Inside Chipotle's Contamination Crisis - <AUTHOR> http://www.bloomberg.com/features/2015-chipotle-food-safety-crisis/ <comment><USER2> I'm just spitballing here, but I wonder how much of this food-borne illness is a function of a person's environment.

I grew up on a farm in Central Texas. We fertilized our vegetables fields with sheep manure. From our sheep.

I drank raw milk from a dairy down the road, pre-pasturization. It was wonderful stuff. The cream would rise to the top, and my mom would skim some of it off for coffee, but often we would just shake it up and drink it.

Until I moved to NYC last June, I still spent a lot of time on that farm with my family, eating vegetables and fruits fertilized by feces, eating sheep and chickens that I slaughtered myself, eating eggs right from the chickens with the detritus of chicken vag still on them. (yeah, you would rinse the eggs a little, but probably not enough to get rid of anything serious. The rinsing was purely cosmetic.)

My family runs a situation that I wouldn't call either organic, nor safe by any standards. They call it mutually beneficial.

The sheep eat the grass, then the sheep poop on the garden, the garden grows and is healthy. The chickens wander around the garden and eat the bugs that tend to eat the produce. The chickens also poop on the garden.

The chickens lay eggs that we mostly eat, and the ones we don't turn into more chickens. Sometimes we eat the chickens; sometimes we eat the sheep. Sometimes the eggs don't hatch, and we shoot them for target practice.

Anyway, my point is this: Not a single one of us has ever gotten sick from this scenario. I'm not suggesting that it's scalable or sustainable at all. Just that it hasn't been a problem for us.

I think it's interesting to note that a lot of people who go to my parent's farm from places like L.A. or Chicago or NYC do, in fact have digestive problems. I'll be curious to find out after a year or two in NYC if I have problems when I go home.

It isn't unreasonable for multiple things to be going on here.

There's an idea that because the vast majority of people live in urban areas and are not biologically equipped to handle natural food doesn't mean that really natural food is bad.

It might just mean that our bodies' adapt over time.

On the other hand, I get the point that the way of doing things that my family does is definitely not sustainable. Hell, we spend as much or more buying feed for the animals as we would just buying the stuff we eat there.

And that's using 43 acres for 30-something head of sheep and maybe 25 hens. And only maybe 20 acres for vegetables.

That's not even enough for a family of 5.

Though, I have to say, as proud as I am to be a part of Brooklyn, I'm probably a little more proud of my 96-year-old dad for managing that farm and taking care of all of it every day.

Especially in that crazy heat.

<comment><USER3> > I'm probably a little more proud of my 96-year-old dad for managing that > farm and taking care of all of it every day.

You should be, that's _very_ impressive.

<comment><USER4> I'm not sure how common it is overall (since my sample size is small), but my great grandpa and great uncle farmed their lands well into their 90s.

Anyone doing it at that age though is nonetheless impressive.

</comment></comment></comment><comment><USER5> Pro tip: if you start having bloody diarrhea, go directly to the ER. Do not pass go, do not wait five days and seek a lower level of care.

<comment><USER6> This five day delay jumped out at me, as did the fact it was mentioned without note or elaboration. This delay would not be normal here in the UK. Should it be read as bravado or fear of invoices?

<comment><USER7> > This delay would not be normal here in the UK.

Well, yes, it probably would be normal for many people to not see a doctor. That's why there's been extensive campaigns on, for example, "Be Clear on Cancer" asking people who see blood in their stool to talk to a doctor.

[https://www.gov.uk/government/news/government-launches- its-f...](https://www.gov.uk/government/news/government-launches-its-first- ever-national-bowel-cancer-campaign)

[http://www.nhs.uk/bowelcancer/Pages/bowel- cancer.aspx](http://www.nhs.uk/bowelcancer/Pages/bowel-cancer.aspx)

</comment></comment></comment><comment> daniel-levin >> The CDC says Chipotle has been very cooperative in the E. coli investigation, but that the company is having trouble telling the agency which batches of ingredients went to which stores at which times. "The system they have is not able to solve the problem we have at hand. It's not granular enough," says Ian Williams, chief of the CDC's outbreak response and prevention branch. He notes that "traceability from the farm to the point of service" should be improved throughout the food industry. In recent years, the agency has been able to find the contaminated ingredients in fewer than half of all multistate outbreaks.

To me this suggests a very simple solution. Legislate that each ingredient parcel must come with an audit trail. Assign to each parcel a reference number - a UUID or hash - that can be used to trace back its entire life and history. The solution seems so obvious that there are probably significant obstacles against doing so that I am not aware of. If such a system is implemented, then the next time a contamination breaks out, the source can be quickly identified and eliminated, then apologies can be made, and business can resume as normal.

>> The spread of norovirus in Simi Valley and Boston was caused by breaches of protocol, Ells says

Eliminating contamination entirely is a highly desirable goal, but outbreaks will likely continue occur regardless of anti-contamination measures. As a result, it makes sense to make it as easy as possible to shut down outbreaks before they become crises.

<comment><USER8> But that means government controlling our food! /s

Seriously though, where does the hash/uuid get added? The farmer? How many people will be against tracking your food and saying this violates peoples freedoms.

</comment></comment><comment><USER9> A previous big "natural" and "organic" company which had a major food poisoning problem was Odwalla. Their slogan: "Killer Juice". That backfired big-time. Sales dropped 90%.[1] Eventually they sold out to Coca-Cola, and are now a minor brand there.

[1] [https://en.wikipedia.org/wiki/Odwalla](https://en.wikipedia.org/wiki/Odwalla)

</comment><comment><USER10> South Park made fun of getting sick from Chipotle many years ago. [https://www.youtube.com/watch?v=RlIHDauX3ao](https://www.youtube.com/watch?v=RlIHDauX3ao)

</comment><comment><USER11> "The CDC estimates that 48 million Americans get sick from contaminated food every year."

<comment><USER12> That stat being buried in the article felt like poor journalism to me. Chipotle is a really popular restaurant, and the article states that 500 people got sick there since July out of (presumably) 24 million total food illnesses during that same period. So maybe nothing unusual is going on?

<comment><USER13> The impression you got is, well, somewhat distorted. While 48 million are estimated to get sick from foodborne diseases annually, only 128,000 are hospitalized [0]; while the ratio between 513 sick in the Chipotle outbreaks to the 48 million annual sick from food borne diseases is miniscule (on the order of 1 in 100,000), the ratio between even the 20 hospitalized (of 53 sick) in the _E. coli_ outbreaks in the whole set of Chipotle outbreaks to the 128,000 hospitalized annually from foodborne diseases is (while still small, by itself) a lot bigger than the ratio of the Chipotle-sick to the annual total sick (1 in 6,000 instead of 1 in 100,000).

(Also, the annual total sick-from-foodborne-illness count is an _estimate_ , the sick-from-the-Chipotle-outbreak count is _confirmed_.)

[0] [http://www.cdc.gov/foodsafety/foodborne- germs.html](http://www.cdc.gov/foodsafety/foodborne-germs.html)

</comment></comment></comment><comment><USER14> Surprised irradiation wasn't mentioned in the article. Irradiating food can give you the best of both worlds: retain the quality of raw food with none of the u-organisms. They could keep a slab of Cobalt-60 in the back of every restaurant!

<comment><USER15> Shucks, I had a feeling this was too good to be true..

[http://www.mercola.com/article/irradiated/irradiation_danger...](http://www.mercola.com/article/irradiated/irradiation_dangers.htm)

EDIT: rspeer, fair request..

> The sensitivity of vitamins to radiation is unpredictable and food vitamin > losses during the irradiation are often substantial. [0]

> Using a Co60 source, repeated irradiation of survivors of bacterial cultures > at a level initially destroying a high proportion of cells gave rise to > strains which were more resistant to irradiation than the original > cultures.[1]

> Fecal coliform concentrations higher than 10(2) CFU/g (Brazilian standard) > were found in 97 (73%) of the samples, and Salmonella was detected in 4 (3%) > of the samples.[2]

0: [http://www.scielo.br/scielo.php?script=sci_arttext&pid=S1516...](http://www.scielo.br/scielo.php?script=sci_arttext&pid=S1516-89132009000500026)

1: [http://www.nrcresearchpress.com/doi/abs/10.1139/m61-027](http://www.nrcresearchpress.com/doi/abs/10.1139/m61-027)

2: [http://www.ncbi.nlm.nih.gov/pubmed/17536694](http://www.ncbi.nlm.nih.gov/pubmed/17536694)

\---

> a blatant agenda

Here's a couple more in-depth articles on food irradiation to review his bias and see if you can trust his info in the future:

[http://www.mercola.com/article/irradiated/nuclear_lunch.htm](http://www.mercola.com/article/irradiated/nuclear_lunch.htm)

[https://www.mercola.com/article/irradiated/irradiation.htm](https://www.mercola.com/article/irradiated/irradiation.htm)

<comment><USER16> You're no really trying to make a case by linking to Mercola's site?

