Use Rails? Check yourself for the YAML exploit - <AUTHOR> https://www.tinfoilsecurity.com/railscheck <comment><USER3> It might be worth mentioning "We determine this by sending a harmless request to your web server. The request doesn't do anything -- it is designed to be rejected with an error, much as if someone typed a URL incorrectly and requested a web page which doesn't exist. If your application is vulnerable, it will respond with a particular error code, whereas apps that are not vulnerable will not. [bold]This vulnerability allows attackers to execute code on your server, but we don't actually do this.[/bold]"

I mention this because I have lately had a lot of experience dealing with Rails devs whose attitudes with regards to security are akin to "If you don't do voodoo then voodoo can't hurt you." We should take special care when communicating with them to a) emphasize that we're not the bad guys and b) explain, as many times as required, that ignoring the bad guys does not make the bad guys go away.

<comment><USER4> Mind if we copy that verbatim? :)

<comment><USER3> Go for it.

</comment></comment></comment><comment><USER3> You should mention that this will give false negatives for people who actually are vulnerable but happen to be running Ruby 1.8.7, by the way. (I'm distilling that from this part of the announcement blog post, plus the knowledge that Syck is the default 1.8.X parser. It is indeed difficult to exploit -- I banged my head into a wall for 12 hours attempting to do so -- but people who are highly credible to me on this issue report having successful exploits for it.)

 _Also, this check is for websites using the Psych YAML Engine and not the older Syck. All of the proof of concepts we've seen so far are for Psych. That doesn't mean Syck isn't vulnerable, but that our checker will only work for Psych. In all likelihood, Syck is vulnerable too and you should upgrade your Rails all the same._

<comment><USER5> The exploit gist was actually pretty easy to modify in order to correctly identify if a Rails 2.3.x / Ruby 1.8.7 app was vulnerable. If you accept the fact that "payload being interpreted as object deserialized from YAML" is bad, then you don't necessarily need a malicious object to see if your app is vulnerable. If you have access to your Rails logs, then you just need to see a params value in your logs that's an object.

Here is my modified gist that can help you identify if your app is vulnerable, which works with Rails 2.3.x / Ruby 1.8.7 apps. If you run this and see in your Rails log something like "params = {#<ActionController... => {default => :action}...}", then your app is vulnerable: [https://gist.github.com/4694948/26d9b6d46c2c60aeb5abde9ca2c2...](https://gist.github.com/4694948/26d9b6d46c2c60aeb5abde9ca2c2154a5816968e)

We also have a couple apps we know of that are really old Rails 2.2.x apps. This doesn't work with them, because the passed YAML doesn't work in the old YAML parser. But then, if you just trust that deserializing an object from YAML in parameters is bad, then we can just make a super simple hash object and check our rails logs to see if the params contain an actual hash object. Here's an even-more-simplified-harmless proof-of-concept to test older Rails 2.2.x apps: [https://gist.github.com/4694948/1e8a94f7c768bf95863288005039...](https://gist.github.com/4694948/1e8a94f7c768bf958632880050399904defba531)

I'm no security expert, but I was able to use these PoCs last night to verify that the patch for Rails 2.3.x worked, and also that my reverse-engineered- patch for Rails 2.2.x worked as well.

Edit: Just to clarify and reiterate, the above modified PoCs require access to the Rails app logs to check if they worked or not, since the older Rails apps could error out for YAML-parsing reasons (which are just as bad, because it just means an attacker needs to get more creative with their YAML payload), instead of being a result of rejecting the attack. That's why I don't think a web-based attack mechanism like this could really know 100% whether or not an app is vulnerable unless it really tried doing something semi-malicious, like obtaining secret information.

<comment><AUTHOR> You're completely right. We call out that it isn't 100% certain if we return a 'not vulnerable'. Our full scan will soon include some code execution modules for these vulnerabilities which will provide a more certain response.

</comment></comment></comment><comment><USER6> After the fantastic post by patio11, I spent all afternoon emailing every person in my network. Letting them know of the huge security risk. The answer I got from most people? "We have backups, and plan to deal with it soon. Thanks for the heads up." Really? This is the kind of stuff that made me delete every simple rails project I had on my workstations, and just push them to git. No sense in risking it.

Oh, and best of all was the response from my webhost (which is well known here):

 _We've added updated Rails installers to our control panel so that new Rails apps will be created with the latest secure versions. However, it's our customers' own responsibility to upgrade their existing Rails apps.

Note that customer Rails apps run as unprivileged users, with resources managed by the kernel cgroups feature, so its very unlikely that you'd see any issues on your own sites if another customer's app was compromised._

Hmm, very unlikely but still possible. Not something I want to hear from the people who Im trusting with my projects. I'm canceling my account tomorrow and moving away from them. I know they are not responsible for their client stuff, but this is a real threat to their servers.

<comment><USER7> FWIW, some hosts were more proactive --- Heroku in particular sent out email to the owners of vulnerable apps within a day or two of the announcement.

<comment><AUTHOR> EngineYard did this too, FWIW.

</comment></comment></comment><comment><USER8> anyone have an open source command line tool to do this? call me paranoid (and probably dumb) but I really dont want to enter this into another website

<comment><AUTHOR> I can tell you we're trustworthy, but I hear where you're coming from. :)

With that said, you can use Metasploit for this too - we just wanted to make a really easy checker for those that wanted a quick OK/NO GO and didn't want to deal with setting Metasploit up.

Metasploit docs here: [https://community.rapid7.com/community/metasploit/blog/2013/...](https://community.rapid7.com/community/metasploit/blog/2013/01/10/exploiting- ruby-on-rails-with-metasploit-cve-2013-0156)

<comment><USER9> You are providing a valuable service, but is Metasploit really necessary for this? I think this is a simpler command:

'grep rails Gemfile.lock'

If you don't see a rails version of 3.2.1, 3.1.10, 3.0.19, or 2.3.15 then you are vulnerable. Yes?

I guess in theory an attacker could have compromised your server and changed the rails version number...

<comment><USER10>
        3.2.1 is not safe (you probably meant 3.2.11)
        3.0.19 is not safe (3.0.20 was released to fix CVE-2013-0333)
        2.3.15 is not safe (2.3.16 was released to fix CVE-2013-0333)

<comment><USER9> Good point. I just copied the version numbers from the linked website - <USER2> guess it was outdated. Although I checked again and they are correct now.

</comment></comment></comment></comment></comment><comment><USER11> Does this work, at all? I get nothing but "There was an error - please double check the URL and try again". There is no-one in the support chat provided. As far as I can tell it simply does not work.

And, to head off the inevitable comments, yes, it's free, I know: I'm just letting people know not to waste their time with something of zero value.

<comment><AUTHOR> Sorry about that! Can you email email@example.com and I'll take a look? It's 11PM here and we've taken a few hours to rest. :)

</comment></comment><comment><USER12> I think this page is hoax ... just an attempt to gather a list of rails urls. looking at my logs I see no such request.

<comment><USER13> I think it can't deal with the traffic it's getting. I saw a couple of hits to my server and the page's progress bar moved a little, but it's been stalled for quite a while now.

<comment><AUTHOR> Are you referring to the scan from our homepage or the Rails checker? Either way, could you get in touch with us at email@example.com or <http://www.tinfoilsecurity.com/chat> ? I'd love to see what went wrong.

We shouldn't be having issues with load.

</comment></comment></comment><comment><USER14> I just tried this on one of my side project sites and it's reporting it as being vulnerable. However I upgraded the site to Rails 3.2.1 last week (and just confirmed that's the version in the bundle). Is there something that would cause a false positive or is my app really still vulnerable?

<comment><AUTHOR> There is the potential for false positives, but I'd be happy to chat about it - feel free to get in touch either via email at email@example.com or in our support chat: <http://www.tinfoilsecurity.com/chat>

ITYM 3.2.11? 3.2.1 is definitely vulnerable... We had a typo in ours that said 3.2.1 was safe - so sorry about that! Fixing that now. You should upgrade to 3.2.11.

<comment><USER14> Aha, well apparently I never merged that commit into my deploy branch, so it was still actually on 3.2.1. That combined with the fact that your page had said 3.2.1 was safe caused my brain to short circuit and not realize that 3.2.11 is what it needed to be on. :) I'll redeploy and check it again, thanks guys!

<comment><AUTHOR> Yeah, that was totally our bad. I'm deploying the typo fix now.

Let me know if you have any other issues! Happy to help.

<comment><USER14> See, in a very circular way I was just reporting the typo. :)

(Looks good now that I have the right release deployed, by the way.)

<comment><AUTHOR> Ha, fair point. :)

Glad you got it fixed!

</comment></comment></comment></comment></comment></comment><comment><USER15> Out of technical curiosity, would it be reasonable to remove YAML from the source tree and check for the lack of exploit via "find $APP_ROOT -name "*.rb" | xargs grep YAML"?

<comment><USER3> You cannot conveniently remove YAML from Rails. It is used in dozens of places in the framework, including some code paths which your app is virtually guaranteed to exercise.

</comment></comment><comment><USER16> This doesn't seem to work. It returns the OK for apps I know I have not patched (simple stuff I've thrown up on heroku).

It's possible heroku is filtering the headers...

<comment><AUTHOR> We know it's not supposed to be 100% reliable, but we haven't seen any false positives so far, actually; only false negatives.

Are you using Syck instead of Psych? If so, that would cause it to return the OK instead, since our check only works for Psych.

</comment></comment><comment><USER17> So what is the exploit, and how do we fix it?

<comment><USER3> There have been multiple vulnerabilities discovered with semi-related causes. These all have (several) exploits which are widely available. The upshot is that they permit remote code execution (i.e. "root the server") on virtually all Rails applications accessible on the public Internet and, perhaps, some which are not.

Rails has been updated to close these particular vulnerabilities. The proper versions are listed in these two advisories. There are also work-arounds if your app is not in a state to just upgrade Rails. If your app is in that state, I _strongly advise you_ that your only priority for the next several days is fixing that, because _one should have high confidence that there will be more vulnerabilities announced soonish_.

