linguistics in general. The most simple anaphoric device in languages like English is pronouns and even with those it can be quite difficult to determine what a 'he' or 'she' refers to in context.

<comment><USER8> >Anaphora resolution is one of the really hard problems not only in NLP but in linguistics in general.

This was one of the most frustrating parts of studying Latin rhetoric. The speakers would keep referring to "That thing I was talking about," and it's a noun from a subordinate clause 2 and a half paragraphs ago.

<comment><USER9> That's actually very common in most languages. English is one of the few western languages that doesn't do this, which makes it quite complicated for some people to write sentences in it, as in their native language such far backreferences, and long run-on sentences may be a lot more common.

</comment></comment></comment></comment><comment><USER10> A lot to review, read, learn. Thanks a lot for sharing this. Any plans to extend it or have another one including even more, like Natural Language Generation (not limited to bots, we are using it in weather forecast), and co- reference?

<comment><USER11> Thanks. Well, there are interesting things that we had to cut because they were too advanced for an introductory article. We were thinking about making a new article for them in a few months. And Natural Language Generation would be another great topic to talk about.

However, if you already have experience in the topic we would be happy if you would like to write a guest post for us.

</comment></comment><comment><USER12> I'm always astonished how little mention gensim gets, considering that it can basically be used for all the listed tasks, including parsing, if you combine it with your favorite deep learning library (DyNet, anyone?).

<comment><USER13> gensim is one of the best libraries for word vectors and summarization. For parsing and NER, Stanford CoreNLP works best in my experience.

<comment><USER12> Well, a model you fine tune to your specific corpus/domain works even (in fact: much) better... And gensim there gives you the tools to build the best possible embeddings.

But you do need a use case and an economic reward for the substantial increase in cost than a pre-trained, vanilla, off-the-shelf parser (model) can give you. Yet, if your domain is technical enough (pharma, finance, law, ... - essentially, all but parsing news, blogs, and tweets...) it might be the only way to get a NLP system that really works.

</comment></comment></comment><comment><USER14> Regarding finding similar documents what is the state of the art nowadays, LDA, word2vec, something else? What do you normally use?

<comment><USER15> Like everything else, depends on your use-case. I have personally used TF-IDF vectors and token sets with Cosine and Jaccard distances in practice.

Some examples of use-cases: are you searching for "semantically similar", or "near duplicate"? You can compare documents under different metrics and different _representations_. Some representations are: LSA, PLSA, LDA, TF-IDF, and Set representations, along with metrics such as Jaccard Distance, Cosine Distance, Euclidean distance, etc.

Doc2vec is the Word2vec analog for documents.

</comment></comment><comment><USER16> First time I see reading time and readability score mentioned together with NLP.

</comment><comment><USER17> Was hoping for some discussion about word vectors like word2vec. I keep reading about them, but don't really understand what they're useful for.

<comment><USER18> Let me try:

Take the famous example of [king] and [queen] being close neighbors in vector space after generating the word vectors ("embedding"). If you then use these vectors to represent the words in your text, a sentence about kings will also add information about the concept of queens, and vice versa. To a far lesser degree, such a sentence will also add to your knowledge of [ceo], and, further down, [mechanical engineer]. But it will not change the system's knowledge of [stereo].

<comment><USER17> Thanks, yeah I get that, but I think I'm having a lack of imagination about what to do with that in terms of how to build something useful and user friendly out of it.

</comment></comment></comment><comment><USER19> My experience with your site on mobile: [https://m.imgur.com/5vLrEJH](https://m.imgur.com/5vLrEJH)

Can't get it to go away, can't read the article.

</comment><comment><USER20> Is there an equivalent to MNIST for NLP? I've always wanted to play around in this space but I don't know a good, and simple, database to start with.

<comment><USER21> There are a few different datasets that might be of use, depending on what you're playing with:-

\- bAbI [https://research.fb.com/downloads/babi/](https://research.fb.com/downloads/babi/) and [https://github.com/facebook/bAbI-tasks](https://github.com/facebook/bAbI- tasks)

\- SQuAD [https://rajpurkar.github.io/SQuAD- explorer/](https://rajpurkar.github.io/SQuAD-explorer/)

\- WebQuestions [https://github.com/brmson/dataset-factoid- webquestions](https://github.com/brmson/dataset-factoid-webquestions)

Edit: there's also a great list of datasets on the ParlAI project page [https://github.com/facebookresearch/ParlAI](https://github.com/facebookresearch/ParlAI)

</comment></comment><comment><USER22> Your 'send me a PDF' popup has the background fade div above the form so it's impossible to fill in the form (without opening dev tools).

<comment><USER11> Thanks for your comment! Now, we have fixed the issue.

<comment><USER23> FYI, still a glitch: email form for pdf doesn't work right on mobile Safari for me---the cursor shows up in strange places unrelated to the form fields, have to click in random places to go from editing the name field to the email field.

<comment><USER11> Thanks for your comment. We are going to look into it.

</comment></comment></comment></comment><comment><USER13> Using Chrome on both a Chromebook and Galaxy S5, the right sidebar is screwed up. On the phone, it completely blocks the content.

