Man jailed indefinitely for refusing to decrypt hard drives loses appeal - <AUTHOR> https://arstechnica.com/tech-policy/2017/03/man-jailed-indefinitely-for-refusing-to-decrypt-hard-drives-loses-appeal/ <comment><USER2> This reads as extremely bizarre. I mean, reading the fifth amendment makes it pretty clear - no one should be compelled to witness against oneself. However, it looks like the current executive and judicial are thinking "well, those Founders were just idiots for putting such an amendment in, clearly it'd be much easier to prosecute people if we could compel them to witness against themselves, so why don't we just ignore it and put people in jail indefinitely until they agree to witness against themselves?". Terrifying that it is so easy for them to completely ignore all constitutional protections.

<comment><USER3> Your interpretation of the 5th amendment is quite different than it has been historically interpreted by the courts.

For example, in a trial, the prosecutor might subpoena some documents and you cannot refuse to turn over those documents, unless doing so would trigger a 5th amendment assertion. Turning over the documents implicitly testifies to at least two important pieces of information: that the documents exist and that you know about the documents.

So if you're asked for the documents and the prosecution has no evidence that the documents exist or that you know about them, the 5th will cover you.

However if during a police interrogation you admit that the documents exist, when they are subpoenaed, you can't withhold evidence.

I imagine that the 5th will work much the same with passwords. If it is known that you have the ability to unlock the device, refusing to do so will be withholding evidence.

However if revealing the password implicitly reveals the hitherto unknown information that you know the password, 5th will work.

<comment><USER4> So here's my concern: guy's now been in jail without charge for 18 months. The prosecutors say his guilt is a foregone conclusion, but apparently it's not foregone enough that they're willing to go ahead and prosecute without the contents of his hard drive. They're gonna hold off until they get what they need.

We're starting to get to the edge of the point where this guy might legitimately forget his password. I think we can assume the FBI has been running a common passwords/dictionary attack with common password symbol substitutions for the last 18 months, and apparently they haven't found the answer, so this password is probably a pretty good one that's not based on a word or even a sentence.

If he stays in jail without trial for another two years and then says "I can't remember my password any more", what should we do?

<comment><USER5> > what should we do?

Release him and pay millions in compensation for violating his writ of Habeas corpus.

<comment><USER6> A court granted him a writ of habeas corpus? When? That changes everything if true, but I'm pretty sure you're mistaken.

</comment></comment></comment></comment></comment><comment><USER7> Some discussion overlooks that this is a special case:

 _... the appeals court, like the police, agreed that the presence of child porn on his drives was a "foregone conclusion." The Fifth Amendment, at its most basic level, protects suspects from being forced to disclose incriminating evidence. In this instance, however, the authorities said they already know there's child porn on the drives, so Rawls' constitutional rights aren't compromised.

The Philadelphia-based appeals court ruled:_

Forensic examination also disclosed that Doe [Rawls] had downloaded thousands of files known by their "hash" values to be child pornography. The files, however, were not on the Mac Pro, but instead had been stored on the encrypted external hard drives. Accordingly, the files themselves could not be accessed.

 _The court also noted that the authorities "found [on the Mac Book Pro] one image depicting a pubescent girl in a sexually suggestive position and logs that suggested the user had visited groups with titles common in child exploitation." They also said the man's sister had "reported" that her brother showed him hundreds of pictures and videos of child pornography. All of this, according to the appeals court, meant that the lower court lawfully ordered Rawls to unlock the drives._

<comment><USER7> And for ease of reading, I'll reply to my own comment with other interesting issues:

* _" The fact remains that the government has not brought charges," [his attorney] Donoghue said in a telephone interview_. It seems a warrant is at issue, if I understand correctly.

* _The contempt-of-court order against Rawls was obtained by authorities citing the 1789 All Writs Act. The All Writs Act was the same law the Justice Department asserted in its legal battle with Apple_

* _The authorities, however, said no testimony was needed from Rawls. Rather, they said, (PDF) "he can keep his passwords to himself" and "produce his computer and hard drives in an unencrypted state."_

* My completely amateur thoughts: If they already can prove he has child porn, then they don't need the additional evidence. If they do need the additional evidence, then he is incriminating himself.

<comment><USER8> "My completely amateur thoughts: If they already can prove he has child porn, then they don't need the additional evidence. If they do need the additional evidence, then he is incriminating himself."

That's a good point. They either have proof he downloaded child porn or they don't. They're definitely trying to do more than prove it. Probably set a precedent increasing their power as usual.

<comment><USER9> "so you, Mr expert witness, are telling me that hashes collide? What's that you say, there are actually people who actively look for and produce such hashes for fun?? Ladies and gentlemen of the jury..."

And so on. I'm pretty sure pedophile is near the top of the "you better make damn sure they don't get off" list.

<comment><USER10> >I'm pretty sure pedophile is near the top of the "you better make damn sure they don't get off" list.

It's not illegal to be a pedophile. It's illegal to possess child pornography.

</comment></comment></comment></comment></comment><comment><USER11> Sitting directly in front of me are two moderately large encrypted hard drives the passwords for which I forgot. If I get a subpoena to produce their contents, I will potentially remain in jail of the rest of my life for the crime of being forgetful.

That judge's behavior and (the laws that enables it) is sickening. You either have enough evidence to convict a person, or you don't.

<comment><USER12> The Court's opinion explicitly addresses that (at 18-19). It first recognizes that impossibility of compliance is a defense to a contempt charge. But it then explains why the trial judge reasonably did not buy that argument:

> At the contempt hearing, the Government presented several witnesses to > support its prima facie case of contempt. Doe's sister testified to the fact > that, while in her presence, Doe accessed child pornography files on his Mac > Pro computer by means of entering passwords from memory. Further, a > detective who executed the original search warrant stated that Doe did not > provide his password at the time because he wanted to prevent the police > from accessing his computer. Doe never asserted an inability to remember the > passwords at that time.

<comment><USER13> 18 months later, though, it is completely plausible that he really has forgot. I don't think I would remember a complex password that I haven't used for 18 months. Hell, I sometimes have to reset simple passwords that I created last month. If you don't use knowledge, you forget it.

<comment><USER14> Perhaps, but the judge can only make judgements based on the arguments presented.

If the defendant wanted to argue that he no longer remembered the password (but would be willing to decrypt the drive if he could), then that's something that the judge would consider. But a judge can't (and won't) simply say "Oh, maybe he hasn't complied because he just forgot the password. I'm going to let him off"

<comment><USER15> Its literally impossible to prove someone has or hasn't forgotten something. You shouldn't be able to jail someone indefinitely for not producing something you can't prove exists.

<comment><USER14> Yes, but that's fairly well tested ground and isn't unique to this case.

Witnesses (in the sense of being called to that stand in a courtroom) are frequently asked to tell the court what they saw/heard/did, or from where/whom they received information. Refusing to answer may get them pulled up on contempt charges, and if they claim not to remember then the judge needs to decide whether they are lying.

Given the impossibility of proving (in an absolute sense) that the witness does in fact remember (at that exact moment), it's a game that witnesses are likely to get away with (hence the standard "I don't recall" answer from politicians and beuracrats), but it's not a universal solution to the "I don't want to tell you" scenario.

<comment><USER15> I think that the difference is that people are generally good at remembering the details that judges are normally interested in. People are notoriously bad at remembering passwords.

</comment></comment></comment></comment></comment></comment></comment><comment><USER16> Here's a recording of the oral arguments for the US Court of Appeals, Third Circuit back in September: [http://www2.ca3.uscourts.gov/oralargument/audio/15-3537USAv....](http://www2.ca3.uscourts.gov/oralargument/audio/15-3537USAv.AppleMacProComputer.mp3)

The gov's argument seems to be that because the defendant doesn't have to give the government the password but rather produce the decrypted hard drives, his actions aren't protected under the fifth. Analogy drawn with unlocking a safe.