[https://groups.google.com/forum/?fromgroups=#!topic/rubyonra...](https://groups.google.com/forum/?fromgroups=#!topic/rubyonrails- security/1h2DR63ViGo)

[https://groups.google.com/forum/?fromgroups=#!topic/rubyonra...](https://groups.google.com/forum/?fromgroups=#!topic/rubyonrails- security/61bkgvnSGTQ)

</comment></comment><comment><USER18> Single location to aggregate a list of all vulnerable apps.

<comment><AUTHOR> See my response here: <http://news.ycombinator.com/item?id=5153615>

You are more than welcome to use Metasploit - a lot of our customers didn't want to go through the trouble of setting up their own Metasploit config, etc., so we built this to give them a simple quick check.

</comment></comment><comment><USER19> Rails Security is apparently "omakase" - meaning 'leave it to someone else', apparently.

<comment><USER20> Do you pose any interesting facts or thought to these discussions? I've seen you post in nearly every single one of these threads with nothing constructive. I understand that "you used to use Rails" and are much happier now that you're leaving the "insecure framework" but do you need to post it in every single thread?

Disclaimer: I'm a java programmer.</comment></comment>


Ballmer talks reorg, stack ranking - <AUTHOR> http://blogs.seattletimes.com/microsoftpri0/2013/07/15/ballmer-talks-reorg-stack-ranking/

<comment><AUTHOR> Personally I'd probably settle for removal of some of the more horrible stack ranking practices. Google's stack ranking is not as bad as MS for example: [https://news.ycombinator.com/item?id=6224655](https://news.ycombinator.com/item?id=6224655)</comment>


Amazon adds ocean freight to the pieces of the shipping puzzle it controls - <AUTHOR> https://techcrunch.com/2017/01/25/amazon-adds-ocean-freight-to-the-pieces-of-the-shipping-puzzle-it-controls/ <comment><USER2> "Amazon is a logistics company" is a common refrain. It's obviously a core capability and essential to the journey from "bookshop" to "general purpose two-sided global end-to-end fulfilment platform" via ships, drones, planes, self-driving trucks, automated warehousing and so on. This is hardly a surprise but it's still instructive to understand that AWS is also a logistics monster.

There's a quote from James Hamilton from 2014, "Every day, AWS adds enough new server capacity to support all of Amazon's global infrastructure when it was a $7B annual revenue enterprise (in 2004)." The actual number of facilities elements, computing & storage units is not specified but, you know, it's obviously _a lot_ , and that was three years ago. Imagine the supply chain & logistics required for that constant growth. Layer on the step function of adding each new region or AZ. Realise there's a lag between demand and fulfilment, and consider the impact of failing to meet a demand projection because something shipped late.

Every global public cloud probably shares similar concerns, but I think one reason AWS got to be a first mover is the logistic capability burned into Amazon's DNA.

obdisclosure: I'm ex-AWS, opinions are my own, all facts above are public.</comment>


Show HN: MacOS app to help you focus and be more productive - <AUTHOR> Hey HN,
I made a small app that plays ambient sounds in the background to help drown out noisy environments.
https://itunes.apple.com/us/app/serenity/id1185371817?ls=1&mt=12 <comment><AUTHOR> Clickable link [https://itunes.apple.com/us/app/serenity/id1185371817?ls=1&m...](https://itunes.apple.com/us/app/serenity/id1185371817?ls=1&mt=12)</comment>


Show HN: AddressLabs – Free API for parsing free-form US addresses - <AUTHOR> http://www.addresslabs.com/

<comment><USER2> '800 w El Camino Real 4th floor mountain view ca' results in:

{"number":"800","street":"El Camino Real 4th Floor Mountain","street_suffix":"Vw","street_pre_direction":"W","city":"Ca","intersection":false,"delivery":{"address_line":"800 W El Camino Real 4th Floor Mountain Vw","last_line":"Ca"},"input":"800 w el camino real 4th floor mountain view ca"}

<comment><AUTHOR> Thanks for your feedback! Looking into it.

</comment></comment><comment><USER3> How do you determine the end of a street address?

For example

10 Avenue of the Americas New York, NY 10020

Street Number: 10 Street name: Avenue City: Of The Americas New York

<comment><AUTHOR> There are a few address formats that don't strictly follow the usual USPS address standards - "StreetType of StreetName" is one of them. Some of them are already addressed in the API (like using letters instead of street numbers), addressing others is still in progress.

We are currently working on identifying these unusual addresses and plan to integrate them into the API very soon.

</comment></comment><comment><USER2> I don't see anything on your website about pricing. Can i run 300k entries through your api for free?

<comment><AUTHOR> Sure, go ahead, it's free as in beer. I would really appreciate if you could provide feedback on the results you are getting - it would help us make the necessary improvements.</comment></comment>


Response to Nodejitsu NPM Trademark - <AUTHOR> https://gist.github.com/mikeal/9242748

<comment><USER2> I pledge not to use nodejitsu or have any dealings with nodejitsu employees until I see a blog post stating that they have changed their minds and are not going to hijack npm trademark.

<comment><USER3> I pledge not to use nodejitsu or have any dealings with nodejitsu employees.

There's nothing to stop them from saying "sorry", and equally nothing to stop them from doing it again. It should not have happened in the first place.

</comment></comment><comment><USER4> Issacs wrote the initial npm and was by far the largest contributor.

[https://github.com/npm/npm/graphs/contributors](https://github.com/npm/npm/graphs/contributors)

<comment><USER5> According to Mikeal he "wrote the original version of the npm registry". More of his thoughts on the history of NPM here:

[https://gist.github.com/mikeal/8947417](https://gist.github.com/mikeal/8947417)

<comment><USER6> the registry, yes, not npm itself. isaacs also has committed more to the actual registry code than I have as well.

</comment></comment></comment><comment><USER7> I wonder how it relates to a few npm forks ([https://github.com/rlidwka/yapm](https://github.com/rlidwka/yapm), [https://github.com/visionmedia/npm](https://github.com/visionmedia/npm)) created earlier this year, especially to second one since @visionmedia didn't change its name...

And what about alternate npm-compatible registries ([https://github.com/mbrevoort/node-reggie](https://github.com/mbrevoort/node- reggie), [https://github.com/rlidwka/sinopia](https://github.com/rlidwka/sinopia), [https://github.com/cnpm/cnpmjs.org](https://github.com/cnpm/cnpmjs.org)), not based on CouchDB?

"npm" isn't only a product name anymore since it's used extremely widely, so this doesn't seem like a good thing to do.

<comment><USER8> In the trademark world you are arguing that "npm" has become "genericized" [1]. That certainly can happen, but that would be a very hard argument to make given npm's relative youth and the lack of true use as a generic. The people you link are either forking the actual npm client (in which case they are referring to it as a proper noun), or are building their own repo architecture, in which case they refer to it as an "npm registry" or "npm repository", not just "an npm".

[1] [http://en.wikipedia.org/wiki/Generic_trademark](http://en.wikipedia.org/wiki/Generic_trademark)

<comment><USER7> As far as I remember, "npm registry" is a trademark as well. Isn't it? At least, that's what is written here: [https://github.com/npm/npm#legal- stuff](https://github.com/npm/npm#legal-stuff) .

My point is: any single package README contains a phrase "install me using `npm install whatever`". It feels like it is generalized already...

</comment></comment></comment><comment><USER9> Had to go 4 pages back in HN to find this. Guess this story is getting flagged by someone.

<comment><USER10> I saw it via Node Weekly. Wondered why I didn't see it on HN. Go to post the links, already posted. Strange!

</comment></comment><comment><USER11> It's my understanding that in open source communities, the relevant trademarks are usually held by a community-led foundation (e.g. the Apache Software Foundation, the Python Software Foundation). Is there no "Node Foundation"?

<comment><USER7> There is no node foundation, "Node.js" is a Joyent's trademark. We had discussed this particular bikeshed in the mailing list last year. :)

</comment></comment><comment><USER12> Well. This is the week I started really getting into node. It's also the week I found about this. It's all disheartening. It's probably a necessary awakening step for developers in regards to truly considering the ownership of their tools.

I hope the npm replacement word is going to be as easy and short, or even more so. nnn? "nnn is not npm"?

<comment><USER13> Maybe just n3?

PS: It is weird that node.js community well known for internal battles. Everybody throw shit at each other and nobody win from this.

</comment></comment><comment><USER14> Why hadn't nodejitsu trademarked npm beforehand, if they believed the owned the right to it?

</comment><comment><USER15> so who owns npm?

<comment><USER16> Well, before Jason Smith started to try to monetize npm, I would have said nobody. It's open source, right?

After, well, he's the first one to do it, and it's not as though anyone else was in that space. So to me he has a better claim than Nodejitsu.

It's possible that my knowledge is incomplete though so if anyone knows better please correct my misconceptions.

I can't really see Nodejitsu's claim here. Also, why didn't nodejitsu voice their reservations over his use of npm before Jason decided to monetize the project? I feel as though either we don't know the whole story or Nodejitsu is pulling a fast one on the community.

<comment><USER17> > Well, before Jason Smith started to try to monetize npm, I would have said > nobody. It's open source, right?

That's not what open source man. There are still copyright notices in open source code.</comment></comment></comment>


A320-X DRM: What happened - <AUTHOR> https://forums.flightsimlabs.com/index.php?/announcement/11-a320-x-drm-what-happened/ <comment><USER2> Previously: [https://news.ycombinator.com/item?id=16412541](https://news.ycombinator.com/item?id=16412541)

It sounds like they distributed a tool that goes through your Chrome saved passwords database and if the installer thinks you're a pirate, it sends credentials from that database back to the author. The author is now saying they used credentials they learned from this to break into a private website to learn more about how their DRM was being bypassed.

This seems so incredibly illegal, I can't believe they admitted that this is what they're doing.

<comment><USER3> Never trusted browser saved passwords. One of the first things I disable after I install a browser. Also disable saving form data

<comment><USER4> Even if you don't save passwords in Chrome, malware can still keylog you, or steal your password from whatever other password database you use.

<comment><USER5> That's what hardware-backed crypto protects against. Passwords on their own is a bad security practice.

A tiny dedicated computer like Tomu[0] that fits into your computer, that provides authentication (and similar cryptographic functionality), with inpedentent input (touch) to receive manual ACKs and output (led) to provide feedback, with no other functionality, is a cheap, reasonably safe, and convenient solution. Maybe unlock it on boot (and after timeout) with a password/PIN for good measure.