</comment><comment><USER24> Quite an obnoxious website on my phone. Anyway I came here to point to GATE as a mature FLOSS option: [https://gate.ac.uk/](https://gate.ac.uk/)

</comment><comment><USER25> Recommend Dan Jurafsky and Chris Manning @ Stanford online course:

[https://www.youtube.com/watch?v=nfoudtpBV68](https://www.youtube.com/watch?v=nfoudtpBV68)</comment>


Warning: Internship May Come with a Non-Compete Agreement - <AUTHOR> https://www.inc.com/suzanne-lucas/warning-your-internship-may-come-with-a-non-compete-agreement.html <comment><USER2> Noncompetes for hourly, non permanent employees are clearly abusive. Based on the experience of California, they don't hurt company performance and competitiveness for highly compensated engineers either. They are just another way to control people.

Washington state just banned them basically for people like sandwich makers but on amazon's advice, they made them supported by law for people who make a certain salary which looked basically to be targeted to software engineers. [1]

Also, amazon has enforced some non-competes on people who aren't vps [2]. So don't work at amazon. Seriously talk about this with amazon, if candidates talk to them about it they will knock it off. I know they rarely try to enforce them but they have so much more power and money they can throw their weight around, in the same way that this article talks about abusing weaker parties like interns.

[1] [https://www.geekwire.com/2019/washington-state- legislators-p...](https://www.geekwire.com/2019/washington-state-legislators- pass-law-restricting-non-compete-agreements/) [2] [https://www.geekwire.com/2017/business-personal-amazon- web-s...](https://www.geekwire.com/2017/business-personal-amazon-web-services- decides-enforce-non-compete-contracts/).

<comment><USER3> Have you seen their outside work policy? They own everything you make or do in any capacity and outright own any video game you make.</comment></comment>


Open-Sourcing Our Reactor Design, and the Future of Transatomic - <AUTHOR> http://www.transatomicpower.com/open-source/ <comment><USER2> I have no idea if molten salt reactors are as awesome as this website represents them to be, but I thought the following point was interesting:

"light water reactors can use only about 4% of their available energy."

They're comparing with 1960s reactors designs, so maybe more modern water reactors are more efficient. But, it's still amazing to me that there's that much more energy that we could potentially harness from the fuel.

<comment><USER3> Currently the fuel is very inexpensive - a tiny fraction of the total cost of the electricity produced. Most of the cost is the initial capital, and most of the ongoing cost is the (highly specialized) labor. A new reactor design that saves fuel is not really what the industry needs.

<comment><USER4> According to Wikipedia current uranium reserves will last for 135 years. It would be 13 years if we increase energy production in nuclear plants 10 times to replace coal and gas.

So even if fuel is inexpensive now, it can become expensive quite quickly.

[https://en.m.wikipedia.org/wiki/Peak_uranium](https://en.m.wikipedia.org/wiki/Peak_uranium)

<comment><USER5> I believe Peak Oil was supposed to happen a dozen times now; we keep finding more when it becomes worthwhile to do additional exploration, and extraction technology keeps improving. Maybe uranium is different, but I would believe it when I see it.

<comment><USER6> As per wikipedia: "Peak oil is the theorized point in time when the maximum rate of extraction of petroleum is reached". You can still discover new sources of petroleum after "Peak Oil", but the idea is that you will never find enough to increase the maximum extraction rate.

What we see as consumers is conflated by the fact that there are self-imposed limits on extraction by OPEC designed to raise prices. Due to various political situations, those limits have been slowly removed. When you see predictions of "Peak Oil", often they are based on _existing_ production and not _maximum_ production (and hence are nonsense).

I'm not aware of _any_ literature that attempts to speculate on current maximum production capacity. Probably it exists, but I certainly can't find it. Whether we have hit "Peak Oil" already, or whether it will come in the future, I don't know. A lot of that kind of stuff is politically very sensitive and oil companies/OPEC are understandably reluctant to be straight forward with the data.

Finite resources eventually run out. When you don't know how much you have, it's tempting to assume that because you are finding more, you will continue to find more. There is no real guarantee of that. It's a risky strategy.

</comment></comment></comment></comment></comment><comment><USER7> Site isn't working now, but their GitHub is here [1]. My understanding on this is that Transatomic started as two young MIT students/grads who did some calcs on a molten salt reactor, found that they could run on high-level nuclear waste in a thermal-neutron spectrum, got really excited, and started a company. They did TED talks and everything [2] and really became this awesome story about advanced nuclear, nuclear startups, private investment in nuclear doing exciting new things, and so on. They were heavily featured in a documentary about advanced nuclear [3] that you can get on Amazon, where we all got a look in their doors.

Then the trouble started. They (smartly!) asked MIT to do a design review and a few questions came up on their key claims. Turns out, there were some calculation or assumption mistakes that showed that it couldn't just run directly on nuclear waste (you traditionally need fast neutrons and/or aggressive reprocessing to do this, even in molten fuel) [4]. They adjusted their copy and moved forward with an adjusted design and new calcs. Eventually they decided to close up shop and open source their design effort as a soft closure.