EFF counter-argument to the safe analogy is that the encrypted documents do not simultaneously exist in a decrypted form protected by an obstacle, like a safe, but rather are produced as an act of translating the data from decrypted to unencrypted form; the government already has the data on the drives, they just can't understand it without the contents of the defendant's mind.

Justices then press the gov lawyer on whether there are fourth amendment issues in the case, as in whether the government can search all files on the hard drive, if decrypted, for evidence of criminality beyond the specific files they seek. Gov lawyer punts on the issue.

Basically it seems like a steep hill for proponents of encryption. The justices talk about how we're heading for a world where almost everything is encrypted, and encryption proponents are asking the government to give up an enormous amount of power.

<comment><USER17> Can you be compelled to provide something that you don't have access to? Were anyone else in this situation, wouldn't it be plausible to simply claim you don't know that password?

<comment><USER18> I've wondered about scenarios where you can legitimately claim to not know the password to decrypt a drive. A few different cases I can think of which may be ruled differently by a court.

1) I use a password manager so I don't know the password. However, I have the means to acquire the password.

2) I use a password manager but somehow lost access to it unintentionally.

3) I use a password manager and lost access to it by design. (eg. Using a dead man's switch of some kind that deletes it if I don't "check in" for some period of time)

4) I used to know the password. However, I suffered a traumatic brain injury and cannot recall it.

I obviously don't have the answers but I think these are interesting to think about as different points in a large legal grey area.

<comment><USER19> one i've ben thinking of is a shuffled keymapping or keyboard - you know what password you type, but not what it actually translates into.

<comment><USER20> Not bad, but that key-map would have to be accessible unencrypted from the encrypted device no? Unless somehow hard-mod a physical keyboard or something?

</comment></comment></comment></comment></comment><comment><USER21> Thought experiment: What if there were an encryption system whereby if a user inputs one decryption key, the encrypted data decrypts to one set of values and if the user uses a second key, it decrypts to a second set of values.

Sure, in order to encode both sets of data into a single encrypted result would require more storage space, but that is a small price to pay for protection against self incrimination from our ever growing police and surveillance state.

The end of the article captures why this idea would be so effective, viz. "The authorities, however, said no testimony was needed from Rawls. Rather, they said, 'he can keep his passwords to himself' and 'produce his computer and hard drives in an unencrypted state.'"

It is absolutely true and valid that the government has the right to compel people to hand over evidence that they are KNOWN to possess (in the same way that legal discovery is essential to civil cases). The line the government is drawing between self-incrimination and forced cooperation in an investigation is they they don't want him to tell them the password or what is on the drives -- they simply want him to hand over the drives in an intelligible state. Thus, if one could decrypt the drives to an intelligible set of data but not the data they desire, then you would be complying with the court order and could not be held in contempt.

Can someone on HN who knows more about cryptography help poke holes in my idea?

<comment><USER22> Thought experiment: What if you kept two sets of bank records for your business. One set of bank records were truthful and demonstrated your guilt. The others were falsified and demonstrated your innocence.

What would happen if, after your bank records were subpoenaed, you hand over the falsified records?

Well, you'd be committing a crime. Maybe you get away with it, or maybe law enforcement figures it out and you get caught. Depends on how clever of a criminal you are.

Same thing here with your double-plaintext encryption.

<comment><USER23> Hmm... I believe there may be a distinction here. Decrypting to the false virtual contents would be more like presenting a copy of the bank records that were correct, but the file had been corrupted and the data was unusable. However, the corrupted but true records had been created before the subpoena (not trying to obstruct) and were handed over in good faith.

You wanted the contents of this drive? Here they are!

The owner of the drive is definitely in a legal and moral grey area, but it would be supremely difficult to prove mens rea in this case.

Interesting thought experiment: What happens when someone fills a hard drive with junk data and then encrypts it, then gets subpoena'd for the unencrypted contents of the drive?

<comment><USER22> The scenario you describe is not at all like the situation at hand. Data corruption and encryption are not the same thing as encryption is a fully reversible process.

Further, the owner of the drive is not in a legal or moral grey area. They are in a "black" area where it's quite clear that they are being intentionally deceptive in defiance of a court order.

</comment></comment></comment></comment><comment><USER24> This case is interesting. If I'm reading [https://en.m.wikipedia.org/wiki/United_States_v._Hubbell](https://en.m.wikipedia.org/wiki/United_States_v._Hubbell) correctly, the fifth amendment only applies if "they don't know what they're looking for." In this case, because there is (enough) evidence of CP on his computer, they are subpoenaing him to produce the unencrypted drives. In some sense, they're not asking for a password - they're asking for the drive contents, which they know to at least partially be illegal. IANAL though.

Assuming that interpretation of the 5th is correct, subpoenas can easily be used to access encrypted information. I just hope the judges that decide when to grant subpoenas know where that line is.

<comment><USER25> It is amazing that anything produced would be admissible.

I don't see how this is different than having circumstantial evidence that someone is a murderer, so ordering them to lead you to where they buried the body.

<comment><USER24> I think they key is that the evidence is beyond circumstantial - they have concrete evidence that he uploaded files that were CP from that computer. It's a bit worrying why that isn't circumstantial (hacked computers aren't a thing?), but maybe the standard for issuing a subpoena is lower than guilt but higher than circumstantial.

Sounds like the only right answer for your password is "I do not recall"

<comment><USER26> This might be a stupid thought but if they already have enough concrete evidence against the suspect, why do they require the contents of the drive?

<comment><USER24> My bet would be to up the sentence. Go from 2 counts of CP to 200 - 5 years in jail to life sentence.

<comment><USER27> But then that seems to undermine the whole argument, because they actually _are_ requiring the suspect to incriminate himself.

<comment><USER28> Each photo in possession is a separate crime and they, presumably, know about and want a single photo. However different legal doctrines say, if they find more in the normal course of events, they are now admissible and can be used to create new charges.

<comment><USER27> > However different legal doctrines say, if they find more in the normal > course of events, they are now admissible and can be used to create new > charges.

Sure, but that's not the case here. They apparently already know he possesses a certain number of such photos, and now are now trying to compel him to incriminate himself further.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER29> So if I forget my password, I can be in jail forever?

<comment><USER30> That would be an interesting case but that's not what seems to be argued here. The state is arguing that they have enough evidence that "the presence of child porn on his drives was a 'foregone conclusion.'". It's likely the defendant didn't use forgetting-the-password as a defense because it was obvious via IP traffic and witness testimony that he had regularly and recently used his computer.

The ruling here seems focused on the point of whether the knowledge/use of a password constitutes self-incrimination, which people have a Constitutional right not to engage in. IANAL, but it seems akin to arguing that you have a Fifth Amendment right not to give up a DNA sample.

edit: Looks like I'm wrong, defendant did use forgetfulness as a defense at one point, though that was ultimately not his only reasoning for appeal.

Look at page 7 of the document here:

[https://arstechnica.com/wp- content/uploads/2017/03/rawlsopin...](https://arstechnica.com/wp- content/uploads/2017/03/rawlsopinion.pdf)

            Approximately one week after the Quashal Denial,
            Doe and his counsel appeared at the Delaware County Police
            Department for the forensic examination of his devices. Doe
            produced the Apple iPhone 6 Plus, including the files on the
            secret application, in a fully unencrypted state by entering
            three separate passwords on the device. The phone contained
            adult pornography, a video of Doe's four-year-old niece in
            which she was wearing only her underwear, and
            approximately twenty photographs which focused on the
            genitals of Doe's six-year-old niece.

            Doe, however, stated
            that he could not remember the passwords necessary to
            decrypt the hard drives and entered several incorrect
            passwords during the forensic examination. The Government
            remains unable to view the decrypted content of the hard
            drives without his assistance.

