Ask HN: Is it legal to attack your own honeypot if it's hosted on AWS? - <AUTHOR>

I'm a security researcher and digital forensics student.
I don't want myself or my colleagues/peers to get involved in any legal troubles when launching attacks against my own honeypot on AWS for testing purposes.
Has anyone got any experience with this? I see a lot of examples on the web of honeypots running on AWS but no legal discussion about launching attacks yourself. Does anyone know what Amazon's stance on this is?
Thanks in advance. <comment><USER2> If I were you, I would ask Amazon directly. In my experience companies are willing to speak candidly about what they do and do not allow with regards to penetration testing on their platforms.

For example, DigitalOcean has given me explicit permission to use their VPS's for authorized penetration testing and security auditing for clients.

Amazon in particular has a policy that requires written permission when testing AWS for both peripheral and direct auditing. This means that even if you're attacking a company hosted on AWS, you need Amazon's permission (as well as that company's), not just if you're attacking Amazon's AWS infrastructure directly. Now, you could say this means you've given yourself permission for attacking the honeypot, but you still need Amazon's permission for attacking AWS hosting the honeypot.

I am not a lawyer, but I am a security engineer, and I'd say this is likely fine in this particular scenario. However, I urge you to contact them directly or find an explicitly written public policy on the matter. Hacker News is not a good place to find a definitive answer on this.

</comment><comment><USER3> Define 'attack'.

Setting up vulnerable software on your VPS and then exploiting vulnerabilities on that software to allow you, the owner of the VPS, to get root access in a method you would otherwise be unable to, is fine.

Exploiting the VPS itself to exercise a bug in Xen/whatever to gain access to the hypervisor, access you would not originally be granted, is much less clear cut. Amazon has a bug-bounty program for EC2, and would very much like to hear about bugs you find in this space though.

[https://aws.amazon.com/security/vulnerability- reporting/](https://aws.amazon.com/security/vulnerability-reporting/)

<comment><AUTHOR> Definitely the former, not interested in attacking the hypervisor or AWS itself at all.

Just want to generate stuff to investigate in the honeypot.

<comment><USER4> Do not make it publicly available (e.g. put it behind a VPN). Otherwise someone might be faster than you to get root access and use your server for other illegal stuff (e.g. join a DDoS). You don't want that to happen as it could be considered you've been negligent.</comment></comment></comment>


Are project managers needed? - <AUTHOR> http://www.projectsherpa.com/blog/management-wants-to-know-are-you-done-yet/

<comment><USER2> It depends.

<comment><USER3> On what does it depend? Size or scope of the project?</comment></comment>


The next Agent Orange: why is our military making its soldiers sick? - <AUTHOR> http://www.theverge.com/2013/10/28/4771164/the-next-agent-orange-why-burn-pits-are-making-soldiers-sick <comment><USER2> thanks for posting this - had no idea this was going on...</comment>


California Based P2P Trader Convicted of Illegal Money Transmission - <AUTHOR> https://247cryptonews.com/california-based-p2p-trader-convicted-of-illegal-money-transmission/ <comment><USER2> The part about these convictions that bugs me is that some of the people getting in trouble were definitely not aware that they were breaking the law. It surprises a lot of people when they find out it's illegal to buy and sell bitcoin for cash to strangers in the US like this (that is, with no license or reporting or discrimination). I hope most of those convicted don't get jail time unless they truly knew that it may have been coming.

<comment><USER3> Ignorance of the law is not a defense, and this person had the resources to engage an attorney (at $300k/year of income).

<comment><USER4> I don't think they made that much. At 6-9 million in transfers, that would be a 10-15% commission, which feels quite high.

But maybe that is typical when doing illegal transactions.

<comment><USER5> 10-15% sounds reasonable. For example currently Bitcoin trades at $6325 on Coinbase, while cash offers on LocalBitcoins are at around $7000 per BTC.

</comment></comment></comment></comment><comment><USER6> Not sure how the bitcoin part is relevant. AFAIK it's not a currency even if it wants to be. So same problems and rules should apply to other trading as well.

What if he had been dealing cars instead of bitcoin? A guy comes in, buys a car in cash, drives away. You use the cash to buy more cars, wait for the next guy. You pocket the diff between how much you pay and how much you ask. How do you know the money isn't from a drug dealer? How do you know you're not engaging in illegal money transmission or receiving money from drug traficking?

I'd even say cars are _more widely_ accepted than bitcoin are.

Maybe bitcoin wasn't relevant but the article just failed to emphasize that point.

<comment><USER7> There exists a cottage industry of individuals acting as money changers for bitcoin and other cryptocurrencies. It can be quite lucrative. This is (was?) a gray market, but judgements like this show the government considers it a black market.