What's up next? Chemtrails?

Edit to add : Mr Mercola and his ilk is one of the most aggressive and virulent antivaxers.

<comment><USER17> Mercola is a bit of flipping a coin, in my opinion. A lot of what he says is "well researched", but said to pander to the crowd you're thinking of.

The articles that aren't fringe bullshit are actually pretty well done.

Unfortunately, for every legitimate article on his site, there's a "microwaves destroy food" and "cell phones eat your soul" type of article.

tl;dr: I'd use Mercola as a secondary link backing up more legitimate primary links, but I wouldn't base my entire argument on them.

</comment></comment></comment></comment><comment><USER18> Five days of bloody diarrhea until he saw a doctor?!

What's wrong with these people?

<comment><USER19> They live in a country where they have to pay for healthcare.

<comment><USER20> Well, someone always has to pay for healthcare - just that in some places (such as here in the UK) we mostly pay for it out of general taxation and it is "free at the point of delivery".

</comment></comment></comment><comment><USER21> related : TED: How I fell in love with a fish (video)

"sustainable, self regulating, environmentally friendly fish farm"

[https://www.ted.com/talks/dan_barber_how_i_fell_in_love_with...](https://www.ted.com/talks/dan_barber_how_i_fell_in_love_with_a_fish)

</comment><comment><USER22> Brace yourselves: people who know nothing about food production are about to give their informed opinions.

<comment><USER23> Maybe so, but snarky pre-emptive dismissals are worse. Please don't post unsubstantive comments to HN.

<comment><USER22> What are you talking about? I posted this fairly late after reading through the comments. It was upvoted all the way to the top. I'd say that's pretty substantiated.

<comment><USER23> Snark, indignation, and drama always get upvoted. That is a bug in human nature, not evidence of comment quality. HN is a site that tries to care about quality and thus is not driven solely by upvotes. Think of it as a constitutional democracy.

I said your comment was unsubstantive (not 'unsubstantiated') because it didn't contain any information, just a snarky putdown of hypothetical other users. Such a comment is merely a status move and those are always uninteresting, despite their popularity.

<comment><USER22> That's a fair point. Much appreciate the explanation.

</comment></comment></comment></comment></comment><comment><USER24> Organic food is overall a net negative for the environment. Due to higher crop loss, more land is used for agriculture, even when taking fertilizer-related energy use into account. Many pesticides target genes only found in the disease vector (easy to establish this via genomics) and have no impact on humans.

<comment><USER25> No. 25% lower yields are a small price compared to traditional pestcides. From increased cancer rates, dead pollinators, heavy metals and hormone disrupting chemicals we cannot even begin to quantify the cost of heavy pestcide use.

GMOs are a better solution, we can agree on that.

<comment><USER17> GMOs aren't totally the answer either. There are no proper FDA guidelines on cross-kingdom gene transfers (ie, corn with squid genes in it).

Accelerated breeding programs to, for example, use genes from one Nightshade in another, and then use a standard hybridization process to further select desirable traits _without_ harming the viability of the plant (which, for futher example, many tomato and pepper breeds are simply shitty plants that require a lot of trellising and other tender loving care to produce a useful yield) is the better solution.

Also, another very useful solution that small time farmers deploy is using predator species (bugs, nematodes, other things that eat or otherwise stop harmful bugs), or planting companion crops, such as basil and onions and garlic alongside tomatoes and peppers to deter common pests.

</comment></comment></comment><comment><USER26> I hope Patio11 has sold (or at least hedged) his shares: [https://news.ycombinator.com/item?id=3770787](https://news.ycombinator.com/item?id=3770787)

(Although looking at the long term share history, he's still up on the deal).

</comment><comment><USER27> I think it's really silly to make this about organic or sustainable ingredients. It's a simple matter of food safety, handling & cooking food correctly. All the talk about "smugness" smacks of _ressentiment_. Not a good look.

<comment><USER28> There are legitimate health risks associated with shunning modern technology in favor of organic food:

>"Contrary to popular wisdom, organic produce is not pesticide-free. Instead, it's grown with primitive pesticides that can be significantly more hazardous to humans and to the environment. Organic agriculture also lacks the benefits of the many crops genetically improved with modern molecular techniques, like Bt-corn, which reduces the population of insects that allow toxic molds to infest corn. (Organic corn has higher levels of the toxins produced by these molds.)"

>"Chipotle rejects modern synthetic fertilizers in favor of suppliers who use manure on their crops. This approach may be "all natural" and "organic" and make some customers feel warm and fuzzy, but it should not come as a surprise that applying stool, feces and excrement to growing fruits and vegetables significantly raises the risk of spreading disease. Bruce M. Chassy, food science professor emeritus at the University of Illinois at Champaign-Urbana scoured U.S. Food and Drug Administration data to conclude that organic food is four to eight times more likely to be recalled over safety concerns than conventionally grown products."

Source: [http://www.forbes.com/sites/henrymiller/2015/12/14/chipotle-...](http://www.forbes.com/sites/henrymiller/2015/12/14/chipotle- the-long-defeat-of-doing-nothing-well/)

<comment><USER29> Right. Modern agriculture wasn't invented because people were bored or stupid, it was because pre-modern agriculture made lots of people either sick or malnourished.

</comment></comment></comment><comment><USER30> I thought the whole point of eating at bland restaurants was to not get sick?

</comment><comment><USER31> McDonald's: "With all of the antibiotics in our livestock, you can be sure we killed the E-Coli"

<comment><USER32> I'm just glad we have a safe fast food burrito option which follows conventional agriculture practices with its food supply.

Let's hope this trendy organic thing stays isolated to Chipotle. A world where Taco Bell causes anyone needless gastrointestinal distress is not a world I want to live in!

<comment><USER25> Last time I went McDonald's I got sick (salad). Last time I had food poisoning it was at a Subway.

Personally, I prefer Chipotle anyhow.

<comment><USER33> Actually, McDonald's caused a small typhoid outbreak in the Maryland suburbs of Washington, DC, about thirty years ago. An employee who prepared salads was a carrier for typhoid, contracted in her(?) native country.</comment></comment></comment></comment>


When Good Waves Go Rogue (2014) - <AUTHOR> http://oceans.nautil.us/article/547/when-good-waves-go-rogue <comment><USER2> I was once in 10-15 ft seas, not really a big deal but we got hit by a three sisters event and I will say that was the scariest event I have ever seen. Basically it's a set of 3 rouge waves these where about 20-30 ft. We where in a small craft but nothing that could not navigate a single 30 ft rouge wave. Anyways the crazy thing about a three sisters event is you get hit by the first two in rapid succession and they backwash and create a gully under the third wave which pretty much puts you bow down going into it. Fortunately I had a good captain with good instincts, so he gunned it into the gully. Initially burring the bow but caused it to right faster due to buoyancy and get us traveling up the wave before it started to break. It slammed us good and knocked us to the floor but we where no worse for wear and we walked away from it. Had it broke on us in the gully, I can only imagine but by the power we got even busting thru it, if we had been in the gully that boat would have been in two pieces. Now I don't go spearfishing if there is even the remotest possibility that a squall line could whip up.

</comment><comment><USER3> I read Susan Casey's The Wave[0] about 8-9 years ago, it is told from alternative perspectives of sailors and big wave surfers - Laird Hamilton to be specific. A fascinating read, I highly recommend it. More I read about it less likely that I'm ever going to take a cruise :)

[0] [https://www.amazon.com/Wave-Pursuit-Rogues-Freaks- Giants/dp/...](https://www.amazon.com/Wave-Pursuit-Rogues-Freaks- Giants/dp/0767928857)

</comment><comment><USER4> How can this possibly be true:

> This means you have probably experienced a rogue wave and not noticed. How? > "If you're out in calm conditions," says Baschek, "and the waves are one > meter high, and suddenly you experience a two meter wave, so what?"

Given that the next sentence says:

> In fact, Baschek says one wave per day, somewhere in the world's oceans, is > a rogue wave.

<comment><USER5> The first quote is clearly true.

A rogue wave is one that almost certainly resulted from a non-linear interaction of waves because its size is statistically unlikely enough under the linear wave model. So anything 2+* the background waves.

It isn't the size of the wave. It is the size relative to the sea around it.

That said, the next sentence does not make sense to me. Particularly not given that it is also estimated that ships in the North Atlantic encounter an average of one rogue wave per year. (But mostly not in sufficiently high seas to be a problem.)

<comment><USER4> I mean if the second sentence is true then it definitely throws doubt upon the clear trueness of the first. If there is one of these per day in the entire world, then it's very unlikely that anyone reading this has experienced one.

<comment><USER5> Point.

However [https://en.wikipedia.org/wiki/Rogue_wave](https://en.wikipedia.org/wiki/Rogue_wave) quotes a researcher estimating that at any point in time there are an average of 10 rogue waves somewhere in the world.

So the second quote appears to be a misquote. And everything else makes sense.