However, in the next paragraph, the document refers to a ruling in which the court found that there was enough evidence to show that the suspect "remembered the passwords needed to decrypt the hard drives but chose not to reveal them because of the devices' contents". I imagine the details of that evidence was in the Oct 5., 2015 hearing in which the suspect "neither testified nor called witnesses. He offered no physical or documentary evidence into the record and provided no explanation for his failure to comply with the Decryption order".

<comment><USER31> > Forensic examination also disclosed that Doe [Rawls] had downloaded > thousands of files known by their "hash" values to be child pornography. The > files, however, were not on the Mac Pro, but instead had been stored on the > encrypted external hard drives. Accordingly, the files themselves could not > be accessed.

He was running a Freenet node. Investigators were also running Freenet nodes, which peered with his. The were using a tweaked Freenet client that logs lots of stuff. So they know that chunks of child porn files went to his node. What they arguably don't know is whether he requested them, or merely relayed requests from other peers. But they have experts who will bullshit convincingly enough about that.

Edit: The Freenet Project, in my opinion, has irresponsibly relied on "plausible deniability".

<comment><USER32> Interesting, didn't think it could be Freenet related, as lists of hashes during synchronisation was stated. If so it could explain why the prosecution want the drive decryped although they on the surface seems to have enough evidence.

But then the foregone conclusion argument could to be slightly disingenuous, depending on exact details which appears to be unknown at the moment?

<comment><USER31> By running their own Freenet nodes, investigators can create databases of observable chunk hashes and file content. And they can see traffic to peers. So they know that his node handled child porn.

But they can't really know that _he_ was looking at child porn without finding saved files. They may also be interested in communications with other potential suspects.

</comment></comment></comment></comment></comment><comment><USER33> This is an interesting contrast to the article reported this past week about Nigel Lang, a black man in the UK who was accused of having or sharing child porn because of an extra digit added to an IP address during investigations[1].

One relevant section from the apology/explanation letter: "The issues around the downloading of IIOC [indecent images of children] are that statistically out of a cohort of offenders, the predominant characteristic is that the offence will be committed in the main by white males. Only a very small percentage will be black, around 3%, and only around 2% will be female. Consequently, any arrests that are made for this offence will revolve around the male in the address as the starting point for the investigation."

Notably Rawls (the man indefinitely jailed) is black.

[1] [https://www.buzzfeed.com/matthewchampion/this-mans-life- was-...](https://www.buzzfeed.com/matthewchampion/this-mans-life-was- destroyed-by-a-police-typo?utm_term=.sq1RxMpPw#.dly024JKV)

<comment><USER34> > The issues around the downloading of IIOC [indecent images of children] are > that statistically out of a cohort of offenders, the predominant > characteristic is that the offence will be committed in the main by white > males. Only a very small percentage will be black, around 3%, and only > around 2% will be female.

That's quite a remarkable statistic. I wonder why.

<comment><USER35> Fewer black people for one.

<comment><USER36> US is like 12% black, no (and 50% female)? Doesn't explain the discrepancy.

<comment><USER37> The quote is from a UK report

<comment><USER36> In that case it lines up exactly

</comment></comment></comment></comment></comment></comment><comment><USER38> Almost like they chose this particular topic to set a precedent...

<comment><USER39> Or, this is a case in which a defendant had a non-foreign-government reason to accept whatever consequences come from not cooperating (thus not having political machinations at work) and it's a case with real human harm that makes it worth pursuing for the prosecutor.

</comment></comment><comment><USER40> It goes to show that regardless of what protection encryption theoretically provides, security is only as good as the weakest link in the chain. Torture in some fashion is _always_ an option to force decryption.

The same goes for constitutional protections. The more time goes on, the more constitutional protections will be attacked and minimized.

The fact that a child pornography case is being used to break encryption via the courts should come as no surprise. Emotion is being used to broaden the power of the courts.

</comment><comment><USER41> It seems like the law is kind of ambiguous on this ([https://en.wikipedia.org/wiki/TrueCrypt#United_States_v._Joh...](https://en.wikipedia.org/wiki/TrueCrypt#United_States_v._John_Doe)), unless my interpretation is completely flawed. I wonder if this will have to go to the Supreme Court at some point.

<comment><USER42> In this case, the 3rd circuit applied the same standard as the 11th (the government can compel decryption if they know what is on the drive), so it doesn't yet create a circuit split.

However, they don't decide that that is the right standard. In a footnote they suggest that the correct standard would be more lax (the government can compel decryption if they know the person knows the password). So if a case comes up where they rule that way, it would create a circuit split and lead the supreme court to take the case.

Orin Kerr writes a column about it here: [https://www.washingtonpost.com/news/volokh- conspiracy/wp/201...](https://www.washingtonpost.com/news/volokh- conspiracy/wp/2017/03/20/third-circuit-doesnt-resolve-standard-for-forced- decryption-under-the-fifth-amendment/)

</comment></comment><comment><USER43> It's my understanding that, while one is obligated to comply with a warrant granting police access to places or materials in one's control, one cannot be compelled to aid them in their search or understanding. In other words, if presented with a warrant, a person would be required to grant access to a home or to hand over an accounting ledger, but the Fifth Amendment protects against being compelled to tell police where in the home drugs are hidden or which line items in the ledger contain embezzlement. A warrant grants the police the right to search, but not the right to find.

With that in mind, here's a thought exercise:

Let's say that I'm caught on camera signing a document with a man who later kills my business partner. The camera then records me going into my warehouse with the document and emerging later without it. The police, believing that I arranged the murder and that the proof is in the document, duly obtain a warrant to search the warehouse.

The warehouse is large and when the police enter, they find it is stacked floor to ceiling with sheets of paper, all indistinguishable except for their contents. They estimate the number of pages to be in the billions -- far too many for them to feasibly comb through.

If I understand the right against self incrimination correctly, I can't be forced to tell the police where I hid the specific piece of paper they're looking for.

Why is this different from finding a password? Assume we use a 43 character password (since the encryption key is AES 256, a password longer than 43 characters wouldn't add additional security). If this is the case, approximately 1.01e86 - 1 passwords effectively yield a garbage document, and 1 password produces the document the police are looking for. If one can't be compelled to help the police find the solution in a physical search space, why can one be compelled to help find one in a digital search space?

</comment><comment><USER44> The scary part is that someone can be jailed indefinitely. I had no idea that was legally possible.[1] But it's CP so it's an easy sell.

[1] [https://en.wikipedia.org/wiki/Indefinite_imprisonment](https://en.wikipedia.org/wiki/Indefinite_imprisonment)

</comment><comment><USER45> This reminds me that I need to wipe the drive I was using to test Bitlocker, as I typed in a random password and have long since forgotten it. I can only imagine the Kafkaesque horror of being imprisoned until I decrypt it, spending decades trying to brute force it.

</comment><comment><USER46> Although most of the comments here have to do with legality, I am more concerned with the technical aspect. The prosecutors say they know that he has porn because the hash values they obtained are identical to the hash values of porn images.

Are hash collisions not a consideration? Can hash values be as incriminating as direct evidence?

Is it possible to take a hash of a benign image (kitten?) and encrypt it with an algorithm that gives a result which is identical to an unencrypted hash value of a pornographic image?

<comment><USER47> I'm wondering how they obtained the hashes. You can't hash images on an encrypted drive. How are they able to obtain a hash of an image without actually having the image? Were the hash values from what he has downloaded stored somewhere?

</comment></comment><comment><USER48> I'm surprised he hasn't argued there's evidence of a different crime on the disk(s), as a reason why he is refusing under the Fifth.

Edit: Thanks for the downvotes :)

<comment><USER49> They'd offer him immunity on the "different crime", then he'd have no defence.

<comment><USER48> That would work? Not a lawyer or American so

(Thanks for the upvotes, and pmyteh for replying)

</comment></comment></comment><comment><USER50> What happens if this guy just claims that he forgets the password and sticks to his story? Will he be effectively imprisoned for life, whether true or not?