What's interesting to me is that they didn't simply nail her for buying and selling bitcoin without a money transmitters license. They also used the undercover agent to explicitly say it was drug money, ensuring worse penalties.

<comment><USER8> >What's interesting to me is that they didn't simply nail her for buying and selling bitcoin without a money transmitters license. They also used the undercover agent to explicitly say it was drug money, ensuring worse penalties.

Creating crime to catch crime is pretty par for the course in federal investigations. The FBI is pretty well known to do it in terrorism cases. The ATF runs their botched illegal gun buying operations that create local crime.

<comment><USER9> I wonder how often the cops get called on the FBI. I know that there was the post 9-11 clownish thing with an FBI informant in a mosque who got banned and reported to the FBI because he was a frothing radical that they wanted absolutely nothing to do with.

</comment></comment></comment></comment><comment><USER10> IMO Bitcoin is a commodity, not a currency. (Please do not downvote me for the opinion). Regulators and at least some judges have called it a commodity. e.g. [https://www.cnbc.com/2018/03/07/cryptocurrencies-like- bitcoi...](https://www.cnbc.com/2018/03/07/cryptocurrencies-like-bitcoin-are- commodities-us-judge-rules.html)

The charge shouldn't be related to currency trading, but something related to failure to pay taxes on buying and selling commodities.

[edit: As usual, comments on bitcoin expressing a non-evangelist point of view get downvoted.]

<comment><USER11> Tax it like property, enforce other laws like it's currency... they get to have their cake and eat it too. It's all for your protection, of course, don't you know.

<comment><USER12> What do you mean "tax it like property"? Property taxes are only for real estate. Income earned in USD is subject to income tax; capital gains earned speculating on the forex market are subject to capital gains taxes.

Both money transmitter and securities broker businesses require licensing. You can't sell AAPL to someone in a park for a duffel bag full of cash. They could have gotten her under either theory (currency or investment).

<comment><USER11> [https://www.irs.gov/newsroom/irs-virtual-currency- guidance](https://www.irs.gov/newsroom/irs-virtual-currency-guidance)

"IRS Virtual Currency Guidance: Virtual Currency Is Treated as Property for U.S. Federal Tax Purposes; General Rules for Property Transactions Apply"

</comment></comment></comment></comment><comment><USER13> Cajoling people to follow particular money handling standards and banking practices is an inappropriate use of the power to imprison people.

Anything short of outright fraud should be permitted in a free society. People shouldn't be expected to question their customers to find out where their funds came from, or be prosecuted because unbeknownst to them, a criminal used their services.

The modern regulatory system is draconian and unjust.

</comment><comment><USER14> Court docket here: [https://www.plainsite.org/dockets/38v97us7k/california- centr...](https://www.plainsite.org/dockets/38v97us7k/california-central- district-court/usa-v-tetley/)

<comment><USER15> Interestingly, most documents are sealed by the court.

</comment></comment><comment><USER16> Is this something she could have registered as a business properly to avoid this fate?

<comment><USER17> To do this type of business legally, you have to comply with both federal laws and state laws. The federal laws basically say you have to register with FinCEN and comply with anti-money laundering laws, which mostly means you have a duty to know who your customers are and why they're transacting with you, to refuse to do business with people who are obviously laundering money, and to report suspicious activity to FinCEN. It's reasonably doable to comply with federal law as an small operator. However, this person didn't just fail to register, she also knowingly facilitated money laundering, which is illegal even if you're registered.

What exactly you have to do to comply with state law varies dramatically. In some states buying and selling bitcoin is basically unregulated, and in others there are onerous registration/licensing and financial requirements that are basically impossible to fulfill as an individual. Off the top of my head I'm not sure where California falls on the spectrum.

<comment><USER12> Anonymity is the purpose of LocalBitocins. There is no reason to use it with licensed services; just transact with a regular exchange.

</comment></comment></comment><comment><USER18> You can run to anarcho-libertarian-utopian ideals, but you can't hide from the fact you still live under actual laws against such things, whether or not such laws are just.

<comment><USER19> If they really believe in their ideals, they should do the hard work to change the laws in their favor, or cleverly use already existing ones, instead of childishly isolating themselves from society and the government as outlaws.

There is a precedent for this: the 18th and 19th century religious communes -- some of them anarchist -- had popular support and were able to change US laws so that they could avoid taxes and live in peace as gated utopias in the way they wanted -- because they didn't antagonize the rest of society or the US government.

Or, put another way, they were anarchists that did politics maturely and succeeded (even though their utopias didn't).