</comment></comment></comment></comment><comment><USER6> See also (2016): [https://news.ycombinator.com/item?id=11976300](https://news.ycombinator.com/item?id=11976300)</comment>


Symbiosis of Docker and Perl [video] - <AUTHOR> https://codeandtalk.com/v/yapc-eu-2016/miroslav-tynovsky-symbiosis-of-docker-and-perl-yapceurope-2016 <comment><USER2> I like Perl, but I don't see why it would be any more "symbiotic" with Docker than any other language.

This is really just a talk on one approach to do microservices with Perl.

<comment><USER3> High-falutin' titles seem to sell better (as opposed to"Using Docker with Perl"), never mind that English doesn't seem to be his first language. The talk itself seems to be on the pragmatic side, though (unsurprisingly when it comes to Perl).

Although one could make a point that symbiosis often involves quite different organisms, and pairing one of the currently hyped buzzwords with the language that last was really popular when CGIs ruled the earth might come close to that.

</comment></comment><comment><USER4> I don't use Perl much these days, but 10 years ago I would have really benefited from containerization of Perl code. That said, Perl really does become rather unmanageable for any sizable project, and was probably best used as a light weight scripting language with a great regex engine. For that limited type of use case, [https://perlbrew.pl](https://perlbrew.pl) is a very handy tool.

On a semi-related note about Perl and later technologies, I was somewhat surprised Perl didn't receive more of a second wind from the early Hadoop days with 'hadoop streaming'. It seems they would have complemented each other well.

(edit: added that last paragraph)

<comment><USER5> You might want to check out one of the companies that has a large codebase in perl. blekko managed to build a nosql database and a million-line search engine without much technical trouble.

</comment></comment><comment> alex-2k1 Plague and Rabies : better together.

</comment><comment><USER6> Well I don't want to be the one to say it but Perl is pretty much dead, it has been replaced by Python in the last 8years or so.

<comment><USER7> A common observation, but I'm not sure how true it is. Python has much more share on things like reddit and on the TIOBE rankings, but it too is dead. Nobody likes Python3 which broke backwards compatibility for Unicode and is significantly slower than 2.x. None of the plans to JIT it have taken off. It doesn't scale. Perl isn't really any better here, but Perl6 is a completely different language than Perl5 that fixes many pain points and if ever successfully optimized might end up being the one scripting language to rule them all ;) (it has a bumpy road though). TLDR: Python has a lot of share, but no real future. It's not dead, but a dead-end (same as Perl5 long-term, but for now it is surprisingly active and well supported). Lots of new projects are done in Perl5 btw. One I'm particularly excited about is TauStation (SciFi text MMORPG).

</comment></comment><comment><USER8> Microservices are rarely extraction __or __reporting ... seems like a horrible misuse of the language (CRUD).

<comment><USER9> > Microservices are rarely extraction or reporting

Perl is just Perl now, just as LISP is now just Lisp; Perl is not, if it ever was, the "Practical Extraction and Reporting Language", any more than Lisp is now "LISt Processing".

<comment><USER3> And if we're talking about the other version of the acronym, then Perl is _ideal_ for webservices and related technologies. Listing rubbish is what a lot of the modern web seems all about.

<comment><USER10> That, and swiss army chainsaw.</comment></comment></comment></comment>


Ask HN: Whatever happened to the Internet of Things? - <AUTHOR> Did it ever reach the hype it was purported to be ?
[1] Gartner estimates $1.9 trillion in value-add by 2020.
[2] Cisco estimates a value somewhere between $14 trillion and $19 trillion.
[3] IDC estimates a value around $8.9 trillion (source: a16z research staff).
1. https://www.gartner.com/doc/2625419/forecast-internet-things-worldwide-
2. http://www.cisco.com/web/services/portfolio/consulting-services/documents/consulting-services-capturing-ioe-value-aag.pdf
http://www.cisco.com/web/about/ac79/docs/innov/IoE_Economy.pdf
3. http://www.businesswire.com/news/home/20131003005687/en/Internet-Poised-Change-IDC#.VVT0bflVikq <comment><USER2> I think people just stopped using the buzzword IoT/Internet of Things even though there are many more devices in use now than before. Just a few years ago Amazon echo was just a curiosity, and now connected speakers are everywhere. I have 70+ smart switches and outlets in my house, and even my hot tub has internet connected sensors measuring water quality. Nearly all of my neighbors have a smart doorbell, internet camera, or smart lock. And these are just the obvious examples. Self driving cars are loaded with sensors that send data back to the mothership all day long. I'm not sure of the dollar amount to put on all of that, but IoT is alive and kicking.

<comment><USER3> This. I'm working in that space and I can tell you it is very much alive. It all comes down to ease-of-use and cost of sensors. 2018 has seen especially some fantastic progress. There's still a lot of low hanging fruit to capture.

But people have stopped using the word IoT or SmartAnything and that is a good thing

</comment></comment><comment><USER4> It has gone deep in the ITU. Go look at "digital object identifiers" and follow ITU study group links.

What I hear of in large-scale IoT is that its big private networks using back end stuff in Amazon, GCE, whatever, to feed big collections of things, but they don't appear up-front in the global net, they run behind doors.

<comment><USER5> Exactly, it's still very much active and widely investigated, thrown money at. Large companies are developing and testing out their own IoT solutions behind closed doors. Just recently saw an invite from some university study group trying to get their project funded. They were looking into IoT for farming and hospitals. This segment is definitely growing, maybe not very public at the moment, but it's going to be soon.</comment></comment>


British tech workers get paid a lot less than Americans - <AUTHOR> http://uk.businessinsider.com/british-tech-workers-paid-less-than-americans-hired-salary-data-015-7#ixzz3fOYSqWxr

<comment><USER2> Those numbers look quite a bit too high on the British side - apparently devs with "three years of experience will make an average of $77,508 (£50,540)" and I don't think I've ever seen jobs advertised at that level for less than 5/7 years experience in London, especially for permanent roles rather than contract.</comment>


Free e-copy of Robin Hobb's Assassin's Apprentice - <AUTHOR> http://www.keepingthedoor.com/2009/08/16/free-copy-of-assassins-apprentice-last-chance/

<comment><USER2> I actually got "Assassin's Apprentice" for free via Kindle (which is still available: [http://www.amazon.com/Assassins-Apprentice- ebook/dp/B000FBFM...](http://www.amazon.com/Assassins-Apprentice- ebook/dp/B000FBFMG6)). The book was great, and touched off a whirlwind reading of the whole trilogy.

Great series, but the ending was really depressing even though it was pretty clear what would happen to the main character from book one onward.

<comment><USER3> Did you read the Fool's trilogy? It's a continuation of the story and also very good.

</comment></comment><comment><USER4> The Baan Free Library once gave away books from the Honor Harrington series, a decision which made them at least $100 from me. I can't understand why they don't do it more often. Well, OK, I know the reasons (contractual/rights issues, mostly) but the businessman in me says screw the reasons and get it done.

There is zero marginal cost to distributing the back lists. The core customer for these products grows to like a character/author/series and then is hooked, producing a LTV upwards of a hundred dollars. Lifetime profit is lower because _cough_ publishing sucks, but the sales generated by most of the back catalog are miniscule anyway.

They should just get the lawyers involved and start renegotiating contracts on an industrial scale. Hello, Author #147. You own 19 books with us, each covered by a separate contract. We are offering you a one-time no-negotiation deal: license us perpetual electronic reprint rights on book #1. We will use it to market your other books. We may inform you of particular promotions and details as a courtesy, but might not have the time, make sure to check our blog.

If you agree to this deal, we will establish a baseline for how many sales you had on books #2 through #19 last year. Your royalty on all sales above the baseline triples. Help us help you.

If not, firm handshake and move on to the next author. The publishers will get returns with scale more than anything else.

</comment><comment><USER5> It's too bad they're PDFs, I'd love to get ePubs without needing to run them through Calibre and then hand-tweaking them.

Or, scratch that. Calibre is sucking on these ones.

<comment><USER6> Have a look at the links they provide... One can get the book in a variety of formats through different stores. For instance, I got a few of these books for free via the Sony Store today.

</comment></comment><comment><USER7> Free e-copy of Red Mars at the same link.

I've got the series in dead tree form already, but may as well grab it while it's there.</comment>


The rich in Europe are poor - <AUTHOR> http://super-economy.blogspot.com/2011/04/rich-in-europe-are-poor.html

<comment><USER2> Am I reading this wrong, or is he actually using raw income and GDP per capita as data without taking the price of life into account ? I am not even discussing whether he's right or wrong, I just don't think it matters at all if you earn ten times more, when everything could cost 20 times more ...

Also, it seems like the author doesn't like the smaller gap between the various "classes" in europe, I couldn't disagree more. When the rich earn obscenely bigger amount of money than the poor, THEN you have a problem because they don't have any idea how the "little people" life is.