<comment><USER51> if they imprisoned him in a way which is later seen as unlawful he can get a huge payout. why not just stick to your guns and get $1m+ for sleeping in bed and doing a few push up.

</comment></comment><comment><USER52> "The fact remains that the government has not brought charges," Donoghue said in a telephone interview. "Our client has now been in custody for almost 18 months based on his assertion of his Fifth Amendment right against compelled self-incrimination."

This should be simple, either they have enough to charge him or not.

</comment><comment><USER53> Is there a charitable interpretation of this that I'm not seeing? Or is this truly as terrifying as it appears?

<comment><USER39> Head's up that the source goes into some detail and is a miserable, sickening read.

Per the source ([https://cdn.arstechnica.net/wp- content/uploads/2017/02/fedsr...](https://cdn.arstechnica.net/wp- content/uploads/2017/02/fedsrawls.pdf)), the prosecutors already have a case based on checksums of the media that the defendant had downloaded, and per the logs, stored on his external hard drive. I imagine that the prosecution wants the media so they can perform harm reduction services for the identified, affected children and/or improve their data for going after other/future child abusers.

<comment><USER32> But harm reduction and improving data for other cases is not the intended use of warrants and contempt of court, or is it?

<comment><USER39> No, and thanks for catching that.

My understanding is that the prosecution doesn't need the decrypted data to secure a guilty verdict, but as they're entitled to it, they likely want it for secondary benefit.

</comment></comment></comment></comment><comment><USER54> If they've got the evidence, legitimately charge him then? If it's sufficient, let a jury of his peers convict him then.

How is this any more complicated than that, no matter how you frame it? We have laws as a check and balance system for a reason, apparently the US courts are slowly forgetting it or something...

</comment><comment><USER55> Quite a minefield of legal issues. Indefinite detention pretty much seems like an abuse of the court's power to find people in contempt. He should get charged with a real crime like obstructing justice and serve a sentence for it, if they have the evidence for that, but this is absurd.

</comment><comment><USER56> They are doing the same inquisidores did, they are torturing someone to confess (in this case decrypt)

</comment><comment><USER57> Can you refuse a search warrant? My understanding (albeit limited) is that you can't, if it's been signed by the proper legal authority. Is refusing to unlock the HDD the same as refusing to unlock a room, when presented with a lawful warrant? I would think so.

</comment><comment><USER58> This raises an interesting idea: why not create two passwords for encrypted drives, one password decrypt the drive, another password completely wipes the drive. This way if someone is forced to give a password to decrypt something, that password renders the data moot.

Thoughts?

<comment><USER59> Here's mine: destruction of evidence is a crime.

Probably not the best idea.

Hiding the partition or otherwise making the encrypted data hidden is probably your only bet.

<comment><USER58> Which would you rather go down for: destruction of evidence, or what's in your hard drive? I'm asking a technical question, not a legal one. There are many instances where this would be preferable than giving up the data.

<comment><USER59> If someone released such a tool, the feds would make sure to clone your hard drive before supplying the password to it, or write a patched version of the tool that reads it to remove the disk wiping call.

And then you'd be in really hot water.

<comment><USER27> I expect cloning to already be standard forensic procedure, but perhaps I'm wrong. If not, it should be.

<comment><USER60> yep. Work on the copy, or the copy of the copy in my case. It's digital with a hash, not a vhs tape

<comment><USER58> Ah cloning, very good point. So that raises a new question: Is there any way to prevent decryption of a drive, when the password is forcibly obtained?

</comment></comment></comment></comment></comment></comment></comment><comment><USER61> If they already know it's on there, then isn't that enough to build the case and just try him as is?

</comment><comment><USER62> The sad part is he has provided the password, but it's "fuckoffI'llnevertell"

</comment><comment><USER63> and this is why the software you use to encrypt hard drives should support plausible deniability. You give away the (other) password and the decrypted drive contains nothing but cat pictures.

<comment><USER64> This. This is actually a good solution. Not cat pictures though, it would need to be something at least shameful, maybe even lightly criminal. This would work as an alibi for why you are encrypting the drive.

<comment><USER65> Or deeply personal like a journal.

</comment></comment></comment><comment><USER66> Is this another case of "encryption works"?!

</comment><comment><USER67> After 18 months in jail, can't the accused legitimately say that he forgot his password? I don't know if I would remember a relatively complex password if I were stuck in s jail cell for 18 months with no computer or ability to type it in every few days.

</comment><comment><USER51> what if there was a password to decrypt the drive into rick astley on a loop?

</comment><comment><USER68> What would happen if he lobotomized(carefully and mildly) himself, and legitimately could not remember his encryption keys/pw nor the reason he performed lobotomy?

<comment><USER69> Or very carefully shot himself in the heart?

<comment><USER70> Surely this layman knows enough about the brain to know how to lobotomize himself such that he forgets his passwords, but not such that he forgets how to perform a self-lobotomy!

<comment><USER71> That's easy, just snip the _blue_ neurons. Or was it the red ones? No, definitely blue. (Snips red neuron.)

</comment></comment></comment></comment><comment><USER72> Okay now, what if my password is the hash of a CP Picture, then there would be no way for me to offer that password without committing a crime in the first place. So in that case you would be safe. Or when the password would be some file that could incriminate me</comment>


NPM v5.7.0 - <AUTHOR> http://blog.npmjs.org/post/171139955345/v570 <comment><USER2> Beware that this release seems to destroy your filesystem if run via sudo.

[https://github.com/npm/npm/issues/19883](https://github.com/npm/npm/issues/19883)

<comment><USER3> This is a pre-release not a final one. But running npm update -g seems to install the 5.7.0 pre-release, due to a second bug, so some people will still hit the filesystem permissions bug in practice, even if they don't try to explicitly install this specific release.

<comment><USER4> >This is a pre-release not a final one.

Which is __not __mentioned anywhere in the linked blog post.

<comment><USER3> Which is why I explicitly mentioned that, as the blog post is likely to confuse people in this regard.</comment></comment></comment></comment>


Meetup's Multi-Day Outage Was Due To A Newer, More Powerful Type Of DDoS Attack - <AUTHOR> http://techcrunch.com/2014/03/04/meetups-multi-day-outage-was-due-to-a-newer-more-powerful-type-of-ddos-attack/

<comment><USER2> "newer" in the sense of "in the last 12 months".

[http://blog.cloudflare.com/understanding-and-mitigating- ntp-...](http://blog.cloudflare.com/understanding-and-mitigating-ntp-based- ddos-attacks)

[https://news.ycombinator.com/item?id=7036037](https://news.ycombinator.com/item?id=7036037)

[http://blog.cloudflare.com/technical-details- behind-a-400gbp...](http://blog.cloudflare.com/technical-details- behind-a-400gbps-ntp-amplification-ddos-attack)

[https://news.ycombinator.com/item?id=7230847](https://news.ycombinator.com/item?id=7230847)

EDIT: just saw who submitter is. :)</comment>


Google tests scripting feature for online apps - <AUTHOR> http://itworld.com/development/68497/google-tests-scripting-feature-online-apps <comment><USER2> Direct link from Google: [http://googleenterprise.blogspot.com/2009/05/old- tool-new-tr...](http://googleenterprise.blogspot.com/2009/05/old-tool-new- tricks.html)

</comment><comment><USER3> GBA? I don't think a real hacker would want to mess with this. I was excited for a while about ZoHo's scripting, but found using a proprietary scripting language in a webpage to be like pulling teeth.</comment>


Broadway, RabbitMQ, and the Rise of Elixir Part 2 - <AUTHOR> https://akoutmos.com/post/broadway-rabbitmq-and-the-rise-of-elixir-two/ <comment><AUTHOR> In this post I cover how to leverage RabbitMQ along side Broadway to process data from the HackerNews Firebase API. I also leverage Prometheus and Grafana to monitor the application and ensure that the pipeline is performing as expected.</comment>


Mexican Billionaire Invests $250m in The New York Times - <AUTHOR> http://www.nytimes.com/2009/01/20/business/media/20times.html?_r=1&em <comment><USER2> New York Times doesn't need money - it needs visionaries.