[0] [https://www.crowdsupply.com/sutajio- kosagi/tomu](https://www.crowdsupply.com/sutajio-kosagi/tomu)

<comment><USER6> This sort of thing is awesome in theory, but in practice it kinda sucks, and will continue sucking until it becomes a first-class feature in the eyes of browser and desktop environment developers.

Currently I'm using Chrome backed by KWallet backed by PGP key on a YubiKey 4. Upon launching Chrome I have to authenticate with/touch the Yubikey to unlock my session, which is spiffy, but after that seemingly random pages (even in an incognito window) will prompt Chrome to unlock my keychain. The Yubikey will flash, indicating _something_ wants access to it, but I have no indication of what that something is. If I ignore the flashing, eventually a KWallet window pops up complaining about being unable to use the GPG key.

<comment><USER5> What you are describing is a specific scenario based on specific solutions. I see multiple things going wrong there.

Chrome shouldn't access your credentials without telling you what it's used for. Chrome shouldn't expose cryptographic identities in incognito mode. The Yubikey's output is vague.

What can we learn from that?

Chrome has shortcomings in this domain. Just one monochrome LED is maybe not enough output to give reasonable feedback.

My online banking security system is called chipTAN and uses a small, monochrome, low-res display to give essential information for what is being processed which I need to acknowledge. That works well, but is also a single- purpose solution.

For identification on the internet, a solution based on GPG seems reasonable. Imagine a small display that shows the receiver you are identifiying to, the identity you are using, and for how long the identification is valid, and then you can acknowledge that.

</comment></comment></comment></comment></comment></comment><comment><USER7> I wonder if they realise just how _illegal_ their actions are, and that they've fully confessed to breaking the law?

They should have at least sought legal advice before trying to do what they did, but failing that at least sought it before posting this message.

<comment><USER8> They should go the FB/Goog route and claim it was a bug.

<comment><USER9> Would that hold water? A file was added to the installer which has clearly nefarious purposes. As well the output produced by running that file was caught by another executable and sent home. Pretty hard to say that this wasn't intentional. Even if you would claim it was bundled erroneously, why would that be part of your code base anyway? It has no legitimate use there.

</comment></comment></comment><comment><USER10> Sent base64'd to a non-secure endpoint with open RDP... ouch.

[https://www.fidusinfosec.com/fslabs-flight-simulation- labs-d...](https://www.fidusinfosec.com/fslabs-flight-simulation-labs- dropping-malware-to-combat-piracy/)

</comment><comment><USER11> If anything this is just going to want to make the crackers keep cracking their releases even more, because one thing they certainly love is a good challenge, and these "bomb-like" features would appeal to them greatly.

(Long-retired cracker, no longer active in the scene but still fights from time to time. ;-)

</comment><comment><USER12> What's the background exactly?

As I read it, they had a function to grab various bits of data from a specific machine that was linked to a specific cracker. Did it misfire and started to pilfer data from other unrelated machines?

Edit - for the record, the original post title was somehing like "Flightsimlabs attempts to explain their password-stealing DRM malware".

<comment><AUTHOR> Here's a Reddit thread discussing the malware: [https://www.reddit.com/r/flightsim/comments/7yh4zu/fslabs_a3...](https://www.reddit.com/r/flightsim/comments/7yh4zu/fslabs_a320_installer_seems_to_include_a_chrome/)

I'm shocked that the company admitted to doing this.

<comment><USER13> Admitting to the crime is a form of damage control. Someone with a clue figured out what was going on, spoke to the lawyers, and determined that the penalties, if any, would be harsher if they wait for a trial before admitting guilt.

That's all it was. They are in a lot of trouble, potentially, and it will be interesting to see how this plays out. I am hoping that charges will be pressed, because this is not the first time developers have "booby trapped" pirated software, but it could be the last if justice is served.

<comment><USER14> All for their DRM scheme.

I still find it interesting how many people don't realize that generosity could be a valuable part of your product. That growing the industry as a whole may be more important than getting back at people who weren't going to buy your product anyhow.

<comment><USER15> I can see generosity working for a single developer but you are not going to build Electronic Arts with donations alone.

<comment><USER13> Whats wrong with that? Electronic Arts is a cancer on the gaming industry.

</comment></comment></comment></comment></comment></comment><comment><USER16> I sort of appreciate the creativity here, though it's blatantly creepy and uncomfortable for a software vendor to be pushing updates with single-user- targeting functionality, in particular, to say nothing of the spyware issue itself.

<comment><USER17> Ham Radio Deluxe blacklisted one user for writing a critical review, then blackmailed him to remove the review in exchange for lifting the ban: [https://www.theregister.co.uk/2016/12/21/amateur_radio_fans_...](https://www.theregister.co.uk/2016/12/21/amateur_radio_fans_drop_hammer_on_hrds_blacklist/)

</comment></comment><comment><USER18> What I don't understand from their explanation is why they had to do this at all -- if they could identify the bogus serial numbers, then why not just block those serial numbers from registering?

<comment><USER19> Might have been a whack a mole situation where the crackers have figured out how to make key and they know how to switch them easily whenever you invalidate one.

<comment><USER20> So maybe stop wasting effort of a clearly lost battle and instead spend it on making your product so brilliant people will be begging you to take their money?

</comment></comment></comment><comment><USER21> I wonder if they are in fact shooting themselves in the foot in their fight against this cracker.

Aren't there laws that basically invalidate evidence gathered by illegal means?

<comment><USER22> In the US, there are laws that invalidate evidence gathered by _the government_ through illegal means. This simply does not apply to private entities.

</comment></comment><comment><USER23> I am curious what the piracy rates are for this game vs actual sales, because I am having a hard time justifying investing that much effort into what they did.

<comment><USER24> I wonder if the publisher even knew, or could ever know. It's presumably hard* to work out the counterfactual - how many more sales would have been made in the absence of the crack/keygen being available.

They do mention that they kept seeing repeated personal information being used on registration, but also that the cracked version was changed to use a different activation server. Confusing.

*or even impossible

</comment></comment><comment><USER25> Gotta say, on reading this I went _" They did what?!"_. This raised my eyebrows so much, I'm fairly certain they're now lost somewhere in my hairline. In the US, at least, I'm fairly certain they've broken more than a few laws. Kudos to them for admitting it, entirely; I guess that would be the only hope they'd have of ever re-gaining any sort of trust with their install base, but they'd be equally smart to find a lawyer[0].

I get that a _lot_ of time and effort goes into developing a product and it's _really_ frustrating when you find out that your product is being pirated. I can't imagine if I'd happened upon a whole community sprung up around pirating my product; they had to be incredibly angry and this likely led to this terrible idea. And no matter how often you repeat to yourself that "piracy does not represent lost sales", when you've poured your time into something -- time that you hope will make you a nice living, time that you took away from your family or other enjoyable pursuits -- you tend to get _really angry_ when you find out there are people that think it's perfectly OK for you to work for free.

I like to repeat the mantra that "piracy does not equate to lost sales" and tell myself that those wouldn't be paying customers anyway, or they're not my real target audience, or that it speaks to the popularity of the product if someone went to the trouble to crack it. And I'm a believer that effort spent on DRM is wasted (especially efforts like this). It's not entirely, true, of course. I always think back to the story I read a few years ago about the TCP/IP stack that nearly every DOS PC used -- a piece of shareware that, at the time, was probably the most popular piece of shareware in existence. I'm sure I, like many, didn't even think to pay for it and operated under the assumption that large corporations were probably using it and the developer was probably using $20 as kindling by now when in reality I think he netted somewhere in the _thousands_ of dollars for his efforts.

At the same time,... well... _this_.

 _This_ is exactly what happens when you focus on piracy so hard. Developer time is a finite resource and this company wasted that time developing a piece of DRM that is indistinguishable from malware. It succeeded in _not_ stopping the pirates, _not_ catching the pirates, angering their _paying_ customers, easily exposing them to civil legal issues and possibly exposing them to criminal legal issues. That little bit of wasted developer effort could very well _end_ the company that made this product in a way that piracy probably never would have. Assuming their customers _like_ the product and would like it to continue to exist, this company basically did everything in their power to _not_ serve their customers.

To be clear, I'm not completely against purchase verification in software products. If it's light-weight, and doesn't get in my way as a customer, it's fine (i.e. provide the ID/password used when it was purchased with a fallback to an offline serial number ... asked _one time_ and _never again_ ). I get it. A small road block is enough to keep my mom or dad from grabbing a copy that a friend attached to their e-mail. Heck, in the case of my mom or dad, they may not even _realize_ that it's not a free product if it _doesn 't_ ask for some form of verification. I don't mind how Steam works or how the variety of stores handle these sorts of things. If your DRM effort goes any beyond this, it's wasted effort. You're not going to stop a determined pirate even (especially?) if the product your selling _is an anti-piracy product_. Just don't. Don't waste the effort. It's _never_ worth it.

Even as I write this I'm still _amazed_. I get frustrated when I upgrade my CPU/memory/GPU and _Office_ won't run without some extra steps. I can't _imagine_ if step #2, after falsely identifying me as a pirate, was "send a bunch of personal data to the authors"[1] so they can turn me in to the authorities. Pro-DRM folks like to equate piracy with theft, so I'll make an equally poor analogy and say that'd be like if I purchased bed sheets at Wal- Mart, and the processor in those sheets[2] decided I stole them, so they started sending the GPS location of my house along with pictures of my bedroom to corporate so that they could turn that information over to the police.

[0] Sure wouldn't be difficult to compare this with any other piece of malware in its behavior, but IANAL.

[1] And yes, I realize that they've stated that they're looking for specific information from a specific pirate that they consider to be the _source_ of the problem, but including that payload in the installer makes me question the truth of this statement. I don't have any reason to dis-believe them, especially considering they've basically written up a post admitting to a bunch of activity that may very well be illegal in nature, but having no way to verify that they are telling the truth, or that there isn't a circumstance that could false-positive flag someone who _isn 't_ that very specific case, I will err on the side of assuming the worst in this case.

[2] I laughed when I wrote that, then I thought ... there's probably already sheets with processors in them. If there isn't, there will be. Shortly followed by the first case of DDoS by IoT bed-sheets.