<comment><USER3> No, you read it correctly. This article and analysis is extremely flawed. My biggest complaint is that he ignores both taxes and benefits, which ties right into your concept of the "price of life". Sure, the middle class in Sweden might only make half of what they do in the US, but they're not going to be completely economically destroyed by the cost of health insurance or the lack of health insurance.

I'd happily take a 50% cut in pay if I could have the level of social services and guarantees that Europe seems to provide.

<comment><USER4> I would be happy if everyone in the US that felt this way would move to one of the 20 or so countries that offer this instead of trying to bring it here. I would rather live in a country where 0% of my pay is taken for services I don't use but I don't really have that option. You can move to your dream country I can't so please do so.</comment></comment></comment>


Ask HN: What are critical non-dev/sales roles at your startup? - <AUTHOR> And how do you fill them? <comment><USER2> I love how nobody answers this. It means dev and sales are the critical ones.

UX/CX is often a huge one. People think this is just hiring a designer. Nope. The person in charge has to understand the customer experience end to end and be able to modify it very quickly based on new information.

This is usually the CEO, who has access to all the information from marketing, sales, engineering, analytics, investors, etc. Especially for the startup level it's often the CEO who understands the problem and the users.

There's also a lot of design decisions involved in UX. Bounce rate is almost entirely dependent on UX.

It can't be outsourced either. You can have, say, a TV UX expert advise you in TV use cases or a e-commerce UX expert advise on ecommerce UX. The UX consultants have been the most expensive so far.

But past a point, only the people who deeply understand this company's product and the user problems can properly do UX and CX.</comment>


Ask HN: How to get into offensive security? - <AUTHOR> I understand web application security, that means I know what the OWASP top 10 are and I know how they work. Given a 0-day I could write a script for it. I understand what people are talking about when I listen to a defcon talk or security podcast. I know what a buffer over flow is. I also understand the basics of cryptography and can write/read assembly if I absolutely have to. I know how to read/write iptable rules. I have taken part in CTFs.
1. How does one start doing bug bounties?
2. How does one start finding 0-days?
Are there any online courses that are good at teaching the above?
I don't want to find 0-days because of malicious reasons. I want to learn how to find them as articles about them seem clever. I like the exploratory nature of it. <comment><USER2> If you're like me, finding vulnerabilities is like solving a puzzle. There's a certain satisfaction but you learn something at the same time. There was a great session at the All-Day-DevOps conference yesterday called "The 5Ws of CTF" that espouses learning computer/software exploits through playing "Capture-the-Flag" ([https://www.alldaydevops.com/addo-speakers/ell- marquez](https://www.alldaydevops.com/addo-speakers/ell-marquez)). I thought the session was recorded on YouTube but couldn't find it. I did find an earlier version of the same talk at [https://www.youtube.com/watch?v=WGiCO2u8JCg](https://www.youtube.com/watch?v=WGiCO2u8JCg).

</comment><comment><USER3> Try sites like HackerOne where you will get a framework for ethically looking for vulnerabilities in public software. Since you seem to know the lingo and top issues on the web, try to find your first XSS on a website. The first one will take some time, but once you find one you will feel the rush of accomplishment. The second one will be easier to find and you will start noticing patterns in what to look for for.</comment>


Model facts, not your problem domain - <AUTHOR> https://ruudvanasseldonk.com/2020/06/07/model-facts-not-your-problem-domain <comment><USER2> > When requirements change, an append-only data model of immutable facts is > more useful than a mutable data model that models the problem domain.

Interesting viewpoint and it sounds like a Prolog/Datalog database.

Similarly, many document databases like CouchDB will keep a revision number so the database itself will keep track of the last N revisions and garbage collect stale data.

<comment><AUTHOR> The Prolog/Datalog comparison is fair, Datomic (the subject of the "Deconstructing the Database" talk linked at the end) is built around this idea of accumulating facts, and it uses a Datalog-like query language.

But you don't need any special tools. A good old relational database will do, just don't do updates or deletes. In my case I was using a simple SQLite database.

Event sourcing is also kind of the same idea.

<comment><USER3> It's worth a mention that there is a next level of challenge for backfilling and correcting historical data - that's when a bitemporal data model is a good idea. In other words, keeping track of the "valid time" (or "application time") of when a fact became true, separately from the "transaction time" (or "system time") of when the fact was ingested into the database.

> you don't need any special tools

Absolutely agreed. I happen to work on [https://opencrux.com](https://opencrux.com) which is designed from the ground up for handling bitemporal data, but I was chatting to someone a couple of days ago who built a really neat approximation of Crux purely on Postgres, using JSON columns and 3 simple tables: Transaction_Log table + All_Documents table + Current_Documents table. A small handful of triggers were used to automate the timestamping and the population of the Current Documents table, but it was super simple stuff.

Naturally there is a big difference in scale and performance compared to something like Crux (where you can join within historical timeslices _efficiently_), but I was impressed by how flexible JSON indexing in Postgres made the approach viable with such little upfront effort.

It's probably fair to say that the majority of queries in typical applications won't ever care about prior history, but I think always having history available for native querying without having to import anything from archives or logs is fundamentally liberating.</comment></comment></comment>


Google employee activist says she's been fired - <AUTHOR> https://techcrunch.com/2019/11/25/google-employee-activist-says-shes-been-fired/ <comment><USER2> Re-instate her right after James Damore is welcomed back.

<comment><USER3> #gumdropsonrainbows

</comment></comment><comment><USER4> It's hard for me (especially having never worked at google or followed the story closely) to judge on the merits here, but I'm curious on the broader subject. It seems many tech workers have strong opinions about politics or how work should be organized or what kinds of work their companies should take on. These concerns appear to be similar to the drivers around the unionization movement a century or so ago, why not have unions in tech?

Maybe it would be structured a little differently than traditional unions, or maybe not. But it may be better than the scattershot protesting at one company, then another and total silence at yet another. It doesn't seem like there's a great vehicle for the tech community to speak with one voice in a publicly facing way.</comment>


Science is often flawed. It's time we embraced that - <AUTHOR> http://www.vox.com/2015/5/13/8591837/how-science-is-broken <comment><USER2> Academic publishing is a conversation between academics. No one paper is truly authoritative and only with time will the highly cited well regarded contributions make themselves known within the academic community (and eventually outside of it too). The time horizon between publication and "impact" for most academic work is usually (or should be) in the range of 10-20years. In the rush for funding and "impact" university PR machines (and scientists too) are forced to make flashy statements about the latest new sensational, tenuous at best implications of their findings. Boring, rigorous, incremental work has no place in a media driven funding cycle. This is a real problem and one we need to think about how to resolve.

Having said that, scientists are not perfect either. As an author, problems of honesty and reproducibility in science trouble me greatly. That's why on our recent papers ([http://www.cl.cam.ac.uk/research/srg/netos/qjump/pubs/2015-n...](http://www.cl.cam.ac.uk/research/srg/netos/qjump/pubs/2015-nsdi- qjump.pdf) and [http://www.cl.cam.ac.uk/research/srg/netos/musketeer/pubs/20...](http://www.cl.cam.ac.uk/research/srg/netos/musketeer/pubs/2015-eurosys- musketeer.pdf)) my coauthors and I have gone out of our way to make the original unprocessed data sets and detailed experimental descriptions easily available. If you take a look inside of our papers, you'll find that all of the substantial figures in the papers are clickable giving direct access to original datasets on our websites. Although not perfect, this is a start down the road of more easily testable and reproducible work. To our great surprise, only a few weeks after publication we've already got requests from people trying to reproduce the results in different environments. This suggests to me that this kind of approach both can work, and really should become the minimum standard in academic publishing.

<comment><USER3> > In the rush for funding and "impact" university PR machines (and scientists > too) are forced to make flashy statements about the latest new sensational, > tenuous at best implications of their findings.

in a lot of cases its worse than just wanting funding. A lot of companies are funding "studies" and getting them published so they can sell their latest revolutionary product.

</comment></comment><comment><USER4> I think the issue stems from a fact that most people overestimate the worth of a peer reviewed article. I like to look at it a bit differently.

A research problem is a like a discussion where each peer reviewed article provides __one discussion point __towards the solution. It by no means is entirely self encompassed but at the same time, it doesn 't mean one should discard it. The solution to the research problem isn't entirely contained in a peer reviewed article. Rather, it is one data point towards making an impact towards the larger problem. A collection of research articles is many such discussion points. The final conclusion has to be drawn by collecting all such arguments on the table and synthesizing them.

</comment><comment><USER5> This entire article is a criticism of the scientific journal industry, not "science." It is disturbing that the authors appear to have a difficult time compartmentalizing those concepts, but still consider themselves authoritative on the matter.

</comment><comment><USER6> > When people talk about flaws in science, they're often focusing on medical > and life sciences, as Horton is. But that might simply be because these > fields are furthest along in auditing their own problems. Many of the > structural problems in medical science could well apply to other fields, > too.