It needs people to step away from the newspaper, and think how to evolve it.

Do what their (gorgeous) web design dept has done -- for print.

Newspapers can be saved.

</comment><comment><USER3> The best they can get is 14% interest, 11% of which needs to be paid in cash. Plus warrants to purchase equity if the company's finances improve?

Who is fooling whom? This company is dead.</comment>


Don't listen to Shipley & Arrington, listen to your customers - <AUTHOR> http://blog.vagueware.com/2008/9/8/rivalry-zero-understanding-of-what-startups-need

<comment><USER2> It seems to me that TC and DEMO are a special kind of launch events. They are not really about launching products but about launching the companies as a "product".</comment>


Thoughty2's Channel on YouTube - <AUTHOR> https://www.youtube.com/c/Thoughty2/videos <comment><AUTHOR> I have watched many of Thoughty2's videos on YouTube, and as a person of the mind, feel that they are quite good.

The man is a thinker; a fellow person of the mind, quite simply stated...</comment>


Normal for companies to 'interview' to receive free consulting? (Facebook) - <AUTHOR> One of my good friends recently interviewed with Facebook. For background, he has massive amounts of experience in the audio/visual industry, and has worked for some of the top companies in the world setting up their AV systems.
So he goes through 3 rounds of video chat interviews, and each subsequent one resulted in them asking more and more direct questions about where he saw the industry going, what was going to be the new technology, what people were going to be moving away from and his thoughts on what the smart moves were.
Facebook did not end up hiring him. Instead they used him as a free consultant, under the guise of hiring him, and wasted hours of his time because Facebook could not be bothered to actually pay him for his consulting time. They took his advice and followed it to the T. We are certain this was an odd move for them, a move they would not have made without his input. We learned about this through the grapevine that is the small AV world.
We realize this is a bold claim, but a month or two after his interviews, Facebook was suddenly pivoting from one process to another. They were moving away from a tech he was sure was going to die soon, a tech that Facebook loved and was in bed with for years, to something else he saw that was going to be ubiquitously the future.
Sorry that I cannot be more specific, but it disgusted me to hear that a company like Facebook, with so much money, would do something so underhanded. Guess I'm naive.
Companies that do this need to be called out. Name and shame! <comment><USER2> I've seen this happen countless times. More specifically, I've seen companies use contrived but domain-specific questions for interviews, and have either junior or overconfident candidates assume they were duped into a free consultation under the guise of an interview.

No, a $100B+ company that regularly pays $500k/yr to mid level engineers is not trying to save a few thousand dollars by dancing around a consultation fee.

I worked for a data heavy company a few years back that would use a domain relevant but extremely contrived and simplified dataset for interviews. Our Glassdoor was _filled to the brim_ with identical accusations.

<comment><USER3> Although I agree large companies would not need to, and probably have very strong rules against it. I can also see various unscrupulous lead engineers / middle managers doing exactly this.

I had a similar experience back a number of years ago. They did offer me a job, but it was not a good offer.</comment></comment>


How This U.S. Tech Giant Is Backing China's Tech Ambitions - <AUTHOR> https://www.nytimes.com/2017/08/04/technology/qualcomm-china-trump-tech-trade.html <comment><USER2> Much like manufacturing did this with outsourcing, this short sided policy will also ultimately hurt these same companies long term.

I'm no trump administration fan, but I do hope they find some way to stop this.</comment>


How to get a job after your startup fails - <AUTHOR> http://www.jamesmaskell.co.uk/2013/how-to-get-a-job-after-startup-failure/

<comment><USER3> I found that having a failed startup was good resume fodder to some extent. I was worth more in the marketplace after my failed startup, since I was perceived as having a more versatile skill set.

(It helped that my failed startup, while financially a failure, was cool and helped me demo a lot of advanced coding skills. :)

But I did run into a personal problem: after being a startupper, I found it very hard to transition back into working for someone else. In the end I had to sit down and be honest with myself: did I want to start another startup right now or did I just want a paycheck? I decided-- for the time being-- on the latter. So I had to swallow a bit of the radical self-direction I'd become accustomed to and decide to work for my employer since that's the deal.

<comment><USER4> I remember one particular job I interviewed for after leaving a start-up, and got asked various questions like "why did you fail?" and "working for that little money? That's stupid!"

I always think of them as the perfect example of "the interview is for you to learn about the company and the company to learn about you."

<comment><USER5> So, if someone calls you stupid to your face in an interview, that's probably not a good place to work - so I'm guessing that was slightly a hyperbolic recollection.

That said, both questions can be turned around to your advantage: The first, show that you have learned from your mistakes and that's you're cool and focused in the face of adversity. The second, that you're not just a day labourer, but you're focused on and motivated by the long haul: "yes, it was a long shot, but if we'd succeeded, we'd change the way the world thinks about X".

<comment><USER4> No, they really said "stupid." I must have blanched -- I've worked with difficult people and can tolerate a lot -- because he immediately tried to back away from it.

But, yeah, bad place to work. They went bankrupt and got delisted from the exchange about 2 years later. I will admit to feeling some schadenfreude at that.

</comment></comment></comment></comment><comment><USER6> __5\. Be clear about wanting to work for someone else __

I think this particular point requires a bit more emphasis. I work for a large development company that requires me to source the top technical talent in the UK. A significant number of highly talented individuals are currently running their own start-ups which is understandable. Regardless of how brilliant a developer may be, that's not a guarantee of success and there will come a point where some of those startups fail and the founders will have to go find a 'regular job'.

The number one concern I have when I'm in discussions with a failed startup founder is how long they will stick with us before coming up with another brilliant idea and leaving us to go give it another shot.

I'm more likely to relax when a potential employee tells me that for the next couple of years they simply want to focus on a 'regular job' and maybe revisit the startup idea further down the line. Unfortunately the onus is almost entirely on the developer/start-up founder to place the employers mind at ease.

<comment><USER7> Steve, does it really matter? Even if a super-talented developer only stays with you for say 6-12 months surely they would deliver enough value in that time to not make it a huge concern? Also, let's flip the question on its head, if a company can't hold on to talented, entrepreneurial staff, is it indicative of a problem with the staff or with the company? What's the common denominator here?

What is better? Being fortunate enough to have a super smart person come on board, deliver a large amount of value, and then leave after a short period; or a less talented developer delivering lower quality work, at a lower velocity over a longer period?

I'm not sure talented but flighty people are a problem. Once they're in the door, it's the company's job to make sure their staff are happy and want to stay rather than moan about it.

<comment><USER6> 6-12 months is plenty of time for a talented dev to have a big impact but I'd much rather hire them on a contract basis than a permanent basis in that circumstance.

Regardless of how adept a company is at retaining their best talent, you will never be able to compete with the appeal of running your own business and being your own boss.

</comment></comment></comment><comment><USER8> Shouldn't just be a question for post-failure, but any sort of post-startup job. I've bounced back and forth between startups and bigCo my entire career. Or as I like to call it, moments of stark frenzied terror sandwiched between years of immense boredom.

One thing being in a small startup teaches is versatility, you can vastly expand the breadth of your skillset in an environment where you _have_ to perform, even if some of your core skills languish a bit.

It's hard to get this across in a resume, but do put them down. Are you a coder than ended up spending a few hours a week on sales? Put it down. Marketing guy who got roped into server administration? Put it down.

When applying for a place, just simply reorder those various hats you wore in your old startup to suit the position you are applying for. Put the most relevant ones at the top of the list and the least relevant ones nearer the bottom.

It can definitely take some getting used to, going back to working for somebody else, you feel like you've lost lots of autonomy -- you might even have to take what feels like a couple steps back. But you can turn that on its head and use your broad skillset to quickly move up the ranks. You can do the job they hired you for and, oh yeah, you can do these other half dozen jobs competently, should you just be in charge of the whole group then since you know what everybody does and can reach across and down as needed?