</comment><comment><USER26> would be funny if the pirate sues these guys for hacking and puts them in jail

<comment><USER27> That is a very possible outcome, especially as several of the actors involved are based in the EU.

</comment></comment><comment><USER28> If they are in the US, anybody on whose PC this ran, including the Cracker, can probably get them all thrown in jail for CFAA violations.

</comment><comment><USER29> Releasing DRM-free is a thing if you want to respect your users, instead of insulting them.

</comment><comment><USER30> This now has the identifier: [http://cve.mitre.org/cgi- bin/cvename.cgi?name=CVE-2018-7259](http://cve.mitre.org/cgi- bin/cvename.cgi?name=CVE-2018-7259)

</comment><comment><USER31> from the headline I thought it was about the Iranian airplane that crashed</comment>


Collated Evidence on What Marijuana Does - <AUTHOR> http://examine.com/blog/the-unbiased-truth-about-marijuana/

<comment><USER2> This strikes me as a very naive view of Marijuana, by focusing exclusively on the Sativa variety, and of the 12 - I think - cannaboids commonly found, only taking into account the effects of THC. That it considers inhalation to be the only method of administration is also indicative of a less-than-ideal amount of knowledge on the subject.

<comment><USER3> We can only research and collate the existing research.</comment></comment>


Zenefits Adds $15M From A16Z To Become The All-In-One Solution For Startup HR - <AUTHOR> http://techcrunch.com/2014/01/22/zenefits-adds-15m-from-andreessen-horowitz-to-become-the-all-in-one-solution-for-startup-hr/

<comment><USER2> I'm a big fan of Zenefits.

At my last startup, we grew from 0 to 65 employees without the help of Zenefits and it was painful. Employee on-boarding, HR paperwork, and healthcare enrollment were all done manually.

Now, Zenefits can handle all that for us. We could send new hires the paperwork they need to fill out before they even start. This makes onboarding so much easier.

(Note, I'm not affiliated with Zenefits. Just a big fan.)</comment>


Facebook, It's Like Instagram for Birthdays - <AUTHOR> http://www.jakelevine.me/blog/2012/02/facebook-its-like-instagram-for-birthdays/ <comment><USER4> A lot of web apps - both the established players and the startups - seem to be in a "sort of, but not really" state. I'm pulling this from a column by Thomas Friedman about Russia ( [http://www.nytimes.com/2012/02/05/opinion/sunday/friedman- ru...](http://www.nytimes.com/2012/02/05/opinion/sunday/friedman-russia-sort- of-but-not-really.html) ) where he says that Russia is "sort of a democracy, but not really". Applied to web apps, Facebook is sort of a way to keep in touch with friends and family, but not really, because it's mainly a pile of uninteresting crap streamed from a bunch of people you hardly know. Twitter is sort of a way to follow interests, but not really, since it's mainly a vast swamp of mind-numbing, hash-tag inundated stupidity that most people don't read.

That's not to say there isn't value in these services, because there is - <USER2> use both. It's just that it seems so half-assed. When you consider the ways in which, say, the introduction of the telephone changed society, Facebook just looks silly.

<comment><USER5> > _When you consider the ways in which, say, the introduction of the telephone > changed society, Facebook just looks silly._

Or maybe just less elegant. Part of the problem is there's not really an obvious problem to solve. In the case of the telephone it was like: "what if you could talk to someone instantly across hundreds or thousands of miles, _without a telegraph operator_!". Then they did a lot of hard work to build a network to meet this end goal, which only does one thing with a dead-simple interface, and it changed the world.

With Facebook and Twitter it's a little trickier because what's the universal goal? We already had email, newsgroups, chat rooms, blogs, etc. So the premise is something like: "what if you could broadcast your thoughts and digital content instantly to thousands of friends and followers?". Right away it's sort of a head scratcher. If you think about it you come up with lots of little niches where it's handy, but nothing that strictly couldn't be done before. The secret sauce is that it's engaging and people like using it so you have a powerful network effect. But at the end of the day it becomes a type of noisy commons; It's heaps better than the truly public internet cesspools like YouTube, but it is increasingly inadequate for individual needs.

<comment><USER6> "Part of the problem is there's not really an obvious problem to solve."

Isn't that just a nice way of saying that Facebook isn't useful?

I think the interesting take-away from this article is not so much that Facebook has changed the context by adding features that include a larger network of people, but rather that perhaps Facebook is most useful when you use it exclusively with a small network of people with whom you have very real, close relationships. Suppose Facebook had exactly the same features that it has now but was limited to college campuses where connections could be made only with close friends and classmates. Would the experience really be any worse than it was when the functionality was more limited?

When the author was in college and he had just recently joined Facebook (and presumably most people he had ever met were just starting to use it) his network was necessarily small and limited to those people whom he had recently met and socialized with. As the years went by, more and more people joined his network. But few, if any left.

The problem is that that is not an accurate reflection of real-world relationships. Over time people prune relationships, either consciously or subconsciously, but the point is that in the real world, relationships evolve and end, but Facebook doesn't do a great job of evolving with those relationships. Recently I find myself using Twitter more and more to the exclusion of Facebook because on Facebook I get inundated with a mixture of every kind of update, a very small percentage of which I care anything about. I don't de-friend people because that is considered rude and what if I do want to reconnect with that person someday?

With Twitter there are definitely times that I get inundated with annoying tweets, but because I can quickly and easily stop following somebody, it is very simple to maintain my network and keep the information presented to me relevant.

<comment><USER5> I don't disagree with any of the rest of your comment, but:

> _Isn't that just a nice way of saying that Facebook isn't useful?_

No it's not—along two axes. First, I should have said "it doesn't solve _an_ obvious problem", it solves many small problems of varying degrees of obviousness to different people. Second, it is not a unique solver of these problems.

Facebook is definitely useful, but it's not a home run in the way the telephone was because communication is no longer a technical problem.

</comment></comment></comment></comment><comment><USER7> I was always perplexed by Facebook's decision to get rid of the birthday gifting system (on someone's birthday, you could pay FB $1 to give them some sort of picture as a gift). It wasn't popular among my friends at first, but it eventually got to the point where every time it was someone's birthday, they got at least _one_ gift from someone.

I can only imagine that if Facebook had pushed it hard enough, it would only have become even more commonplace. When you have 500M+ users, each of whom has a birthday once a year, and each of whom has numerous friends to wish him a happy birthday, $1 gifts are nothing to balk about.

The opportunity they had reminded me of the story behind how the diamond business itself created the profitable tradition of giving engagement rings and wedding rings.

<comment><USER8> Your post immediately made me imagine a go-between that enabled people to send a physical/voucher gift to an email address or social media account. Sender would choose something and pay for it, but assign the recipient as a virtual address. The recipient would then hit the go-between and arrange fulfillment, choosing the postal address themselves.

If you could get it tied into the networks and built up as something of a tradition within Facebook/Twitter /Pinterest (as you said, Facebook would be perfect for it), it could get some traction.

Maybe have it trawl recent posts for gift suggestions in various price brackets.

</comment></comment><comment><USER9> Very similar to my thoughts. Plus, I have some other experiences to compare to, and FB doesn't come out very well in those comparisons.

Some websites allow you meet new people and to get to know them better over the years. You'd think "social" networks should do that as well, but they aren't. In fact, Facebook sort of works in the opposite way. For the most part, it's a collection of people whom you used to know, but whom you know less and less as the time goes. It doesn't allow for much real communication (which is essential in preserving any kind of meaningful relationships) and it's designed to discourage speaking with "strangers". (Remember all those warnings about not friending people you don't know?)

What irritates me to no end is that there are lots of people who seem to be (socially) incapable of using email, IM or phone to share the same information they share on Facebook.

<comment><USER10> I don't see what you mean by "designed to discourage speaking with 'strangers'", it seems to me that the interest tags that Facebook has implemented and the stream of people it suggests for you to be "friends" with encourages exactly the opposite behaviour. There may be some lip service to online safety, but everything else points to pushing users to expand their networks.

As unintuitive as it seems to me, a sizable minority of people use Facebook as a way to meet others, either for dating (read: hooking up with your friends hot friends), shared interest, or just adding another source to the stream. Perhaps this is what keeps others active on the network? The few who activity seek out new connections keep everyone else just engaged enough to keep posting pictures and a few lines about their life.

<comment><USER11> That stream of people supposedly represents people you already know but aren't friends with on Facebook.

I agree with OP in that Facebook that greatly taken away the ability to find people who are into a specific topic. I would like to find people in my area who like the film "El Mariachi". There is a Facebook page for it here: <https://www.facebook.com/ElMariachiMovie> I can see that 30,000+ people are fans of the film. Great! However, I can't see any of these people (let alone their proximity to me). The best I can do is maybe post something to the page, which will NOT appear by default, and may or may not get lost in the noise about other posts about actual Mariachis or maybe Mexican restaurants with the same name. The functionality related to one of my favorite books is even more bare (<https://www.facebook.com/pages/The-Man-with-the-Golden-Arm>)!

This leads me to believe that (in the wake of privacy concerns) Facebook is no longer designed to help you meet strangers. You might find someone with similar interests, but it is likely to be a friend of a friend. This might be intentional. It's not necessarily bad or wrong, but I think it is important to call it out.

</comment></comment></comment><comment><USER12> Facebook is also great for organizing events. I don't know anyone who uses e.g. Evite anymore. Social chatter.

I'm not generally a fan of how ubiquitous FB seems to have become recently, but when everyone is on the same network and that network has some simple tools for doing socially useful things (making plans with people lots of people and carrying on idle chatter), that's handy.

</comment><comment><USER13> More than anything I miss the "How are you connected" feature that was sort of a six degrees of Kevin Bacon for every person in your school. I would spend a lot of time picking completely random people almost always finding a connection.

I guess the graph got too big.

</comment><comment><USER14> "So should I un-friend that girl I met at a party five years ago but haven't spoken to since? Oh wait, you make that nearly impossible. Plus, how then will I know that she needs my help to kill a rival Mafia?!"

If you no longer care about someone's updates or anything that's going on in their life, you can remove them as a friend. I know tons of people who have removed people from their friends lists. Or if someone plays too many games and you dont like seeing that update on your feed, mute those types of posts or posts from that user.