<comment> xkcd-sucks Utopian societies in pre-20th century USA were typically located in isolated settlements. Armed conflict was typical unless it was a group specifically dedicated to nonviolent ideals. Cf. the "Mormon wars" and pro/anti abolitionist movements in Western territories

</comment></comment></comment><comment><USER20> localbitcoins.com has been on the radar of federal law enforcement for years. They routinely did (and maybe do) stings off the site to catch unlicensed traders. If I were the site's operators I'd be extremely wary of ever traveling to the United States.</comment>


Microsoft's Tay Is an Example of Bad Design - <AUTHOR> https://medium.com/@carolinesinders/microsoft-s-tay-is-an-example-of-bad-design-d4e65bb2569f#.2qvwrf49x <comment><USER2> My problem with articles like this is they talk about Tay like a "product" (article actually uses that term), though it was very clearly an "experiment". They now have data to work with, which was the goal, for developing the next version. And it's much easier to figure out how to filter this content based on actual communication with Tay than saying "these are the words I feel I need to blacklist" ahead of time.</comment>


Comcast to offer 2Gbps Internet - $300/month - <AUTHOR> http://arstechnica.com/business/2015/06/comcast-2gbps-fiber-to-launch-in-a-bunch-of-markets-this-month/

<comment><USER2> What's the point? They still have pretty low monthly bandwidth limits, right?</comment>


DuckDuckGo Watrcoolr, how does it work? - <AUTHOR> https://watrcoolr.duckduckgo.com/watrcoolr.js?o=json <comment><AUTHOR> I am just wondering if you someone could shed light on how this js/json application works?

I am trying to make something similar but can''t find how it was done and whether it is server side rendered or client side. etc.

Thanks in advance. JJ

</comment><comment><USER2> I just see json blob

<comment><AUTHOR> Yes, my question is how can you achieve the .js url to output different json blob depending on the url argument passed. E.g. The same url when passed the following argument returns the output of an article.

[https://watrcoolr.duckduckgo.com/watrcoolr.js?o=json&l=12023...](https://watrcoolr.duckduckgo.com/watrcoolr.js?o=json&l=120234)

<comment><USER3> This is a question for stackoverflow.com. Send me an email with what language you are working in, and I can point you in the right direction.

<comment><AUTHOR> Thanks mate.

I am trying to find out how I can send you an email but I am a bit lost here. Could you please help me how. Should I provide my email address through the comments area?</comment></comment></comment></comment>


Ask HN: Is there a chat service that allows Markdown? - <AUTHOR>

Maybe an extension that would allow Markdown in a service like HipChat. This would allow collaboration on code with the ability to give code examples that had syntax highlighting and code-block highlighting. <comment><USER2> I think Slack does this. I'm not sure if it does this out of the box.</comment>


Show HN: I built an Excel plugin for the SQL enthusiast - <AUTHOR> http://www.thingiequery.com <comment><AUTHOR> The project was initially a hobby but as of this month is my full time occupation.

So the plugin is called ThingieQuery, and it's basically for people who spend time in Excel and are familiar with SQL. The point is to make working in spreadsheets easier, possibly even enjoyable...somewhat.

The database engine that does all the heavy lifting is SQLite, it has access to Excel tables through an adapter layer I built, and it can also call VBA functions (you can call them from your SQL queries).

I'm particularly happy with my own SQL parser that I built for it. I use in the editor so it now understands SQL and can do all the things the big boy sql tools can:

\- pretty decent code completion (it's context sensitive in what it offers, offers keywords as well as identifiers, understands aliases, derived tables, common table expressions)

\- error detection (syntax errors, undefined symbols, some semantic errors)

\- function insights (shows function documentation and parameter info while typing)

\- SQL auto-formatting

\- a few other things (star expansion, symbol disambiguation, bracket matching, same reference symbol highlighting)

So anyway, take a look and ideally try it. Feedback is appreciated and most welcome.</comment>


Tell HN: Never share your ideas - <AUTHOR>

An idea I've been working on was recently posted to Hacker News and described in the same exact way.
It's an imitation, but for people who think sharing is going to make your idea better beware. It's a pretty obvious attempt to copy what I was doing and if they didn't describe it in the exact same way I wouldn't have thought much of it. Obviously, I talk too much.
Before you ask, no my project isn't finished. They're faster/better coders than I am. Yes, I'm an idiot for talking about it out loud in the first place.
Protesting and giving details would just give it more attention, so I'm content with this message. Shut up about your ideas and just work on them ---> giving this advice to myself. <comment><USER2> I disagree. You should be able to talk about your idea to get feedback and certainly to gauge any sort of possible market. Few ideas are truly unique, perhaps everyone else who had the same idea just didn't think there was a good enough market to be worth pursuing. Someone stealing my idea would be one possible positive indicator for me but I would still need to do a lot more market research.