 _also get used to befuddling even competent recruiters, at one startup I did almost every job in the place at one time or another, when looking for a new job it drove the recruiters crazy trying to place me_

<comment><AUTHOR>
        also get used to befuddling even competent recruiters, at one startup I did almost every job in the place at one time or another, when looking for a new job it drove the recruiters crazy trying to place me

I had this problem - recruiters want a job title to pigeon hole you with. Their brains explode when they can't do this.

<comment><USER9> Yeah, they don't like it when your answer is "everything" to the question, "What did you do at _____?".

I've since changed it to "Everything, but tell me what you're looking for and I'll tell you about my experiences in that realm."

</comment></comment></comment><comment><USER10> The best way to get almost any job is to knowing someone who already works there. It is old advice, but it is probably the best, it is easier to get your foot in the door when they already have someone to vouch for you. In other words, while you are working on that startup, dont forget to keep in touch with people and look for new friends in your field of interest, it will go a long way.

<comment><USER11> This advice works best when the person you know is directly responsible for running the company but gets less and less useful the further you get from that point.

<comment><USER12> Actually, having someone refer you internally will almost guarantee an interview. It's super useful.

<comment><USER13> You're both right if Rocky meant a range in usefulness from 'virtual lock' to 'a really good shot'

<comment><USER11> Yep. Even the person in your pocket at the absolute bottom of the rung is still someone in your pocket.

</comment></comment></comment></comment></comment><comment><USER14> It heavily depends on the market. When my startup failed in 200x after popping of the dotcom bubble, the market for programmers was terrible and I was lucky to get a job at a state funded research institute.

Comparing this to today, where I get at least one offer a week, this was completely different.

<comment><AUTHOR> Unfortunately I'm not a programmer (I can write enough code to be dangerous) - but more of an ops/product/sales type person instead, so it was a bit harder for me to find something.

I was also surprised at how long it took our developer to find a new role - <USER2> was extremely good, got first interviews quickly but it took companies a long time to make a decision. And we're in London, where those skills are in very high demand.

<comment><USER14> In Berlin we have two open ops positions ;-)

" but it took companies a long time to make a decision"

Yes, a lot of companies get that wrong, sometimes we do too. But we strive to have interviews as fast as possible and make decisions within a week, most often the same day as we do not consider it fair letting people wait on a decision (and it rarely gets better with time).

</comment></comment></comment><comment><USER15> I'm in a similar situation to the blog author, but unfortunately for me i really struggled to find a job. In all fair ess, there were one or two pieces of advice in the post that i hadn't followed, so worth considering, but at the same time, there are very few start-ups where i live. And i'm unable to re- locate due to personal circumstances. I've had a little bit of success with freelance work and consulting however, and i feel that is the way forward for me.

Well done to the blog author for keeping his chin up and turning things around for himself so quickly.

</comment><comment><USER16> In the process of shutting down my own company. I was bootstrapping a software startup with consulting gigs for the past 5 years. What killed it was my inability to expand, i.e. costly attempts to expand dried up my funds.

Though I learned a lot in running a company I feel I lost touch a bit on the programming side. My bread-and-butter was C/C++/ASM from about 1996-2008. De- rusting those skills now feels somehow liberating.

</comment><comment><USER17> Just for fun and to hopefully one day avoid failing in a startup, I like to do post mortems. What I understood of Vinetrade is it struggled to make any income in a market which isn't comfortable right now trading online.

1\. 2/12 Launches vinetrade

2\. It manages wine portfolios

3\. Raises funding

Getting funding so early is an indication that early profitability was probably not the main focus. Can give a false sense of success and idea validation.

4\. People already trade wine but are not using an online service to do it yet

If this is your first startup, don't try and revolutionise an industry. Let someone else blow the money and make the mistakes first. Be a fast follower instead.

5\. JM talks about building an MVP

Vinetrade should be your product? Another indication of not focusing on achieving profitability and a good revenue model and pricing structure early on.

6\. 3/13 Closes vinetrade. Mentions it would have needed more funding.

Funding focus again an indication of lack of focus on early idea validation through profitability.

<comment><AUTHOR> The struggle was more around scaling the business. We had income, and raised some seed funding on the back of it (in order to go full time on the project). We didn't take further investment because we knew we couldn't scale and provide the return that investors would have wanted.

While running Vinetrade, I learnt a lot about testing ideas and getting validation with minimal effort. The MVP post was about some of these lessons. If I was starting again, I'd get that validation much more quickly (but it would likely be the same early validation again).

<comment><USER17> But if it made enough money to keep yourself and the others in a job then why ever declare it as a failure? Unless it didn't make enough money?

<comment><AUTHOR> It didn't make enough to support the team. There was an argument for running it as a side project / one man business, but that wasn't something that I wanted to do (and investors supported/advised when making that decision).

<comment><USER17> Cool, thanks for being open about it

</comment></comment></comment></comment></comment><comment> super-serial Or you could get a $10/hr shit-job...

I think the best part-time jobs are fitness clubs. You're in the right environment to stay healthy and it's low stress. I used to work part-time at a racquet club and it was pretty awesome.

If you do go this route - just make sure when you apply to Target (you're more classy than Walmart right?) you put down "some college" instead of graduating with a CS degree. Also lie about previous work... all my prior programming jobs I put down as "Tech Support" jobs. Before I did that my applications weren't even considered.

I'm at the point now where either I succeed at a startup or I end up being a janitor at age 40. I couldn't stomach coding for anyone else but customers/users ever again.

<comment><USER18> Haha.. this cracked me up. Either you must be a genius with a thick skin or a "do or die" type entrepreneur.

</comment></comment><comment><USER19> I think I would be an amazing employee. After managing several people in a startup I can really empathize for what it takes to be a good manager.

I now believe that bad managers aren't bad because they are bad people, they just lack the right experience. I'm more inclined to give bad managers a break and good managers unwavering loyalty.

Of course I can be projecting, since I'm still running my own business.

</comment><comment><USER20> I can identify with the "Networking" advice, as all of my past employment situations were the result of "someone who knows someone who knows me."

</comment><comment><USER11> Avoiding HR is excellent advice. Find a company you want to work for and reach the person at the very top if you can.

</comment><comment><USER21> I'm four months into a new corporate job after running into financial problems towards the end of last year. I didn't shut my business down, but things had gotten very dicey financially, making it necessary to get a regular pay check. I don't do much work on my own business these days (desktop, not web, and few support issues to handle), but I do have one product released late last year that is starting to show real promise.

The day job is driving me nuts. I thought at first that I could easily give it a year and a half, but now I'm counting the days to when the financial mess will have cleared up enough to resign - 2 more months. Maybe it's the company I'm working for (evil banking software), but more likely it's me. I have great difficulty working for someone else on one small part of a huge, 10 year old product.

Over the past 4 months I've drawn up a detailed plan for the new product that I released last year, and I'm sure it's going to work (heard that before). Roll on July 1st. I feel bad about the company I'm now working for, knowing that I'll be resigning soon and that I'm effectively using them, but not bad enough to stay.

<comment><USER22> 2 months go by fast, you'll be back on your startup in no time. When you do, tell us about it! :)

</comment></comment><comment><USER23> A whole article about THIS?

How about:

1) Get a job.

Fin.

Or, could it be, that a startup failure descends upon one with such shocking repercussions, that one forgets how to tend for himself?

Yeah, another shameless rant from me. It's just rather disappointing seeing such useful material on the front page, that is.

<comment><USER24> I found the article quite practical and useful.

It never hurts to put oneself in other person's shoes. It's called empathy, which I gather you may not have for people in this situation.

For someone that has shut down their business, emotionally it is very unsettling. Having to come to terms with the failure and at the same time looking at the next steps is not as simple as "Get a job". Granted, perhaps you would handle this situation without any issues but I would say for most of us, its good to read another person's experience (even if it seems "obvious").