<comment><USER15> It's actually quite difficult to remove a friend. You have to go to their individual page, scroll down, look at a text link on the bottom left of the page, click "Yes" in the confirmation box.

I wish I could just navigate through my friends list and remove friends right from there just like how I can add them to groups or lists or anything I want.

<comment><USER16> Actually, you can just hover their name anywhere on the site (including your friends list), hover the "Friends" button and click "Unfriend". It hardly gets easier than that.

<comment><USER17> A: Anything you have to do by hand up to 400+ times is not particularly easy. It's an hour's mind-numbing work.

B: It's only easy if there's no cognitive load to unfriending someone. If you have to call them up in your mind, decide if they're still a friend... that's thought, and the emotions involved can be literally overwhelming depending on your personality.

C: Do the people you unfriend get alerted in any way? Take everything I alluded to in point B and raise it to the third power, because now every click is also a social signal...

<comment><USER16> A: True, but "mind-numbing" does not mean "quite difficult". Also, if you have 400+ Facebook friends you wish you hadn't I think it's your fault, not Facebook's. I don't expect any service to provide marginal functionality like that. You do that once and from then on you think more carefully before accepting someone's request.

B: True, but the parent was talking about UI.

C: No.

</comment></comment></comment></comment></comment><comment><USER18> *"It was my Birthday a couple of weeks ago. From my 527 friends, I received 52 birthday wishes on Facebook. That's 10% of my friends — more activity in one day than I saw in an entire year prior. Who are these strangers posting on my wall? I haven't spoken to some of them in 5 years. What a wonderful treat to hear from them on my birthday."

This paragraph pretty much sums up why I deleted my Facebook account - <USER3> two or three (bad memory..) years ago on the 10th of January, the day after my birthday. I never hated Facebook, I never had any problem with the company... I just realised, having got a bunch of emails telling me that people who don't know me well enough to tell me in person, or on the phone, or on skype/msn, or via sms, had left birthday wishes on my wall, that I hadn't had a use for it in quite a while before then.

<comment><USER19> I wish Happy Birthday to people I haven't spoken to in 25 years (apologies for being old). I wish it to people I don't really know (members of a creative collective I belong to). I wish it to any of my friendsters that have birthdays on the day that I happen to visit FB. It's not so random as it sounds, either, I have fewer than 200 FB friendsters.

Most people think it's nice to receive birthday wishes, and if you're simply not getting them from the people you want to get them from, that's not their fault.

Then again, I turn off email notifications for this stuff so I don't get that kind of inundation that I saw in years past. The only email I get from FB is, coincidentally, the one that tells me whose birthday it is this coming week.

<comment><USER20> It's a nice sentiment, but sometimes I wonder what is the point as well. I've often thought of deleting facebook for similar reasons. Not necessarily because a flood of emails regarding people of whom I'm not invested in decided to jump on a birthday band wagon. But I think a piece of what he's saying, is why bother. It's just a reminder that the majority of people you've told yourself you're there for(facebook that is), you know to keep up with these peoples lives, aren't really all that important to you. If it takes a flood of copy and pasted "happy bday!" messages from people who don't talk to you on days facebook doesn't tell them exactly what to say..To open peoples eyes to that... so be it.

<comment><USER19> Why does a nice sentiment have to have a point?

<comment><USER20> Could probably rephrase this, as a nice sentiment can be very nice with no point at all. But the "happy birthday!" messages on facebook, imo, have lost their meaning and relevance a long time ago. There's no thought or effort that goes into this action. In the early stages of facebook, there was still a couple more steps that had to be taken to get that message to the old acquaintance. Thus, albeit small, a little more meaning. "Oh, frank, he actually took those couple steps, thats so nice."

Now, as a society, as well as on facebook, we're a step away from automating our wishing people happy birthdays. That progression is what is slowly chipping away at that "nice sentiment." For all I know, you write heartfelt messages to old acquaintances, leaving them feeling awesome that you cared to write to them on such a day. But the vast majority don't, facebook tells them to say happy bday to these people [list of names]. Without even leaving the page, and following exactly what facebook tells you to say, you've said the most generic thing you can possibly say to someone on their birthday.And to top it off, you haven't said anything to that person since last year on that day. And again, by "you", I mean the majority of people, not you personally.

The occasional person will go the "extra mile" sticking the persons name at the end of the message, or saying something like "hope you're doing well!"..It's just an illusion that that doesn't mean much of anything. I'm not saying I hate getting 100s of "Happy bday's" from people I don't talk to or, in a lot of cases, even know. Or that people are assholes for routinely wishing every single person on their friends list a big happy birthday. But the sentiment really isn't even there anymore, to me. All facebook has done for us, as far as birthdays and keeping in touch with old acquaintances in this manner is concerned, is make the actual efforts, like phone calls and real personal messages, even more valuable.

<comment><USER19> That's all in your interpretation. _You_ have devalued the birthday wishes you receive, _you_ feel your birthday wishes are insincere, _your_ friends aren't sending you the kinds of birthday wishes you want. None of this mentions your wishes for other people.

 _Now, as a society, as well as on facebook, we're a step away from automating our wishing people happy birthdays._

The dystopia you imagine is already here in the form of Christmas Card lists.

</comment></comment></comment></comment></comment></comment><comment><USER21> I understand the authors position, but FB's value is different for lots of different people. Your journey on Facebook might be very different than mine and I don't think that means there should be a blanket statement about Facebook's value. Part of that value is that everything is inter-connected.

</comment><comment><USER22> A friend entered a fake birthday when joining FB, thinking it was not really something FB needs to know about.

The amount of greetings and happy wishes on one random winter day greatly amused him.

<comment><USER23> My brother entered a false day intentionally thinking that it would be it would be a good way to filter genuine from empty happy birthday wishes.

<comment><USER24> My brother updated his birthday to the 9th of the current month for 8-9 months straight and got birthday wishes every month. He carefully monitored for and deleted people giving it away on his wall, and reading the posts (often the same people for several months) was hilarious. 'hey man, I totally thought your birthday was in May? oh well, happy birthday!'

</comment></comment></comment><comment><USER25> _Who are these strangers posting on my wall? I haven't spoken to some of them in 5 years. What a wonderful treat to hear from them on my birthday._

I couldn't tell if this was sarcasm. Is it really a treat? An empty "happy birthday" posted out of obligation that took practically no thought from someone that has otherwise not bothered to contact you in 5 years and will probably not do so for another 365 days?

<comment><AUTHOR> Sarcasm :) sorry, I got a little snarky there.

Totally agree with you.

</comment></comment><comment><USER26> I have, and continually remove people from my friends list -- it makes no sense for them to know what is going on in my life if I barely want to speak to them in person. And wildly more important I really don't care what is going on in their lives.

I take the Larry David approach and prefer to have less friends and acquaintances

</comment><comment><USER27> Facebook really needs a 'friend clean up' tool ASAP. The problem of having irrelevant friends is huge.

<comment><USER28> Facebook has no interest in reducing the complexity/value of your social graph.

<comment><USER29> That tool would add complexity/value to your social graph. They'll get to annotate nodes with the "removed using cleanup tool" information.

</comment></comment></comment><comment><USER30> How did they know about my Facebook usage habits? Is this a thickly veiled privacy article? Though seriously, it's easy to look back in retrospect and summarize webapps like this. It would have been more interesting if they discussed what the future could hold for Facebook. They are in a bit of a "serves no real purpose" limbo for me and I'm sure many other people. I have some fuzzy ideas on where they can take it to become more engrained in everyday real life, but I don't think society is ready for what I have in mind yet...

</comment><comment><USER31> Instagram, It's Like Facebook for your iPhone. Really now, is it that hard to provide Android support?

This is 2012. Whats the excuse?</comment>


Asking Interviewer About Family - <AUTHOR>

I know it is poor form and bordering on illegal for the interviewer to ask the interviewee about family situations(wife, kids, etc.)  What about the reverse direction?  It is poor form/unethical for the interviewee to ask the interviewer about their family, specifically if the interviewer is going to be the interviewee's supervisor?  I am married and have three young children and have had bad experiences with supervisors who have not had children.
Specifically, all things being equal I would rather work for somebody who understands that I don't want to support late afternoon meetings on certain days because kids have soccer practice and that sometimes I will just want to take a day off and spend it with the kids.  I find people who have had children at some point to be more understanding.
Any thoughts? <comment><USER2> The problem I see is that sometimes the person who interviews you is not going to be your direct boss. Meaning the interviewer is irrelevant. If you are sure this is your direct boss I believe asking these questions is valid.

</comment><comment><USER3> I wouldn't ask those questions point-blank, but if you are reasonably personable and chatty, it's usually pretty easy to lead the conversation in that direction.</comment>


As Many as 5K .Com's Taken Away by Sealed Court Order by Verisign - <AUTHOR> http://www.thedomains.com/2014/10/02/as-many-as-5k-coms-taken-away-by-sealed-court-order-by-verisign-including-some-of-mine/ <comment><USER2> Everything to do with the DNS system is so corrupt and shady. Half the domains dropping in the new GTLD process are "unavailable", "registered", etc. We tried to get an _exact_ trademark for one of our companies in the new GTLD system during the Sunrise phase only to be told by Gandi that the new GTLD owner rejected it. We pushed it pretty hard and had a back and forth with Gandi's CEO who was pretty much on our side but the new GTLD owner (Demand Media) wouldn't budge. We have to sue them if we want it. That's what the privatized DNS system has come to.

You know who I feel bad for though? Those people who originally registered big corporate brands .COM in the 90s and had their domains ripped from them. That shit is ICANN endorsed nowadays.

<comment><USER3> Is there any law or ICANN rule saying you're owed the domain with the same characters as your trademark in every possible GTLD? I don't understand what the outrage is about. It's not even like you have an exclusive claim on that particular string (multiple companies can have the same mark, eg across industries, countries, etc).

<comment><USER4> His point is he had a strong claim to the name, as strong or stronger than anyone elses, and he was willing to pay the Sunrise premium to get it... and still couldn't.

<comment><USER3> Yes. So what?

<comment><USER5> I particularly like this argument. It's so full of meaning.

<comment><USER3> It's not an argument. It's a request for one. What's the argument for condemning the GTLD holder just because he doesn't want to sell a particular domain?