Pure FUD; those fields have unusually low levels of empiricism. Rule of thumb: as a science has greater trouble gathering enough data to settle disputes the scientists of that field become more and more like philosophers. They decide what's true based on arguments or personal feelings and in the worst cases they fabricate data to fill the vacuum. The problem is that the core element of science, that of rigorous experimentation, is missing from the process.

The question is if a field is only able to follow the aesthetics of science but unable to adopt the rigor to what extent should we consider it science?

</comment><comment><USER7> The problem is that admitting science is flawed means that people will propose astrology or alkaline diets or antivaccinationism as alternatives.

So yes, let's _all_ embrace that science is flawed and then work together to fix science, and not pretend that Christianity or traditional vitalism are better alternatives to science.

<comment><USER8> Science is not a religion, lets not compare apples to oranges.

<comment><USER9> Belief in Science is a religion.

</comment></comment></comment><comment><USER10> How about we just ban "journalists" from publishing articles about the results of recently published studies?

<comment><USER11> > ban "journalists" from publishing

Maybe not.

</comment></comment><comment><USER12> One humble idea: Include the proposed press release in the peer review process. Maybe require two abstracts, one for the academic journal, and the other for the lay press. And there is no loss of honor from saying that a study is of purely intellectual interest.

</comment><comment><USER13> We should obviously not embrace that. Science should never be flawed knowingly, if we break this contract, then it's best for the public to withdraw all academic funding earlier than later and seek answers elsewhere. I understand that too many people are working in science nowadays, and they all have to publish something, but that's no excuse to justify "flawed" science.</comment>


Notice: We're turning off the YC application form at 10pm Pacific - <AUTHOR>

Since people are still applying, I thought we'd better announce when the application form will be turned off.  If you want to apply, do it by tonight at 10 Pacific time.  Please don't get your hopes up, though. The odds of a late application getting funded are much lower, and the odds of us funding one this late (the first dinner is on Tuesday) are very low indeed. <comment><USER2> I'm sure you'd agree that the quality of an idea has no bearing on the time that it was submitted.

So I wonder... Do you think you've missed any investments because the company timing didn't coalesce with a funding cycle?

<comment><USER3> Then they wait a couple months and show up much earlier in the next cycle.

<comment><USER4> nice handle :)

<comment><USER5> I assume that's just his name and middle initials?

<comment><USER6> koenigdavid = king David

</comment></comment></comment></comment></comment><comment><USER7> I'm curious - how many at this point (if any) have been funded which were submitted late?

<comment><AUTHOR> 4

</comment></comment><comment><USER8> Will every application get a response, even if it's a rejection?

<comment><AUTHOR> Yes.</comment></comment>


Chrome Passes Firefox Market Share For The First Time - <AUTHOR> http://www.conceivablytech.com/9653/business/chrome-passes-firefox-market-share-for-the-first-time

<comment><USER2> It's funny. Any performance/memory tests I have done between Chrome and Firefox always had Firefox come out as the faster, less memory hungry browser.

That is on _my_ typical sites, which are not JavaScript heavy.

I think there is some cognitive dissonance when it comes Chrome... It seems fast, because everybody says it is.</comment>


Consumer Safety Notice for Nest Protect: Smoke and CO Alarm - <AUTHOR> https://nest.com/letter-from-the-ceo/ <comment><USER2> Not waving, but choking. Many comments seem to be cutting more slack to this announcement than perhaps they would for other companies' products. Nest says they discovered this for themselves, which indicates that there is some measurable effect and it came up on post-release testing, months after release. Even though some people had been discussing a potential for exactly this scenario when the product features were first announced. Given this not unexpected error condition, Nest really should have run those same tests before releasing a product whose sole function is safety.

<comment><USER3> Yea, just like the 4 recalls for my Honda Fit. They should have totally tested all those aspects before. And since I'm only paying $100 compared to the $20K for the fit, I should expect better safety measures than the automobile industry. Because the number of people that die in house fires is minuscule to the number of people who die in automobile accidents.

<comment><USER4> Honda is selling a single purpose safety device with no moving parts called the "Fit"? And it's had 4 recalls you say?

Won't that lead to confusion since they sell a car of the same name? With millions of parts? That moves down the road by controlled explosions with chemicals stored onboard the vehicle?

</comment></comment></comment><comment><USER5> The support page for the Nest Wave feature is interesting

[http://support.nest.com/article/What-is-Nest-Wave-and-how- do...](http://support.nest.com/article/What-is-Nest-Wave-and-how-does-it-work)

 _> One of the most common things you see when a smoke alarm goes off is people waving their hands, towels or magazines to air out the room. With Nest Wave, that instinctive motion will actually silence the alarm._

A person's natural response to the first sign of danger might silence the alarm, inadvertently, and lead them to believe that they are safe. That is troubling.

However, they have thought about this problem:

 _> Depending on the situation, you may need to wave more at Nest Protect in order to silence it: Non-emergency situations require less waving, such as cancelling a manual test or listening to a Nightly Promise message. For your safety, you'll have to wave more at Nest Protect during a Heads-Up or an Emergency Alarm. This helps ensure that you are deliberately trying to silence an alert._

Obviously, the liability load on this product is far more than most other gadgets. I guess that even though they anticipated this sort of issue, a paranoid level of caution is required from Nest

(Makes me think of the attention that Tesla received over one or two battery fires, or that bitcoin receives over company failures. New products are held to much higher standards than 'traditional' products)

</comment><comment><USER6> _It's very important that you immediately connect your Nest Protect to your Nest Account so we can remotely disable Nest Wave._

Does anyone else find that unsettlingly creepy? If they can disable some feature of their product remotely, presumably via firmware updates or a similar mechanism, isn't it not much of a stretch to assume they can disable the _entire alarm_ remotely?

<comment><USER7> And then they can get your Android phone to overheat and start a fire! Or slow down your car remotely when the police are chasing you!

Yup, that's the 21st century for you. Most of the cool things we have today are here thanks to being able to be controlled remotely over the Internet. I wouldn't be surprised if the next product Nest comes out with is a security system. ADT has had its run of shitty and insecure systems for too long. It is time for someone to create a better version where you can monitor everything remotely. This will have all the same ramifications: the manufacturer can lock you inside your own home.

<comment><USER6> The fact that they can do it remotely is not as creepy as how they've worded it and seemingly provided no instruction on how you can do it yourself.

</comment></comment></comment><comment><USER8> The feature I really want in a smoke alarm is a "snooze" button which I can pre-register. I don't have a good fume hood over my kitchen stove, and the smoke detector is essentially in the kitchen (it's an open kitchen/living room), and the smoke alarm is on the kitchen side of the living room).

I want a way to easily hit a button _prior_ to cooking and not have any smoke alarm (but maybe a CO alarm still) for the next 15-30 minutes. As long as I'm still in the kitchen cooking, I don't need the smoke alarm to tell me if there's a fire.

On the other hand, it's also entirely likely someone could step out of the kitchen for a few minutes, kitchen could catch fire, and bad stuff would ensue if the alarm were disabled.

One option might be a pre-alarm for 5-10 seconds, during which you can snooze it. Unfortunately, if anyone ever died in a fire where 5-10 seconds might have made a difference, massive liability would ensue.

The right solution is to move somewhere with a proper high-flow external- venting hood, of course, and only heat/CO alarms in the kitchen area.

<comment> k-mcgrady Why spend time developing a feature when the solution (moving it to a different position in the room) is relatively simple and also safer? How many people are going to hit snooze and then be called away for something and not get alerted when their kitchen catches fire?

<comment><USER9> In the UK smoke alarms are generally permanently installed to a ceiling. Moving it isn't an option.

<comment> k-mcgrady Really? I'm in the UK and they're just fixed up with a couple of screws.

</comment></comment></comment></comment><comment><USER10> Great response from Nest. But honestly - their algorithmic "trust us, the device knows what its doing" approach has always made me uncomfortable. The thermostat for instance - I don't want my thermostat to learn my habits and predict what temperature I want, etc. I just want to tell it what temperature the house should be and when, and leave it the hell alone.

Same thing with the smoke detector. False positive? Push the button. Its the rational ux given the criticality of failure modes involved.

<comment><USER11> I was under the impression that the Nest did work the way you would like— you tell it a temperature and thats it. The only "learning" involved was noticing you were gone and letting the temperature change a bit more, and when you come home it goes back to what you set. (There's also some bit about reducing the temperature a bit during peak load).

As with a smoke detector, I would never expect it to disable its smoke detecting function unless I pressed some button.

</comment></comment><comment><USER12> Very awesome and direct response by Nest. Kudos.

Oftentimes, recalls or other safety notices do not adequately spell out specific issues, merely allude to a vague "safety issue." Transparency is good.

<comment><USER13>
      > we observed a unique combination of circumstances that caused us to
      > question whether the Nest Wave could be unintentionally activated.