The biggest issue I see is that as a failed startup founder, you have accept that there will be another day for another attempt (if that is still what one wants to do). You just have to reinforce the cavalry (ie. build up the finances, the mental resolve, etc.) and that could take time.</comment></comment>


A web directory that doesn't suck, add and rate your favorite websites - <AUTHOR> http://www.addekt.com/ <comment><USER2> The pagination would be a lot more useful if every load wasn't random. I've seen the same sites multiple times across different pages.

<comment><AUTHOR> Every load is random to actually avoid repetition once you pick a category. You can however sort sites by rating or date and the issue won't presume.

</comment></comment><comment><USER3> The site _does_ suck: after registration and login, the "Submit Website" is a link to the login window.

<comment><AUTHOR> After registration and login, the site automatically redirects you to the submission form page. However if you go back to the homepage, you'll have to confirm your login to submit again.</comment></comment>


Ask HN: Feedback on my twitter app - hashlike - <AUTHOR> http://www.hashlike.com

<comment><USER2> Very interesting.

Some suggestions:

1\. Consider adding: img {border-style: none;}

2\. Consider right aligning images in the column. This will make the differing sizes not stick out as much.

3\. (twtr) can be replaced with an icon. (hummingbird?)

4\. Change "How-to" to something else or just remove that title.

All the best!

<comment><AUTHOR> thx

</comment></comment><comment><USER3> nice idea of converting blurbs/tweets about stuff people talk into a list.. It might be a nice idea if you had some kind of ranking with things that are most talked about on the top.. got the thought from tweetdeck which shows wordclouds with largest words being the ones most talked about, to see the trend

</comment><comment><USER4> mwerty, good luck on dealing with items that have movie and book versions with the same name.

<http://www.hashlike.com/movies>

Instead of under books, "The Black Swan" was listed under movies.

</comment><comment><USER5> found an error: <http://www.hashlike.com/hashlike/by> shows dark knight by smsq when your in the hashlike profile

<comment><AUTHOR> fixed.

</comment></comment><comment><USER6> hmmmm not bad.

I see that your business model is Amazon referrals... :)</comment>


Fatal crash of Tesla Model S in autopilot - <AUTHOR> http://www.latimes.com/business/la-fi-tesla-crash-20160630-snap-story.html# <comment><USER2> I don't know whats going on with latimes.com but their infinite scroll is bugging out on me and loading pages ever 200ms and jumping around.

`Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/53.0.2782.0 Safari/537.36`

</comment><comment><USER3> The usability question with partial automation has always been this: Will humans mistake excellent automation for perfect automation and come to rely on it and fail to provide adequate oversight?

Tesla's PR engine here makes a number of cringeworthy statements. For example, they say "Neither Autopilot nor the driver noticed the white side of the tractor trailer against a brightly lit sky." While the statement is literally true (the driver apparently did not notice the trailer, and the sky was brightly lit behind the trailer) it also invites the reader to mistakenly infer that the driver was paying attention and did not notice the tractor only due to the lighting situation. Maybe they were paying attention, but we'll never know.

The PR also reports the average vehicle miles driven in the US per crash death and reports the number of Tesla automated miles driven without a death. That invites the reader to make a comparison of apples and oranges: the US figure is for roads of all types whereas the Tesla figure is restricted to those types of roads where autopilot works.

</comment><comment><USER4> This might be an orthogonal remark but...the article is simply unreadable from a mobile device. When the ads are reloaded it jumps a page up and this happens every 5 seconds.

</comment><comment><USER5> Based on how this unfolds, we're going to have self-driving cars in 5 years or 50.

But the Tesla PR machine has been great at handling emergencies so far.</comment>


How We Deploy 300 Times a Day - <AUTHOR> http://dev.hubspot.com/blog/how-we-deploy-300-times-a-day <comment><USER2> This is a great example of a modern web stack following many if the steps from the "twelve factor application" methodology.

[1] [http://12factor.net](http://12factor.net)

<comment><USER3> [http://12factor.net/config](http://12factor.net/config)

> The twelve-factor app stores config in environment variables (often > shortened to env vars or env). Env vars are easy to change between deploys > without changing any code; unlike config files, there is little chance of > them being checked into the code repo accidentally; and unlike custom config > files, or other config mechanisms such as Java System Properties, they are a > language- and OS-agnostic standard

This is just silly... you have to store your configs somewhere, and setting env vars is not OS agnostic.

Assuming you're not using something like Zookeeper, you _do_ want track your config files in your revision control, just separate from the app. Implement an override system so your app loads the env specific settings from a standard override location (e.g. Java /opt/overrides/myapp.properties). If you use env vars or property files doesn't matter as much as being consistent and that you're not creating more complexity to just to make things simple.

<comment><USER2> Funnily enough, in the dev team I'm in, we build "11" factor apps, which keep the code in a git repo. I build a lot of django apps and use the idiom at the bottom of the settings.py that looks like:

try:

        from local_settings import *

except ImportError:

        pass

We then have dev_settings.py, local_settings.py, and qa_settings.py in the code repo. The deployment system will copy ${env}_settings.py to local_settings.py. So... assuming you aren't using something like zookeeper (or etcd if you're more bleeding edge), I 100% agree with you :)

This is why I say my team builds 11 factor apps :)</comment></comment></comment>


"A Toast to Your Health": Getting Drunk in Colonial America (2013) - <AUTHOR> https://theappendix.net/blog/2013/2/getting-drunk-in-colonial-america

<comment><USER2> | Modern estimates place the annual amount consumed by the colonists somewhere in the range of five to six gallons of pure alcohol (by comparison, per capita consumption in the United States in 2007 came in around 2.3 gallons).

It would be interesting to know the distribution of this. I wonder how much of it is individual people drinking more vs more people drinking. Take away video games and TV and I bet a lot more people would end up at the bar.

<comment><USER3> According to the Ken Burns documentary _Prohibition_ [1], it was both - especially if you replace "people" with "men". I don't remember all the facts and details leading up to Prohibition, but the documentary did make me more sympathetic to the temperance movement.

[1] [http://www.pbs.org/kenburns/prohibition/watch- video/](http://www.pbs.org/kenburns/prohibition/watch-video/)

<comment><USER4> Does it cover the sectarian, nativist element to the temperance movement?

</comment></comment></comment><comment><USER5> I wonder how much of this had to do with using alcohol as a primary source of nutrition and method of food preservation.

Perhaps the best way to preserve all the new world crops (including corn, potatoes, and numerous fruits and vegatables) was to ferment them? Old world wheat is very dry to start with, making it easy to store for long periods. But new world staples are much harder to preserve - what else could you do if you haven't discovered bacteria or pasteurization, invented refrigeration or canning, and need to feed everyone year round?

With farm output preserved through fermentation, alcohol would have been extremely cheap as well - I would guess significant cheaper than fresh foods during winter months.

<comment><USER6> Also transportation: fermentation reduced bulky corn crops to a few litres of alcohol with a corresponding increase in value density. Concentrated the wealth, which you could carry on your back to market.

<comment><USER7> I think this is a big issue. You would have wanted to ship alcohol instead of grain for the same reason you want to ship pig iron instead of ore. Transportation costs can eat up all your profit.

</comment></comment></comment><comment><USER8> Previous thread about this post on HN: [https://news.ycombinator.com/item?id=8857969](https://news.ycombinator.com/item?id=8857969)

</comment><comment><USER9> I might be doing the math wrong, but it doesn't really seem that much:

6 gallons = 768 oz

768 oz 100%abv = 1920 oz 40% abv

1920 oz is approx 192 drinks a year, or 3.7 drinks a week.

<comment><USER10> At 40% abv, isn't a drink 1.5 oz?

In which case it's 1280 drinks per year which is 3.5 per day.

<comment><USER9> Ah you're right. Don't know how I got from 1920 oz to 192 drinks—unless you consider 10oz of vodka a drink!