<comment><USER2> The argument is that there's only one Sunrise phase. If Demand Media decide to sell it later to say a competitor of mine, I'm out of luck now aren't I? What's the point then of even having a Sunrise phase? It's just smoke and mirrors.

<comment><USER6> >>If Demand Media decide to sell it later to say a competitor of mine, I'm out of luck now aren't I?

That depends - are they really a competitor in the same industry, and their use of your trademark leads to confusion in the marketplace? Because then you're not out of luck at all, you have a trademark case.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER7> Scenario:

A domain is free to register. You register it as per your registrars normal procedure. In some faraway country (say the USA) a bankruptcy court decided that this domain that you just registered was part of the original holdings of the company in bankruptcy.

Even though the company (or the receivers) let the registration lapse (presumably because they were not doing too well financially).

And so the court will order that domain that you just paid for to be assigned to some third party.

That's pretty perverted.

If there was an unbroken chain of ownership from the moment the original company registered it to the point where the domain was levied during the bankruptcy proceedings I can see the logic of it, but _once the company and /or the receivers let the domain lapse_ they technically forfeited it and a judge should not cooperate with them to reverse agreements between two other consenting parties (you and the registrar) in order to re-assign that domain to the pile of assets in the bankruptcy, especially not 'ex parte' (so without hearing either you or the registrar as to how you came into possession of that domain).

Otherwise from now on there is no such thing as a 'lapsed domain' any more. And in fact, domains would not longer be 'property'. (I don't think they're property to begin with and this case is a nice example of why I think they aren't even though everybody treats them as such.)

<comment><USER8> U.S. bankruptcy law gives courts great latitude to reverse transactions involving the property of a bankrupt entity, because a lot of abuse of the bankruptcy system is possible otherwise.

The problem here is actually with VeriSign. Any time you transfer an asset to an entity but retain the right to get it back under certain conditions, you have to think through what will happen if that other party enters into bankruptcy and those assets get sucked into the proceeding. It's wrong for them to assume they can resell the domain name the second it lapses.

</comment></comment><comment><USER9> Interesting reading the comments, seems DreamTeamFinancial.com went bankrupt and the domains were seized as part of the assets, even though some (many?) had been transferred elsewhere. I would guess you could get an injunction forbidding the domain seller who was liquidating the names from selling them until ownership was more closely established but it does seem like there is an education gap on domains that are "owned" by a company who then doesn't pay to renew them so they simply 'lose' ownership rather than selling them.

</comment><comment><USER10> I'll be following this case. I don't understand why this would be filed under seal. I'd enjoy some legal experts comments on the matter.

<comment><USER11> It's really difficult for anyone to speculate on a sealed court order.

Probably a deal gone bad and the person convinced a judge that if it went through normal channels the persons owning the domains would liquidate them. That or the transfer was deemed illegal in the first place.

A quick google for Robert Olea reveals he is a domain broker.

<comment><USER12> I know Bob personally, and he is a domain broker. I believe he is just the one holding these domains until the last sauce can be resolved.

</comment></comment></comment><comment><USER13> This reminds me a lot of the no-ip.com case. Did anyone ever find out how that was resolved? Apparently Microsoft gave back the domains[1], but did they face any payments for damages or censure?

[1] [http://www.noip.com/blog/2014/07/10/microsoft-takedown- detai...](http://www.noip.com/blog/2014/07/10/microsoft-takedown-details- updates/)

<comment><USER10> Out of court settlement. Microsoft and No-ip both issued press releases/updates to their original blog posts about it.

No details about the settlement were released but No-IP certainly got paid.

<comment><USER14> Details are obviously not public, but noip did not receive any money as a result. Regardless of popular opinion on the matter, Microsoft managed to get a lot of harmful malware shut down.

<comment><USER15> and the ends justify the means right?

Who care how many innocent people are victimized in the process, as long as Microsoft can get some good PR it is all A-OK

I bet Microsoft could shutdown all kinds of malware if we all just allow them to continually monitor all of our computers at all times....

</comment></comment></comment></comment><comment><USER16> Another incident that tells us we need to move towards something more decentralized. Namecoin is an excellent concept and idea, it's a pity it is not used and supported more widely.

<comment><USER14> What if the 5,000 domains were seized and shut down to prevent a massive worm that had compromised millions of computers and would result in massive theft against millions of consumers?

In the vast majority of cases law enforcement and court actions against domains are justifiable and benefit the internet.

<comment><USER17> In that case why would it be a sealed court order? Also if sealed court orders are involved and we assume we don't know about all of them, how can you possibly make claims regarding "the vast majority"?

<comment><USER14> Personally being involved in a lot of domain takedowns.

</comment></comment></comment></comment><comment><USER18> That's a very interesting website. It also features for example analysis of companies and what domains they did/should buy. It really shows how there is really an entire economy over domain names, not just in buying/selling but also other secondary fields like regulation.

</comment><comment><USER19> That situation is just about as maddening as that site's scroll behaviour.

</comment><comment><USER20> While this is obviously a perversion of justice, I'm not shedding many tears over shady domain landgrabbers losing their 'property'. It's unfortunate (and clearly shouldn't have been filed under seal) but the histrionic comments on anigbrowl's link about how this is going to kill the domain squatting 'business' just make me think "good."

<comment><USER21> Given that we don't even know why they were seized (or how many were seized by each person), it seems like you have an amazing hostility towards domainers in general.

What makes you so mad towards them?

<comment><USER22> Imagine a shopping mall car park where it costs $0.20 a day to park. Except you can't park anywhere near the door, because people turn up at the start of the day, park their cars across three prime spaces, and offer to sell them - for $20.

You'd have to be a big fan of the coase theorem to enjoy paying $20 for a $0.20 parking space, when the only thing the seller has done to add value is get in your way.

<comment><USER21> Or - if you simply look at it as real estate - they bought that land when the supermarket was being built (and no one else thought it was valuable).

In this space - it's akin much more to having parking spaces near a sporting event or concert. In which case - there's lot of happy people willing to pay $20 for the privilege of parking.

Also - you should know that pricing goods based on "what they cost" isn't the proper way to valuate a property, service, etc. If that was the case, every user past 1,000 in most SAAS apps should just ask for their subscription to be free.

<comment><USER23> No, the mall bought the land and made the parking spaces. They are merely squatting on parking spaces that other people created. And the reason those parking spaces were created was to enable actual, productive business to take place, not to feed parasites.

<comment><USER21> Technically - the land was free. You're looking more at a hypothetical that's similar to settling new land.

Also - calm down. There are businesses that are way worse than domainers.

<comment><USER23> Ah, the "I'm not the _biggest_ scumbag in the world so it's fine" argument.

That might be a reason for you to not do something even worse. But it doesn't make you less of a parasite.

</comment></comment></comment></comment></comment></comment></comment><comment><USER24> Well that can't be good - my "name" on the web can be snatched out from under my feet?

<comment><USER7> There are now several 'known' ways in which this can happen, all of them seem to involve a US court at some point in time so if you're running a legitimate business on a .com and you acquired the domain as first registrant from a registrar.

If you acquired that domain through the 'aftermarket', especially if it had lapsed we now know that if that entity should ever go bankrupt there is a potential problem.

And even in that case I assume you could object against this in some way (though the story does not detail any of that so far, we'll have to wait to see how it all plays out).

I'll be following this quite closely, to say that I'm surprised here is an understatement.

There is even potential for a chain of bankruptcies causing repeated clawback of the same domain!

<comment><USER25> Would it be possible to transfer the name initially to a front company, resell it on to the intended company with a clause that says it cannot be clawed back and then bankrupt the first so creating a legal firewall?

</comment></comment></comment><comment><USER26> I wonder, is David J. Steele the John Steele of Prenda Law or is this just a weird coincidence?

<comment><USER27> Just a coincidence.

</comment></comment><comment><USER28> Better to submit the original article, per HN guidelines. There's a lot of useful info in the comments: [http://www.thedomains.com/2014/10/02/as-many- as-5k-coms-take...](http://www.thedomains.com/2014/10/02/as-many-as-5k-coms- taken-away-by-sealed-court-order-by-verisign-including-some-of-mine/)

<comment><USER10> Yes the comments of the original blog post have been really interesting to read.

The domain name community looks to be all over the comment section of the original post.</comment></comment>


OsTestBackdoorATI symbol found in AMD-catalyst 13.12 - <AUTHOR> http://pastebin.com/mc3Xg694

<comment><USER2> The dump is incomplete. It is a switch case and the cases do not appear in the dump... The debugging function called only return 0. This is obviously some debug to trap memory corruption for objects shared with the device hardware.

</comment><comment><USER3> I also have 'backdoor' symbols in my proprietary code. It is a means to bypass certain functionality in a test environment. The test symbols do not get excluded in the production build due to laziness.

</comment><comment><USER4> If you care enough to look, you should be using open source, not binary blobs. The current state of graphics on Linux are nothing less than a travesty to the Open Source movement, as many new users are pushed to the blobs.

The ATI open source drivers are pretty good, the NVidia's were not so good last I checked, and everything else is a crapshoot for even correct modesetting.

<comment><USER5> > _" The ATI open source drivers are pretty good"_

For 2D yes, but for newer models OpenGL is incompletely implemented and the performance is worse than on an integrated Intel chipset. Unfortunately, AMD's Catalyst blob is oftentimes buggy, or doesn't support the latest X.org and is generally a nightmare to configure when not using a completely standard setup. Nvidia's blob at least works mostly flawless while the open source Nouveau driver is far behind in terms of completeness and performance.

All in all, there is no way around the proprietary drivers at the moment if you want to use the full capabilities of your hardware under Linux. That has been the situation for years and it seems unlikely to change anytime soon.

</comment></comment><comment><USER6> People need to calm down. There is no reason to believe this is malicious.

</comment><comment><USER7> If this were indeed malicious, I doubt they'd be dumb enough to give the symbol a name with backdoor in it.