You think that counts as "spelling out specific issues"? That is not very transparent to me. Compare Nest's "specifics" with cperciva's response to a security bug in tarsnap:

[http://www.daemonology.net/blog/2011-01-18-tarsnap- critical-...](http://www.daemonology.net/blog/2011-01-18-tarsnap-critical- security-bug.html)

<comment><USER12> Fair enough, but for a consumer product, it's specific at least from the recalls and safety warnings I've been exposed to as a consumer (car recalls, child safety products, food, etc).

<comment><USER13> Excerpt from most recent smoke alarm recall from CPSC:

      > In  cooperation   with  the  U.S. Consumer  Product   Safety  Commission
      > (CPSC), Universal  Security Instruments Inc.,  of Owings Mills,  Md., is
      > voluntarily recalling  about 34,000  smoke alarms. The smoke  alarms can
      > fail to  alarm when smoke or  fire is present. A capacitor  in the alarm
      > can burn out, releasing smoke and melting the cover.

      > Universal  has  received  three  reports of  alarms  failing,  releasing
      > smoke. There has been one report of minor  smoke damage to the wall of a
      > mobile home. No injuries have been reported.

      > Consumers can identify  the recalled models by removing  the alarm cover
      > from  its base  and  looking for  the manufacture  date  code and  model
      > number. The  smoke  alarms  are  made  of white  plastic  and  have  the
      > manufacture date  code and  model number  imprinted on  the back  of the
      > alarm.

[https://www.cpsc.gov/en/Recalls/2000/CPSC-Universal- Security...](https://www.cpsc.gov/en/Recalls/2000/CPSC-Universal-Security- Instruments-Announce-Recall-of-Smoke-Alarms/)

<comment><USER6> In other words, a smoke-emitting smoke alarm?

<comment><USER14> Must be made in Britain. Their fire extinguishers have a tendency to ignite on use. (According to the IT Crowd tv series)

<comment><USER15> And their realistic screensavers.

</comment></comment></comment></comment></comment></comment></comment><comment><USER16> What a mess. My existing CO and smoke detectors don't need a patch.

As per my comment yesterday on Nest's thermostat, this product doesn't need to exist. To have it proven as dangerous suggests that they have their priorities wrong here. I don't want poorly engineered toys keeping me safe.

As for the press statement, it's wriggling nothing more.

Their products remind me of Zorg's desk in the Fifth Element.

</comment><comment><USER17> It's only a convenience feature anyway, it seems.

Wave seems like the type of feature that should probably have some audio/light indication that it was invoked, though.

Between this and Google, though, remind me never to name a product or feature Wave.

<comment><USER18> A convenience feature that could have killed you.

I know some engineers who design life critical safety systems for a living, and they all said something like this was going to happen when this product first came out. The example one of them gave was it was like a AED that could also let you recharge your phone, a moderately worthless feature that could only ever cause the failure of critical components.

<comment><USER19> Or perhaps a car airbag that can be disabled by spoken word

</comment></comment></comment><comment><USER20> I'm really wondering what unique circumstances could cause this. Flapping your arms out of fear when you see a fire?

<comment><USER21> Probably running/walking past the smoke alarm.

There's a fine line between too sensitive and not sensitive enough.

If I burn something while cooking I do NOT want the smoke detector to go off (it's loud), and the Wave feature takes 3 or 4 seconds before it registers.

Plus there are a lot of configurations to account for. Some people put the units on the walls while others on the ceiling. The Nest has to guess how far away people are when the walk by and how far people will be when they wave. Putting them on the ceiling with 10+ foot ceilings verses putting one on the wall in a small hallway will require different sensitivities for the Wave feature.

If you have multiple Nest Protects then they will all go off when one detects smoke or carbon monoxide, so the Wave bug won't matter too much.

<comment><USER22> Any by all accounts the sensors are ultrasound - cost effective, but not a famously high resolution sensing mechanism.

[1] [http://www.ifixit.com/Teardown/Nest+Protect+Teardown/20057#s...](http://www.ifixit.com/Teardown/Nest+Protect+Teardown/20057#s55891)

<comment><USER21> I think there are also a couple of other sensors which also help detect movement and waving. They call them "occupancy" and "activity" sensors.

[http://support.nest.com/article/Learn-more-about-the-Nest- Pr...](http://support.nest.com/article/Learn-more-about-the-Nest-Protect- sensors)

</comment></comment></comment></comment><comment><USER23> Funny, when I first read about the Nest Protect, my thought was that the Wave feature could be dangerous if it was unintentionally activated. I figured they would have really tested it to make sure that couldn't happen, but I still wasn't comfortable with the feature in general.

</comment><comment><USER24> I'm searching for a combination of "totally normal" smoke detectors (for safety) and a possibility to trigger an additional remote alert on my mobile phone. Is there some arduino project for something like that?

<comment><USER6> Personally, I wouldn't trust an Arduino for anything safety-critical...

<comment><USER24> Do you know of any better approaches?

</comment></comment></comment><comment><USER25> Kind of awesome that this will, at least temporarily, be addressed via a software update assuming that you're nest is connected to a nest account via wifi. Puts me at ease.

<comment><USER26> How do you know it will be a software fix? (Other than just disabling the feature.)

I would assume they would use a new sensor to do a more discriminating job of detecting the motion.

<comment><USER21> I strongly doubt they will replace the sensors, maybe it's influence the hardware in a 2nd version but they have plenty of sensors in the current Nest protect.

It's more of a matter of better measuring the room to allow the unit to guess when someone is walking by and when someone is standing in front of the unit and waving.

The sensors are almost working perfectly. Because this device is relied upon to save peoples lives and there are also legal repercussions to allowing a known bug, they have to make sure that the waving and walking can be distinguished 100% of the time.

Only in a very rare situation (like having the unit at shoulder level or in a hallways with a very low ceiling combined with multiple people running past it) would the unit malfunction.

</comment></comment></comment><comment><USER27> Not directly related to this issue, but I'm skeptical about the Nest Protect in general. It includes a CO detector, but CO is a denser-than-air gas, so stays near the floor while the Protect is mounted on the ceiling to detect smoke. Also, most CO detectors need to be replaced every few years because it wears out. Does this mean you have to buy a new $300 Nest Protect every 5 years?

I have a Nest Thermostat that I love, but the Nest Protect doesn't seem nearly as cool or useful...

<comment><USER28> carbon monoxide is less dense than air - according to wikipedia, density at room temperature is 1.15 kg/m³ for CO vs 1.275 kg/m³ for dry air.

The nest protect retails for US$129.00 and has a service lifetime of 7 years.

I recently checked all the smoke detectors at my parents house and found that they were all well past their 10-year replace-by date. (I replaced them, but not with Nest smoke detectors).

<comment><USER19> Fun little tangent; I don't know how old my smoke detectors are, but the one by my front door gets a little test every now and again. One of my neighbors burns a fireplace on cold days. Invisible (but smellable) quantities of wood smoke pool under the rafters of my porch; the next morning, when I leave through the door, the smoke alarm always chirps for a moment! It amazed me how sensitive it is, when I first figured out what was going on.

</comment></comment></comment><comment><USER29> Where's the consumer warning that their data is now accessible to google and the NSA?</comment>


Show HN: Anonymization App - <AUTHOR> https://www.anonymization.app/ <comment><USER2> "Upload your unredacted sensitive documents and our magic AI will remove PII for you!" \-- lol yeah sure</comment>


My 2.5 Year Journey with Vim and Why I Switched Back to Sublime Text - <AUTHOR> https://medium.com/in-the-weeds/my-2-5-year-journey-with-vim-and-why-i-switched-back-to-sublime-text-4afcc303741e <comment><USER2> You wanna try VSCode</comment>


We should retire Aaron's number - <AUTHOR> http://threads2.scripting.com/2013/january/weShouldRetireAaronsNumber <comment><USER2> So, if we make a permanent "monument" out of his domain name, what's the deciding factor for or against doing it for any other website?

Will the internet become littered with millions of permanent monuments to misguided souls, like the little crosses on side of our highways?

<comment><USER3> Take this sentiment and jump forward 100 years. What's left?

I suspect this will happen to any namespace after long enough. Domain names, Twitter handles, Facebook URLs, whatever. Once enough real estate is taken up with immobile monuments to the dead, the living will have to move on to something else.

I also think this will happen well before 100% utilization. After some point, the number of collisions you hit when trying to get a memorable name becomes too much of a burden and you just go somewhere else, as previously described here: <http://rachelbythebay.com/w/2012/11/28/namespace/>

<comment><USER4> The first number ever retired in all of sports was Lou Gehrig's, in 1939. By the 100th anniversary of that ceremony, the Yankees will have retired about 25-30 numbers. The active roster requires 40+ free numbers < 100\. What happens when they run out?

<comment><USER5> > What happens when they run out?

2 digits of base > 10?

3 digit numbers?

Hardly a tricky problem to solve...

<comment><USER6> Got a nice chuckle picturing them wearing hex numbers.