It's highly regular for advanced nuclear efforts to adjust their design and strategy as they move forward. In fact, I'd go so far to say it happens in 100% of efforts. The only thing Transatomic did that might be a lesson learned is that they got really hyped up early on in their effort, before they shook it down with engineering reviews and whatnot.

As far as I can tell, no one is curating progress or roadmaps in the open source effort. I LOVE the idea of open-source reactor design. It gets around huge institutional barriers clogging up opportunities for collaboration and alignment in the nuclear space. Nuclear is traditionally very secretive, and all these startups promising the world in 2024 without collaboration is basically a doomed effort. The industry must team up, find overlapping tech development efforts and facilities, and work together to build a market. Once they build the market, they can worry about competing in it. Open source can also transcend traditional funding cycles, like when national labs work on a reactor for 2-4 years, make tons of exciting progress, and then drop it. If it's open, universities, international institutions, companies, etc. can all coordinate on it.

Doing open source reactor design would require a lean and highly-dedicated non-profit or foundation or something with a handful of nuclear design pros in it to do the coordination. These projects don't run themselves. It would also need lots of legal resources to navigate export control space. Everything Adm. Rickover said in 1953 about academic vs. practical reactors is incredibly accurate to this day [5], and using open-source philosophy to face these facts brutally may be essential for progress in nuclear.

If anyone has ideas on how to fund that kind of thing, let me know.

[1] [https://github.com/transatomic/reactor/](https://github.com/transatomic/reactor/)

[2] [https://www.youtube.com/watch?v=AlRhcHNJed0](https://www.youtube.com/watch?v=AlRhcHNJed0)

[3] [https://www.newfiremovie.com/](https://www.newfiremovie.com/)

[4] [https://www.technologyreview.com/s/603731/nuclear-energy- sta...](https://www.technologyreview.com/s/603731/nuclear-energy-startup- transatomic-backtracks-on-key-promises/)

[5] [https://en.wikiquote.org/wiki/Hyman_G._Rickover#Paper_Reacto...](https://en.wikiquote.org/wiki/Hyman_G._Rickover#Paper_Reactors,_Real_Reactors_\(1953\))

<comment><USER8> Could the essential aspects of a reactor design be patented so that value can be captured despite innovation being created in the open?

<comment><USER7> Possibly, as long as participants can still be motivated to working within the open effort.

Frankly, effective reduction to practice is required 1000x more than traditional "innovation" in nuclear. Every bright mind in the 1950s was dreaming up whacky and incredible reactor designs, and everything I've ever thought of, from spinning vortex/whirlpool fuel to giant uranium gaseous pistons already has 50-page publications from back then sitting on OSTI. What's needed is to figure out how to get nuclear technology into a practical rapid iteration process where we can shake down good ideas vs. bad ideas, and put some rigor behind cost and schedule estimates.

Otherwise it's just a game of who can get investors/government most excited about their particular reactor concept, which, without actually understanding, adjusting, and improving upon what's happened in the past, will struggle mightily.

<comment><USER9> > What's needed is to figure out how to get nuclear technology into a > practical rapid iteration process where we can shake down good ideas vs. bad > ideas, and put some rigor behind cost and schedule estimates.

Sadly this is currently just not possible. You can not get regulatory approval for a prototype beyond a tiny research reactor (that is unsuited to test real production reactors). Thus nuclear companies are forced to directly produce to a production design, and to production regulation and not just that, but also prove operational regulation and so on.

This comes with incredible cost and it is very much possible that a nuclear reactor company builds one design and works with it for 20-30 years because doing any substantial redesign would require a completely new regulatory process.

Thankfully regulators in Canada and the US have been waking up to the fact that regulation as currently designed have totally crushed innovation and are trying to reform. Canada is leading in this and British, US and Canadian companies all have started to go threw the Canadian regulatory process because of this. But 40 years of fearmongering and regulation introduced right when nuclear scare was at its peak are deeply embedded both in the regulation and the culture of these agency.

</comment></comment></comment></comment><comment><USER10> I helped run a TEDx event (I did event branding and ad designs) where Leslie Dewan gave a talk about this! Unfortunately it looks like the video from her talk at our event isn't up yet, but I will ask the team if they could have it posted.

</comment><comment><USER9> Its cool that they open sourced their design. I thought it was very likely that they would fail, even more so then most nuclear startups. They made design choices that were questionable and their claim to run directly of nuclear waste seemed very surprising. They also seem to be way to optimistic about the regulatory and business aspects.

For those interested, Terrestrial Energy and Moltex Energy are somewhat more serious attempts to build molten salt reactors, both are quite different form Transatomic.

Terrestrial Energy and Moltex both are in the regulatory process in Canada (the only place a new reactor can realistically be approved) and Terrestrial Energy is the furthest along of any GenIV reactor in terms of commercial regulation in the Western world.

This talk by the main designer of Moltex is a pretty nice summation why they think it would work:

[https://www.youtube.com/watch?v=TvXcoSdXYlk](https://www.youtube.com/watch?v=TvXcoSdXYlk)

</comment><comment><USER11> Got excited about an open source reactor pattern</comment>