But maybe they're doing some clever reverse psychology

</comment><comment><AUTHOR> Source: [https://twitter.com/hashcat/status/422665130002747392](https://twitter.com/hashcat/status/422665130002747392)</comment>


Ask HN: Does anybody have this annotated music dataset? - <AUTHOR> Hi there HN, you're my 'means of last resort', or so I hope. I'm working on a music project and would very much like to get my hands on a particular dataset because it is used in many papers reporting other people's results. Unfortunately the download facility doesn't work (it's password protected, I've signed up but then it will not allow me to log in).
The email addresses associated with the project all bounce.
http://www.tsi.telecom-paristech.fr/aao/en/2010/07/08/maps-database-a-piano-database-for-multipitch-estimation-and-automatic-transcription-of-music/
Is the download page.
Does anybody have this dataset, have another pointer to where I could find it or is there someone who is in contact with one of the authors?
Thank you very much for any help you can provide.
best,
Jacques <comment><USER2> This seems to be the personal website of the author of the set: [https://pageperso.lis-lab.fr/~valentin.emiya/wp/](https://pageperso.lis- lab.fr/~valentin.emiya/wp/)

There is another mail address mentioned; you could try to reach him there.</comment>


Adoption of Cloud computing and Blockchain in a financial organization - <AUTHOR> A combination of Cloud and Blockchain will potentially transform the current paper-based trade finance approach for the processing and management of trade transactions into a more inclusive digital and efficient platform.<p>Adoption of Cloud computing by a financial organization will represent a major change to its existing technology management, resource, and policies. <comment><AUTHOR> You can download the whitepaper on this topic for free here: [http://tinyurl.com/cloud-nd-blockchain-in-finance](http://tinyurl.com/cloud- nd-blockchain-in-finance)</comment>


Ask HN: YC vs TechStars - <AUTHOR>

I couldn't help but notice that the TechStars/Boston deadline is approaching (Jan 11). TS looks and sounds a lot like YC, but I'm wondering how it compares. As far as I can tell it looks like a wonderful alternative for east coast residents.<p>Has anyone had an experience with TechStars? Is anyone in the position to compare the two? <comment><USER2> I think this community might be a little biased, just a little.

<comment><USER3> I think the amount of people not in either program far outweighs the number actually connected with either. And founders who have gotten into both regularly post here, although I think there are more YC people. So I don't think it's actually quite so biased.

</comment></comment><comment><USER4> The alum network of other founders is helpful for technical expertise, startup advice, introductions, morale boosts, and idea exchanges; so consider in your decision the number of alums and where they ultimately reside.

In YC's case, there are 9 sessions of alums and a big handful who stay in the Bay Area (even when the sessions were in Cambridge).

Maybe some of the other programs form strong alum powerhouses in Boulder, DC, Philadelphia, Boston, or Seattle.

</comment><comment><USER5> I think both are equally difficult to get into. I think that TS does not impose as many ideas from above as YC. The YC companies all seem to have very similar names and designs when they first publicly announce, while the TS companies seem more diverse.

A good technical team with poor marketing and biz skills should go to YC, and good biz people should go to TS.

<comment><USER4> YC definitely does not dictate company / domain / product names "from above."

There is not much mandating or micromanagement at all, or else it would feel more like an incubator.

<comment><USER5> Why do all the names seem so similar, and a lot of the designs follow similar philosophies?

<comment><USER6> A lot of YC companies have trendy names and designs, but the phenomenon is in no way limited to YC. You see that all over the valley.

</comment></comment></comment></comment><comment><USER7> I work at TS and have a lot of friends that have been through YC. You can debate about this a lot but at the end of the day both can be fantastic for your team. There is a style to the Valley, Boulder, Boston and Seattle that will be better depending on your company and team. All have their strengths.

I'm jumping on a flight, wish I could expand. We have a ton of respect for YC.

</comment><comment><USER8> To me YC is more of a first stringer compared to Techstars. They've proven their stuff. They've had plenty of exits. You know they can get stuff done.

Take techcrunch for example, a ton of YC startups get their own stories. Meanwhile Techstars just gets a single big "here are some techstar companies" with a list of their top 5 companies.

Given the choice, go for YC.

Think of Techstars as your safety school. It's a great school, but deep down you know that the only reason you are going there is because you got rejected by the school of your dreams.

<comment><USER9> I love YC, but this is false.

TechStars, actually, has a better track record of exits when compared to YC. YC has some bigger companies that are still growing, but the TechStars scorecard right now is looking pretty good.

<comment><USER10> Are you going by percentage of companies to exit? What data are you using?</comment></comment></comment>


Announcing Rust 1.27 - <AUTHOR> https://blog.rust-lang.org/2018/06/21/Rust-1.27.html <comment><USER2> SIMD on stable is very exciting news. SIMD unlocks the power of the GPU-esque parallelism that is already inside your CPU. While compilers do try very hard to take advantage of this automatically, it's not always predictable and can make performance fragile. This is what people are talking about when they refer to "low level control". Don't expect that with Rust 1.27 you'll need to understand SIMD to get anything done. Do expect various libraries to just get faster on stable. For example, BurntSushi, the author of the regex crate and the ripgrep tool, has already enabled it if you're on Rust 1.27 Stable. [1]

SIMD is another notch towards never needing to use nightly Rust. What this really looks like in practice is that less frequently will a user encounter a fast-mode and a slow-mode for a crate depending on whether they're using nightly, with all the unstable features enabled, or not.

[1] [https://github.com/rust-lang/regex/pull/490](https://github.com/rust- lang/regex/pull/490)

<comment><USER3> How useful is SIMD on CPU these days given that most of the touted original applications (back in the MMX SSE days) have been moved over to GPUs?

<comment><USER4> Still really useful. We use NEON on Android all the time since there's not a great API there and spinning up a GPU on a mobile device is not something you want to do unless you absolutely have to.

<comment><USER5> I don't want to worry you, but on a mobile device with a screen the GPU is always spinning. That is where the pixels come from after all.

I get your point that there are energy efficiency tradeoffs to consider. However for massively data parallel tasks like image operations, 3d graphics, machine learning, vision etc, I haven't seen SIMD implementation come close to GPU compute in terms of efficiency. Perhaps short lived text pressing and file compression where data access is more random could benefit from SIMD.

<comment><USER4> Nope, I'm well aware. Built/worked on two android based 3D graphics stacks at two different companies and I've worked directly with just about every mobile GPU vendor aside from PowerVR(which is pretty similar to all the other tiled GPUs that are out there).

Your GPU is actually running much less than you'd expect. Unless pixels are changing there's a 95% chance that everything on the system is sleeping and just the display controller is being kept spun up. Battery requirements mean that DVCS on any mobile chipset is going to be really aggressive.

Either way GPU compute has a pretty large overhead both in terms of latency and scheduling. Earlier GPUs didn't schedule nice(hello waiting 16.6ms for your next compute request) and generally the type of places where you use SIMD(3D transforms, audio processing, etc) are so tightly coupled with other CPU operations that even the act of moving them to the SIMD registers is something you need to consider before diving into it. A lot of times waiting for some work queue to complete(or adding pipeline latency by waiting for next frame) just isn't feasible.

</comment></comment></comment></comment></comment><comment><USER2> The new syntax for dynamically-dispatched traits, "dyn Trait", is an example of Rust's persistently excellent consideration of what should be explicit and what should be implicit. Python's mantra of "explicit is better than Implicit" mostly captures my general feeling, but you can't make everything explicit. Back before impl Trait existed, just Box<Trait> seemed very clear. Now that there's an important thing to differentiate it from, it seems better to have dyn Trait and impl Trait both prefixed with keywords.

It also makes for _much_ easier googling. ;)

<comment><USER6> > Rust's trait object syntax is one that we ultimately regret.

Would someone please explain the problem (and the solution) for someone who doesn't know Rust yet?

<comment><USER7> A trait is like an interface. A struct implementing a trait means it takes on the methods of that interface (but there's more to it, because a trait can have default implementations of of the trait methods).

If you want to express something like "this is a variable that holds something that fulfils this trait", without knowing the _actual_ type it is, that variable effectively has an unknown runtime size. std::io::Read is an interface for reading bytes of some source, like a file or a socket.

This matters because we're talking about a stack frame. So the size needs to be known at compile time.

        let a: u64 = 42; // ok, because well known size.

        let b: Read = ...; // illegal, because unknown size.

A "trait object" places the object on the heap and has a pointer in its place.

        let b: Box<Read> = ... // legal, because pointer is a known size

However it's a bit more complicated, because this syntax allows for dynamic dispatch at runtime using a vtable. So there's a quite big difference between Box<u64> (a 64 bit unsigned integer on the heap) vs Box<Read> (a runtime dispatched lookup via a vtable).

This difference is not obvious at a glance though. Hence the new syntax: Box<dyn Read>.

(I think I got that right)

<comment><AUTHOR> You did, except that it's not one pointer, it's two. This is one way that rust is different than C++; the vtable isn't stored with the data, but separately, with the "trait object" itself being two pointers to the two things.

<comment><USER8> >This is one way that rust is different than C++; the vtable isn't stored with the data

Which "data" is the vtable stored with in C++? An object contains only a pointer to its vtable, not the vtable itself...

<comment><USER9> A C++ object with virtual methods and some members looks like this, if you put it in terms of C:

      struct ClassVTable {
       void (*firstMethod)();
       void (*secondMethod)();
      }

      struct Class {
       struct ClassVTable *virt;
       int firstMember;
       int secondMember;
      };

and a pointer to it looks like:

      struct Class *objectRef;

A language that uses fat pointers, like rust, has this separated completely:

      struct Class {
       int firstMember;
       int secondMember;
      };

      struct FatPointerToClass {
       struct ClassVTable *virt;
       struct Class *data;
      }

      FatPointerToClass objectRef; // note lack of pointer, it'd be stored on the stack directly for eg.

This means a much simpler object layout in exchange for passing around larger pointers, and it's a good fit for trait-based typing since it doesn't require you to know all possible interface subtypes of the object in order to describe or use its layout.

(please note that I'm using C struct to be precise about the concept, and this should not be taken as a perfectly verbatim description of the actual object layouts in memory)

<comment><USER10> Oh, I didn't know that: this is also great for serializing code where you might have an array of `Class`, it would still be a POD-type to use C++ language.

</comment></comment></comment></comment></comment></comment></comment><comment><USER11> Yes!! I have been waiting for the new time helpers to arrive in stable. It may be a small thing but is so much nicer and makes Rust feel more like a higher level language when I can do `some_time.subsec_millis()` rather than `some_time.subsec_nanos() / 1_000_000`.