</comment></comment></comment></comment></comment><comment><USER7> Nice thought Dave. Aaron did already address this in his "If I get hit by a truck..." post: <http://www.aaronsw.com/2002/continuity>

And Sean is most definitely on the case. But please give him some time and space.

<comment><USER8> I agree. We should leave the responsibility of the upkeep of a virtual presence after death to the person themselves. Aaron showed that you can plan for your presence after death: maybe we should all have some sort of plan. (Something like a will).

<comment><USER9> If you read through Dave Winer's past writings on this subject, you will find that there is currently no good way to implement this such a plan.

</comment></comment></comment><comment><USER9> Dave Winer has discussed the issue of preserving websites for a long time. He calls this "Future Safe Archives".

[http://scripting.com/stories/2007/03/29/fourIdeasForTheFutur...](http://scripting.com/stories/2007/03/29/fourIdeasForTheFuture.html) [http://scripting.com/stories/2007/12/10/futuresafeArchives.h...](http://scripting.com/stories/2007/12/10/futuresafeArchives.html) [http://scripting.com/stories/2009/10/10/onceAgainFuturesafeA...](http://scripting.com/stories/2009/10/10/onceAgainFuturesafeArchive.html) [http://scripting.com/stories/2011/01/10/nytOnFuturesafeArchi...](http://scripting.com/stories/2011/01/10/nytOnFuturesafeArchives.html)

Even just a week or so before Aaron's death.

[http://threads2.scripting.com/2013/january/makingWebArchives...](http://threads2.scripting.com/2013/january/makingWebArchivesSafe)

I am sure that I have read him write about this many other times, maybe going back over a decade.

<comment><AUTHOR> I first got really serious about it when we lost the RSS 2.0 spec on a server upgrade at Harvard. That's when I realized that unless we took serious steps to protect the content, by using least common denominator technology, and not requiring a separate domain, that it wouldn't last very long after everyone who cared about it was gone from Berkman.

It's turned out pretty well. The spec is still there and accessible, and now it's been almost ten years at that spot.

I'm also hosting my uncle's site and now my father's. I'm not happy with the job I'm doing on either of them, but I have my own work to move forward, and as I do that of course I'm creating MORE problems. But I'm also trying to be mindful of separating the content from the rendering. The actual content is stored pretty permanently, and the rendering is considered lose-able.

Eventually I hope to have ultimate editorial flexibility and have it also be very future-safe. CMSes can anticipate these problems, and I've tried to do that in my latest development.

</comment></comment><comment><USER10> It's hardly a "small" hack. Who would be running the site, paying for bandwidth, etc. Who decides who gets a memorial like this? It's essentially creating infinitely long registrations and adding a "special case" that will remain in the internet's infrastructure forever.

<comment><USER11> Aren't all physical memorials, statues, plaques, banners paid for? Just like paying for the upkeeping of a memorial, I see no difference.

<comment><USER10> Someone just has to keep paying for the domain and hosting and it will remain forever. This is proposing that we never allow these domains to be registered again, even if they expire

<comment><USER12> If the Internet Archive would support hosting the content/collection, I'd be willing to throw $50-100 into a pool to prepay the domain for the next 10-20 years.

The content can't be over a GB. Hosting that all static in S3 would be, what? ~$0.10/month+transfer costs?

</comment></comment></comment></comment><comment><USER13> While the idea is novel, domains are virtual real estate. I don't think it's in anyone's best interest to retire domains/addresses. There are many more sane ways to make all of the content easily accessible indefinitely.

<comment><USER14> Isn't that exactly what a grave site is? Real estate permanently set aside for a deceased person.

<comment><USER15> Moving or simply paving over cemeteries may be more common than you think.

</comment></comment></comment><comment><USER16> It's a good idea. I'd say there are a number of options; at the very least a mirroring setup would be sufficient - I'm certain that there are people that are able to do this quite easily with wget.

Even I have servers that I'd be willing to provide that could certainly handle the load his now-static mostly-text sites. I'd even be happy to hold the domains and pay the registration into the future. I think Aaron already had a post about who would be handling his assets if he "got hit by a bus".

</comment><comment><USER17> For the domain name, aaronsw.com . It's currently not possible to register domains for more than ten years.

You could envisage some sort of way have putting the domain in a trust fund. Where there would be funds to renew the domain, you could potential show how much is in the fund, on the trusts's page. And as long as there is money in the fund, the domain would be renewed. The domain technical contacts, and possibly the other contacts too would need to be put in the trusts name so that they can renew with the registrar, and possibly change the DNS if needed.

As for the hosting, you could probably run a script that would take a static snapshot, and save the files in plain HTML. This of course gets more complicated for sites that use things dynamically with database backends.

</comment><comment><USER18> It depends on what arrangement he had with/for his heirs, and with his registrar.

</comment><comment><USER19> "The Internet is just software."

<comment> cm-t ah, just noticed your comment :)

( cf: <https://news.ycombinator.com/item?id=5066250> )

</comment></comment><comment><USER20> I've often thought that the Internet Archive would be a good entity for this. I would happily pay a large one-off fee to cover domain name renewals and static hosting in perpetuity. I don't know how such a fee would be calculated - the cost of 100 years of .com renewals at the lowest negotiable fee perhaps?

<comment><USER21> You could just start your own domain name registrar. Family can transfer the name after death or you could transfer there before you die. Add a small link to the bottom of the page to donate to support re-registering the name ad- infinitum. The registrar collects donations to keep it going. Maybe add hosting too. Unfortunately getting your own registrar company would cost $50-100K from what I've read plus $8K annual dues.

</comment></comment><comment><USER22> I'm surprised there are no virtual cemetaries. A company (a known Internet entity like Archive.org, WikiMedia or W3C would be best, not a startup that will pivot away in 3 years) could offer for a fixed fee to take your blog, freeze it in time, and publish it online forever.

<comment><USER23> > I'm surprised there are no virtual cemetaries.

There are several obituary sites, they're one step away from that. And in a sense portions of <http://reocities.com/> are exactly that, for instance: <http://reocities.com/SunsetStrip/1838/> I'm committed to keeping that alive as long as I can afford it. So far so good.

</comment></comment><comment><USER24> Why would a porn site ever choose aaronsw.com as their domain? We aren't going to run out of strings.

<comment><USER25> traffic and backlinks are a valuable commodity, that's why.

</comment></comment><comment> cm-t >The Internet is just software.

wait, what ?</comment>


Bayadera: Bayes and Clojure and GPU - <AUTHOR> http://dragan.rocks/articles/17/Bayadera-Bayes-Clojure-GPU-slides-Bobkonferenz <comment><AUTHOR> Here are the slides (open in any web browser, best wieved in Chrome) for my upcoming talk at Bob Konferenz in Berlin on 24th February. Any comments and suggestions welcome!

<comment><USER2> Hey, this looks very interesting. Unfortunately I won't be at that conference, but I suppose there will eventually be a video of it online?

<comment><AUTHOR> I hope there will be.</comment></comment></comment>


Let's talk about ZRTP - <AUTHOR> http://blog.cryptographyengineering.com/2012/11/lets-talk-about-zrtp.html

<comment><USER2> For anyone else wondering for what ZRTP is the acronym, apparently it isn't one. It is SRTP [1] with the S replaced with Z since it was developed by the Zfone Project [2].

[1]: <http://duckduckgo.com/Secure_Real-time_Transport_Protocol>

[2]: <http://www.zfoneproject.com/>

[3]: ZRTP spec: <http://zfone.com/docs/ietf/rfc6189bis.html>

</comment><comment><USER3> Interesting overall. But I'm pretty sure that's not how the birthday paradox works. You have to put all the ~random elements into the same pool so that each one of your 2^16 values has 2^16 candidates to match against. This handshaking is always one on one. I mean yes it's possible that the same SAS will show up in completely unrelated calls but that won't help Eve.

<comment><USER4> I think what he is saying is that we can get lucky in guessing the correct hash even if we guessed the value wrong.

b can only be picked once, and we transmit g^b Attacker then needs to guess a g^a that will cause hmac(g^ab) to match. So we might guess an incorrect g^a that still manages to collide and give us the correct hmac.

This apparently close to doubles our chance of guessing correctly? Depending on the properties of hmac this sounds reasonable, but still doesn't affect security much, as he says - it would still be 1/2^{16} - not likely to happen.

</comment></comment><comment><USER5> I'm still waiting for ZRTP to catch up in normal XMPP/Jingle clients like Pidgin and etc. Somehow support for it is really lacking.

<comment><USER6> Jitsi supports it, among other encryption protocols:

<https://jitsi.org/index.php/Main/Features>

<comment><USER5> Yes, but it's still strongly lacking in most other clients to be useful.</comment></comment></comment>


Our app is a website. Click to download and watch - <AUTHOR> https://infstream.com <comment><AUTHOR> Hey HN! We're Callum and Ben, founders of Infstream

Infstream is a video sharing platform that allows creators to earn from their exclusive videos by charging fans $1 per month for access.