</comment></comment></comment><comment><USER11> On an unrelated note, I love the font on this page - "ff-quadraat-web". Very natural and easy to read.</comment>


ErlPort - connect Erlang to other languages - <AUTHOR> http://erlport.org/

<comment><USER2> Would really like to see some documentation about how to implement other languages. This does seem to be a neat tool if needed.</comment>


Are you the lonely DevOps engineer doing 24/7 on-call? Change it - <AUTHOR> https://marbot.io/blog/are-you-the-lonely-devops-engineer-doing-247-on-call-change-it.html <comment><USER2> But that's what DevOps is all about</comment>


PubHubSunday (Tim Bray's thoughts on PubSubHubbub) - <AUTHOR> http://www.tbray.org/ongoing/When/200x/2009/10/18/PubHubSunday

<comment><AUTHOR> The interesting bit (to me) is the section "The Spec". He raises the issue of whether a specification should use SHOULD and MUST so that only 'well behaved' services can be said to confirm to the specification.

</comment><comment><USER2> Regarding the POST problem: <http://news.ycombinator.com/item?id=889806></comment>


Passwords Are Broken, a Temporary Fix - <AUTHOR> https://medium.com/i-m-h-o/d70301e29305

<comment><USER2> I'm really not sure that getting humans to reliably use a relatively complicated and ultimately completely deterministic algorithm for password generation solves anything.

PassPhrases on the other hand work well, both in people being able to compose high-entropy, unique, site-specific phrases and playing to the strengths of human narrative memory.</comment>


Patterrific.com - <AUTHOR> http://patterrific.com/ <comment><AUTHOR> Not sure why, but really quite liked browsing this.

Sort of reminds me of a Wallpaper collection that I saw at the V&A Design Museum in London - sounds pretty boring, but turned out to be fascinating.

<comment><USER2> what specifically was fascinating about it?

<comment><AUTHOR> Well - I guess the main part was it was something I'd never really thought about before - it's amazing how much work was produced in the Victorian era for example.

I think there is a real art to producing something that is decorative, still interesting in it's own right, but isn't overwhelming / remains complimentary ("ties a room together") - a nice set of design paradoxes that can lead to some interesting results.

</comment></comment></comment><comment><USER3> I kind of get rubbed the wrong way when a site is little more than a wordpress install with a custom theme, but one which includes no 'built with Wordpress' (or Chyrp, or whatever…) tag. Not that it's not legit to build a site with Wordpress—most of mine are—but it just seems slightly unclassy, as though one was trying to gloss over the amount of work other people put into one's site. Am I the only one who feels like that?

</comment><comment><USER4> nifty</comment>


3D-Printed "Magic Arms" - The most inspiring use of 3D-Printing I've ever seen. - <AUTHOR> http://www.youtube.com/watch?v=WoZ2BgPVtA0 <comment><AUTHOR> I thought I'd post this because it seems to me that 3D-Printing has massive disruptive potential. It's incredible to see the impact this has had on this girl's life, but where else do you think there could be heavy disruption in 3D printing, and what startups might we see over the coming decade in the 3D printed space?

</comment><comment><USER2> I almost cried, that was a beautiful use of technology :)</comment>


What Happens When You Can't Talk to Yourself? - <AUTHOR> http://nautil.us/issue/30/identity/what-happens-when-you-cant-talk-to-yourself <comment><USER2> > American philosopher Jerry Fodor proposes an alternative idea, called the > "Language of Thought" hypothesis. He argues that in addition to our > consciously perceived internal monologues, we have a second internal > language that is codified into the brain—a kind of "mentalese," that we > don't consciously perceive.

That's roughly in line with the anecdotal reports from the "tulpa" community seem to report when trying to train a portion of their brain to operate as a quasi-independent entity: [https://www.reddit.com/r/Tulpas/](https://www.reddit.com/r/Tulpas/)

<comment><USER3> I can attest to this. I don't have an inner monologue (not that I can't, I just don't), I stopped in my teens. Nowadays, if I do talk to myself internally, I can feel the idea forming initially in milliseconds, and then the internal monologue just puts it in words, but it's just for amusement, it's not something necessary for thought. Most of the time (like right now, when writing this comment) I skip the monologue entirely.

It makes sense to me that this is exactly how we talk. We don't think things out at first in our heads, we just form an idea and then say the words to communicate it.

I was talking about this with a friend, entirely incidentally, and it turns out that he does the same thing too. I find it hard to believe we're that rare.

<comment><USER4> Me too. Thought is more fluid; putting it into words concretizes it, collapses the possibilities of the waveform. Somewhat, formalizes it.

Words are a serialization format for thought. There are different formats; there are also different bindings possible for the same information in the same format. Grammars are used to describe both. Actually, important early work on regular and context free grammars was done by a linguist.

Of course, none of that shows that thought is analogous to graphs of data structures. But I suspect if we ever develop direct brain-to-brain communication (i.e. prelinguistic telepathy), we'll see similar problems to interoperating programs written by different people at different times in different contexts for different purposes.

<comment><USER5> > Thought is more fluid; putting it into words concretizes it, collapses the > possibilities of the waveform. Somewhat, formalizes it.

That is a very good description.

I discussed this topic with a colleague recently, and we both agreed that putting thoughts into words takes conscious effort. Though I suspect that is not so for the majority of people, whose default mode of thinking is distinctly verbal, even when not talking or writing.

</comment></comment></comment></comment><comment><USER6> A great book on this is _My Stroke of Insight_ , written by a neuroscientist who had a massive left-hemisphere stroke. Her experience was horrific in many ways, absolutely beautiful in others.

She also has a TED talk: [https://www.ted.com/talks/jill_bolte_taylor_s_powerful_strok...](https://www.ted.com/talks/jill_bolte_taylor_s_powerful_stroke_of_insight?language=en)

<comment><USER7> I just watched that talk. Wow! She's a skilled public speaker; I felt her words as she was saying them. This talk inspired me to try meditating again. Thank you.

</comment></comment><comment><USER8> NPR Science ran a similar piece a while ago. The patient reported a stillness of mind that meditators seek to acheive. There was an immediate prsence in sensation, uncontaminated my thinking. This may be what pre-language children experience. Of course an accomplished meditator can turn this on and off, unlike an aphasia parient.

<comment><USER9> This sounds interesting - does anyone have a link? I searched but could not find it.

</comment></comment><comment><USER10> My favorite explanation of what the verbal stream-of-concsiousness does is from this paper: [http://www.jayhanson.org/_Biology/consciousness.pdf](http://www.jayhanson.org/_Biology/consciousness.pdf) titled "Conscious Thought Is for Facilitating Social and Cultural Interactions: How Mental Simulations Serve the Animal–Culture Interface"

</comment><comment><USER11> Thinking the Way Animals Do: Unique insights from a person with a singular understanding.

[http://www.grandin.com/references/thinking.animals.html](http://www.grandin.com/references/thinking.animals.html)

</comment><comment><USER12> Meanwhile, I'd love to get myself to shut the hell up once in a while. It might be really lovely to really have silence. Best I'm able to do is during a really long massage, maybe, I'll drift into a semi-conscious state. Or perhaps on certain medicines, a slight loss of identity (but not nearly enough to be silent internally.) Gonna try a 10-day vipassana course as that's supposed to help somewhat. Any suggestions?

<comment><USER13> You could give some binaural audio a try. I've found it useful for relaxing during the work day.

[https://www.youtube.com/watch?v=WFlPE6wPIfM](https://www.youtube.com/watch?v=WFlPE6wPIfM)

</comment></comment><comment><USER14> Or a train of thought is an epiphenomenon, and we don't have to speculate about secret languages. Fodor finds this unacceptable, but without serious argument.

[https://en.wikipedia.org/wiki/Epiphenomenalism](https://en.wikipedia.org/wiki/Epiphenomenalism)</comment>