<comment><USER12> I don't understand your comment. It feels like a higher level language because you can use a different unit for measuring time?

<comment><USER13> Having written enough of boilerplate to do millisecond timestamps, or including a quite big chrono library for a nicer interface for a few time operations, these additions are quite luxurious.

</comment></comment></comment><comment><USER14> SIMD! For anyone curious about the performance impact of this feature and a real-world implementation, check out the PR adding support to the regex library: [https://github.com/rust- lang/regex/pull/456](https://github.com/rust-lang/regex/pull/456)

<comment><USER15> And just because this kind of thing is fun, if you use the right kind of pattern on a big enough file, SIMD can be quite noticeable:

        $ rg-with-simd --version
        ripgrep 0.8.1 (rev 223d7d9846)
        +SIMD +AVX
        $ rg-without-simd --version
        ripgrep 0.8.1
        -SIMD -AVX

        $ time cat OpenSubtitles2016.raw.en > /dev/null
        real    0m1.280s
        user    0m0.020s
        sys     0m1.257s
        $ time wc -l OpenSubtitles2016.raw.en
        336602465 OpenSubtitles2016.raw.en
        real    0m4.303s
        user    0m3.132s
        sys     0m1.167s
        $ time rg-with-simd -c 'Sherlock Holmes|John Watson|Professor Moriarty' OpenSubtitles2016.raw.en
        6033
        real    0m2.099s
        user    0m1.750s
        sys     0m0.347s
        $ time rg-without-simd -c 'Sherlock Holmes|John Watson|Professor Moriarty' OpenSubtitles2016.raw.en
        6033
        real    0m4.128s
        user    0m3.781s
        sys     0m0.343s
        $ time rg-with-simd -c 'Sherlock Holmes|John Watson|Irene Adler|Inspector Lestrade|Professor Moriarty' OpenSubtitles2016.raw.en
        6731
        real    0m1.989s
        user    0m1.621s
        sys     0m0.366s
        $ time rg-without-simd -c 'Sherlock Holmes|John Watson|Irene Adler|Inspector Lestrade|Professor Moriarty' OpenSubtitles2016.raw.en
        6731
        real    0m18.417s
        user    0m18.000s
        sys     0m0.403s

Looks like `cat` is still faster, so there's some room for improvement. ;-) With a single pattern, we're almost there:

        $ time rg -c 'Sherlock Holmes' OpenSubtitles2016.raw.en
        5107
        real    0m1.333s
        user    0m0.974s
        sys     0m0.357s

This one is mostly thanks to glibc's memchr implementation (which uses SIMD of course), and the regex crate's frequency based searcher.

Of course, I'm presenting best cases here. Plenty of inputs can make ripgrep run quite a bit more slowly than what's shown here!

The crazy thing is that we're still only barely scratching the surface. Check out Intel's Hyperscan project for some truly next level SIMD use in regex searching!

<comment><USER4> Uf da, that's still some good speedups.

BTW as a happy daily user of rg thanks for all the work you put into it, definitely shows.

</comment></comment></comment><comment><USER16> Anyone happen to know when inline asm will hit stable?

<comment><USER17> There are a _lot_ of inline-asm related bugs in the compiler. I'm hitting them almost daily (I'm writing a kernel, so a fair bit of asm is going on here). You can see them in the bug tracker[0].

Stabilizing inline asm in its current form would be a mistake. It's simply not ready.

[0]: [https://github.com/rust- lang/rust/issues?q=is%3Aopen+is%3Ais...](https://github.com/rust- lang/rust/issues?q=is%3Aopen+is%3Aissue+label%3AA-inline-assembly)

<comment><USER16> "not ready, bugs." Is a perfectly good reason to hold it back. Thanks.

</comment></comment></comment><comment><USER18> Any idea what SIMD in Rust via WebAssembly will look like?

<comment><AUTHOR> Wasm doesn't support SIMD yet, so no way to tell.

<comment><USER18> Thanks, wasn't able to easily discern how far along the browser SIMD wasm implementations were.

Do you see a future where wasm has its own std::arch module?

<comment><AUTHOR> Yeah, SIMD is on the wasm roadmap; we'll see what form that takes for exact details, but that's what I'd expect.</comment></comment></comment></comment>


Php.net is down. - <AUTHOR> http://php.net

<comment><USER2> php.net goes down relatively frequently for such an important site, it's nothing new. It's back up now. If you want to see it stay up more consider donating to the project.</comment>


Ask HN: Where are the unit-typed languages? - <AUTHOR> Are there any programming languages that treat, say, numbers like adjectives, as human languages do, and have units typing?<p>Instead of an integer being a standalone noun, "5", it would be "5 apples", or "5 meters/second".  Multiplying a variable of 3 meters/second by a variable of 2 minutes could give a result of 180 meters, and adding nautical miles to dollars would give an exception.  I've played around with this idea a little bit in objects, but it seems like a language with such features built in  or an object library should already exist somewhere. <comment><USER2> You can do this sort of thing with Ada's type system. There is also a blog post about units of measure in F# [https://blogs.msdn.microsoft.com/andrewkennedy/2008/08/29/un...](https://blogs.msdn.microsoft.com/andrewkennedy/2008/08/29/units- of-measure-in-f-part-one-introducing-units/)

It's a pretty niche topic. You can do this in a language like c++ or even python but unit aware calculations aren't a requirement for a lot of systems.

</comment><comment><USER3> Have you seen [https://frinklang.org/](https://frinklang.org/) ? I think that's supposed to be its Big Idea.</comment>


Ask HN: Why so many negative news about Zoom on HN recently? - <AUTHOR> Seeing an uptick of negative news about Zoom in HN. Any specific reason? <comment><USER2> Probably because of the fact that everyone and their mother are now using Zoom. The options are pretty bleak if you need 5+ user video conferencing and a tool that's usable cross platform with minimal fuss and either free or very minimal pricing plans... I think you have maybe Google Hangouts/Meet/whatever it's called now, BlueJeans, and maybe a few other more proprietary options. Don't know if people are using Skype much these days.

Anyways, since it's become wildly more popular, I think more people are digging into what it's actually doing (probably similar to what most other not-self-hosted video conferencing tools are doing) and finding that there's a lot of privacy-violating actions.

Some of these issues bubble up from time to time, but now that Zoom is one of the few companies in the limelight as everyone goes WFH and school from home...

</comment><comment><USER3> There are organic incentives for these stories to appear and to get a lot of attention on HN right now.

Please see [https://news.ycombinator.com/item?id=22751116](https://news.ycombinator.com/item?id=22751116).

</comment><comment><USER4> Zoom has a metric ton of security and privacy problems, but not many people have looked that deeply into them.

Now that they're getting a lot more press, more and more people are looking into the problems — and not liking what they see.

</comment><comment><USER5> competition

</comment><comment><USER6> jealousy</comment>


The Trouble with Silicon Valley - <AUTHOR> https://www.theatlantic.com/magazine/archive/2020/01/wheres-my-flying-car/603025/ <comment><USER2> same story, [https://news.ycombinator.com/item?id=21818999](https://news.ycombinator.com/item?id=21818999)</comment>


Ask HN: Would you accept me as a mentee at your side-project? - <AUTHOR> I am learning to code with the intention to become a software developer. Specifically a web developer, probably starting as a front-end web developer.
What I want?
A mentor who is an experienced web developer with a side-project that I can help with.
Why a mentor?
I think the best way to accelerate my learning. I am learning through freeCodeCamp mostly and although I'm happy with my progress, I feel I am lacking any training on a few essential skills to properly perform at a job, namely: working in a team, practical collaboration through git/github,  feedback on comments, how to create code that fits well with code from other people on a bigger project, how to read and understand other people's code.
Why a side-project?
I know a mentor could just give guidance, but to dig deeper in the semantics here I want a mentor that also is a coach that also is a boss. As mentioned above I also would like to have hands-on experience with a real life project. And, by my understanding, this project being a side-project means more room for experimentation (like experimenting having a mentee helping out), less pressure for results (as in $ results), fewer people involved in any decision process (from having a mentee to deciding what task to pass to the mentee).
Why me?
I think I can genuinely help. I believe I am smart and I am working hard to learn everything I need to be effective. Currently, that just englobes HTML+CSS+JS. You can learn more about my code checking my freeCodeCamp history (https://www.freecodecamp.com/deltasoneca). I also have some experience as a generalist digital marketer. You can read about that at my LinkedIn (https://br.linkedin.com/in/rodrigohgpontes). So I can help with good input on your marketing/growth strategy and help with execution.
But at the end, you have to primordially want to be a mentor. To teach, guide and manage a junior developer. I expect no payment, but I do expect patience. <comment><USER2> Hey, I admire your hustle. I'm not sure if I can offer you exactly what you're looking for, but feel free to submit a pull request to any of the Standard Notes projects[1]. The code is pretty simple so it might be a good way to learn. Even if your code is initially bad, you'll learn just as well from rejected pull requests :)

[1] [https://github.com/standardnotes](https://github.com/standardnotes)

<comment><AUTHOR> Maybe it is unfounded, but I was (am) afraid of pulling requests to open source projects. I read all the time how time-consuming is for the developers, so to send poorly coded requests as a junior developer seems kind of abusive to me. Someone will "waste time" reading my request to reject it.

But since you opened that door, I will take a better look and take my chances. Thanks!

<comment><USER3> > Someone will "waste time" reading my request to reject it.

Patches don't usually get "rejected", unless it is for a political reason (we don't want that feature...). Usually the "code review" process involves the maintainer telling the patch submitter what to fix. That's my experience at least (from both sides of the table). Even experienced devs take a few feedback cycles to get the patch right in many projects.

</comment></comment></comment><comment><USER4> Freeciv-web is always looking for contributors. [https://github.com/freeciv/freeciv-web](https://github.com/freeciv/freeciv- web)</comment>


The Quadrupedal Conjecture - <AUTHOR> https://keplerlounge.com/2016/09/15/the-quadrupedal-conjecture/ <comment><AUTHOR> If the mass of a cheetah were kept constant, would its maximum velocity be diminished if more pairs of legs were added?</comment>