Problem: Earnings from ad monetized videos is inconsistent, requires a large audience and minimum watch times before you can even apply for access. Income is highly variable, and dependent on the location of your fans, and topic & length of your uploads.

\- Digital creators are facing decreasing revenues from d based services that prefer algorithmic feeds focusing on the largest creators. \- Users have to watch adverts, or begin paying for a relatively expensive monthly subscription service to watch content they may not want to.

The general consensus from creators is that they are tired of existing platforms taking a large proportion of their earnings, whilst making sure content is advertiser friendly, otherwise they risk their videos being removed and subsequently, their livelihood affected.

The idea: after listening to a large number of creators that had complaints towards existing video monetization platforms, we thought of a platform and model that solves all of these issues, with the top priority ensuring that creators are earning their fair share.

What's different? \+ Creators earn directly from their fans, with a $1 per month subscription (per channel). The price makes content accessible for all and is an easy sell to an engaged audience. \+ It doesn't matter how often you upload, how long your videos are, what they contain or where your subscribers are from. \+ Creators start earning from their first subscriber \+ Human support and manual video review systems make sure creators aren't at the mercy of bots and automated systems removing their content first, and asking questions later. \+ Users can build their own library of influencers and YouTubers that they want to watch, adding and removing subscriptions on a pay as you go basis.</comment>


Certifications - <AUTHOR> Certification: My wife is about to be a lawyer, is good at tech (used to do support at medical co.), but wants a cert  for her résumé. I know they're crap, but lawyers don't.  What would be a good certification for this? <comment><USER2> She wants a certification for her résumé? If she's about to graduate from law school she should be officially obtaining her JD or LLB equivalent. That's a pretty good "certification" by itself.

Also, if she graduated from an accredited American law school, she will most likely be taking the Multistate Bar Exam[1] soon which then grants her the ability to practice in multiple states depending on her MBE score. This will also be something of note she can state on her résumé that employers will value.

[1] [https://en.wikipedia.org/wiki/Bar_examination#Multistate_Bar...](https://en.wikipedia.org/wiki/Bar_examination#Multistate_Bar_Examination_.28MBE.29)

<comment><AUTHOR> Yes, of course all that, but so are all her classmates. None of that sets her apart, nor does it suggest IT skills.

</comment></comment><comment><USER3> I would find something with regards to security and compliance, like CCISO. This will be useful in various parts of the business/startup world. [https://ciso.eccouncil.org/](https://ciso.eccouncil.org/)

I doubt an A+ cert would be much use as people are suggesting. (which is for computer technicians - the people that replace hard drives, network cards, etc).

<comment><USER4> Great suggestion!

Any cert will need an explanation: "I have this A+ so I would know what the forensic techs are talking about" or "This CCISO has given me insight in understanding the liability our clients really take on -- and what is ridiculous. And I can explain it to a judge."

A couple of comments like that and then everybody will point to her and say, "she's the go-to expert on X!"

</comment></comment><comment><USER5> I'm not exactly sure why she would need one, especially considering lawyers won't know what's what. So if this is about resume building, I guess we'd need more information about what she's trying to accomplish.

If it's about learning something, I guess she should pursue what she's interested in.

All that said, A+ is what I consider a good "entry level" certification. It's not hard, but it's also not possible to bullshit your way through without knowing something. Most CompTIA are like this. Also good are MS Professional certs, Red Hat, VMWare, and Cisco. There are definitely others, depending on the area, but those are a few that I see often that most would consider legitimate (meaning you don't have to just go through motions to get them).

</comment><comment><USER6> I think an Amazon Developer certificate could be a good choice. One of the lower level certifications like associate developer[1] wouldn't require much time investment vis-à-vis studying, while still having broad name recognition.

[1] [https://aws.amazon.com/certification/certified-developer- ass...](https://aws.amazon.com/certification/certified-developer-associate/)

</comment><comment><USER7> If she's just looking for something to show that she has some level of technical skill, I'd second the suggestion others have made for CompTIA certifications. They are a good base level cert - [https://certification.comptia.org/](https://certification.comptia.org/)

Depending upon what type of law she is planning to go into:

\- A+ is targeted at basic devices and operating systems (think: very basic tech support)

\- Network+ is basic networking

\- Security+ is basic security

etc.

Probably the best way to start.

</comment><comment><USER8> You should say a little more about what her goal is. Is it to:

get a job?

"In" tech?

As a lawyer?

As a patent lawyer?

HR lawyer?

Does she want a job as a programmer?

There are lots of certifications (as you well know), so people need to know more about the goal.

<comment><AUTHOR> Good point. She'll be a lawyer, but working in tech related to non-patent IP. Definitely _not_ HR. Her mouth and overall "direct style" preclude that. No programming directly, but working with the subject to protect IP.

<comment><USER8> If by non-patent IP you mean: NDAs, Non-compete's, and Trademarks, then it would depend on the particular niche.

Really, if she is working as a lawyer, I don't think a particular certification will give her more credibility. Given what you said, a design certificate might give her a leg up in Trademark law.

If she is going to work with code itself, I would definitely learn as much git as I can. She can diff a few files, and get a feel for how much people borrow and fork when it comes to code.

Those are the ideas I have but she probably knows more about it than I do, from your description.

</comment></comment></comment><comment><USER9> Not a specific cert per se, but super important info for a lawyer to understand if she wants to do law around technology.

[http://kfrankc.me/cs88s/](http://kfrankc.me/cs88s/)

</comment><comment><USER10> Probably A+ from CompTIA.

<comment><USER11> I agree, A+ will serve a lawyer well. Time and money well spent ++++

:)</comment></comment>


Show HN: I launched Claritask (built from scratch in the open; not a programmer) - <AUTHOR> https://claritask.com/updates/claritask-launched <comment><AUTHOR> Thank you all for the positive comments so far. The response has been very encouraging considering I launched Claritask with 2-3 features. Simplicity and design have been praised so far.

Some people on twitter were super kind with praise [https://twitter.com/GranitGjevukaj/status/908232553357873157](https://twitter.com/GranitGjevukaj/status/908232553357873157)

And some found a bug that I had overlooked when updating some js classes: [https://twitter.com/josefdlange/status/908373904455999488](https://twitter.com/josefdlange/status/908373904455999488)

I'll be posting updates on my YouTube about launch/build, etc. [https://www.youtube.com/c/ValonSopi](https://www.youtube.com/c/ValonSopi)

Thanks tons all!

///

You can follow my written Updates here: [https://claritask.com/updates](https://claritask.com/updates)

OR

subscribe to my Weekly Dispatches. View previous Newsletters before deciding to subscribe: [http://us16.campaign- archive1.com/home/?u=95b8b388569827f889...](http://us16.campaign- archive1.com/home/?u=95b8b388569827f88928849e6&id=1382362061)

</comment><comment><USER2> Absolutely well done!

How many hours to do that from no coding experience?

Did you do a bootcamp or completely self taught?

You are inspiring me to keep going with my project. Which is a Haskell blog even though I'm no Haskell expert.

<comment><AUTHOR> Thanks for the good words!

In days that I was working on it, I would go for some 8-9 hours/day (with breaks in between). Other days I'd work less, if I had client working needed to work on. I'm counting time spent on tutorials, forums, asking questions, etc.

So 30-days like that / sans weekends.

Totally doable with the amount of documentation that's online on learning how to code (StackOverflow, Quora, Asking devs on my coworking floor)

</comment></comment><comment><USER3> GL man!

Lots of task trackers out there. I'd focus on finding 1 major differentiating feature next.

<comment><AUTHOR> That's very true @ztratar!

The whole thing started from this post I wrote about a month ago: [http://valsopi.com/blog/play](http://valsopi.com/blog/play)

I'm trying to keep the whole thing as a play-thing / if anything comes out of it, Great!

</comment></comment><comment><USER4> I'd like to see what it looks like without signing up for an account.

<comment><USER5> Here, I took some screenshots for you. It seems like all you can do is make a project, add tasks, and then mark them Active or Complete.

[https://imgur.com/a/AKWIq](https://imgur.com/a/AKWIq)

<comment><AUTHOR> Thanks @graysonk!

That's basically all there is for now. I've launched as soon as I had Auth ready.

I talk more about current features and what's to come here: [https://claritask.com/updates/claritask- launched](https://claritask.com/updates/claritask-launched)</comment></comment></comment>


Why coronavirus is so frighteningly successful - <AUTHOR> https://www.theguardian.com/commentisfree/2020/apr/20/coronavirus-master-of-disguise-scientists-viruses-covid-19 <comment><USER2> _> As we now know only too well, Sars-Cov-2 is far more of a menace, because it can cause severe acute respiratory syndrome in some patients, which may lead to between 1% and 7% mortality._

Wrong. See the newest study from Dr. Ioannidis here: [https://news.ycombinator.com/item?id=22922812](https://news.ycombinator.com/item?id=22922812) (spoiler: fatality rate is estimated to be 0.12-0.2%).</comment>