If there is a decent market for your product / service, then there is likely room for multiple competitors. At that point, it's all about implementation rather than speed to market (though speed to market is still important for you because the faster you get the product built the faster you are able to start seeing money from your efforts.)

History backs this up with examples everywhere. Don't worry about people stealing your ideas.

</comment><comment><USER3> First mover advantage is mostly a myth, except in the very short term where it's trivially true. Even if whoever copied you had waited until you launched, if they are indeed "faster/better" than you, they'd catch up and overtake you soon enough. If your idea is good enough, competition is a fact of life you're just going to have to live with.

</comment><comment><USER4> I am someone who empathises with your situation.

However, look at it this way.

If it is such a great idea, chances are other people have already thought about it. To assume that you are the only person to have thought about something is just selfish and egotistical. Noone should have a monopoly on ideas.

If you were the only one with that idea, I'd say 80% of the time, it wasn't such a good idea in the first place.

If someone thought your idea was worth stealing, then I'd say that you should feel confident that your idea is a good one, steam ahead and speed to market.

<comment><AUTHOR> You're right about all of that.

But it's a different story when they use your own words to describe the concept of it. It was practically my pitch describing their website.

Few people come up with the same ideas using the same words. That's just not likely. Conceptualizing is not easy. There are a lot of different ways to describe Twitter and Quora. People describe things differently. I don't think it was random.

<comment><USER5> A lot can be done post-launch to differentiate, though. They might have a headstart, but you probably have more of the vision lurking in the wings, beyond whatever you've pitched to people.

</comment></comment></comment><comment><USER6> I loved stealing your idea, thanks! I also wrote you a song called "Will you be my Winklevoss tonight?" ;)

Ok kidding aside, I once felt like you, so I tested my phobia. I had another idea that I knew I wouldn't get to in this decade, great idea, but not for me to work on yet. So I gave it away, as far and loud as I could. Well first of all, no one "got it" right (lesson: sharing vision is a HARD thing to do), secondly two dudes tried to run with it and when they came out with the prototype I was surprised how they did almost everything I told them and more, yet it looked so different. Kind of like it was their own idea altogether. And finally, it took them 1 year to get 100 users! That was enough time for me to figure out what they did right/wrong and in between and beat them! Anyway, they went back to school, haven't heard from them. The site was up until recently, but is now gone.

My advice, let someone make mistakes for you at their dime. It's one thing if you're going after an established brand that has been around for years, and its completely another if you go after someone who just launched less than a year ago. They are in infancy, making tons of mistakes, which you can learn from. Here is an idea: look at a company launched less than 6 months ago and go copy them! ;)

</comment><comment><USER7> Perhaps you didn't talk to enough people all at once. Having a few people trusted by the community back you up and call out the weasel would probably stop this kind of thing cold. If you get a rep for poaching ideas and hogging credit in this community, you're done.

</comment><comment><USER8> The problem with this is your one idea could be your "wave" to success. Not to say there wont be any other great ideas but if you can create it first, regardless of competition its something for your resume that people respect. This wave could help fund an even better idea. I know HN is built on sharing ideas and I think thats great but unfortunately HN is not the world we live in. The world we live in is filled with thiefs and liars. Im in the same boat and I keep my startup right now pretty tight. I tell lots of people but only people I trust. Hope this helps

</comment><comment><USER9> Ideas are cheap, it is all about execution. A lot of hackers have so many ideas, that we can actually start blogging idea-a-day. I bet nobody would steal them, because everyone else have their own ideas. Unless your idea is validated, nobody will want to steal it.

But once you have cash rolling in, you will have tens if not hundreds of clones spawning up with in few weeks.

</comment><comment><USER10> I weighed the advice/secrecy tradeoff myself, and I figured I needed the advice more than I could benefit from secrecy. Never sharing your ideas just seems idiotic if you're a novice and you need input.

</comment><comment><USER11> On the positive side, if someone's copying you already then the idea must be good and worthwhile to work on. Converting the idea to a viable business is another matter completely and who knows, you might execute better than them. As they say, competition is a good thing.

</comment><comment><USER12> So now you get free market research by watching what happens with their site. What's the problem?

</comment><comment><USER13> I partially agree with the OP. It's easy to say _execution is everything_.

I have an honest question for you guys. I am working on a project that needs design help. I am a coder and could use a designer. The one I could afford and connect online is another programmer with decent design skills. (he has a decent portfolio).

My project is not rocket science but it has some novel elements to it. How do you make sure that someone you outsource it for few hundred bucks is not gonna steal your idea and launch it themselves? Especially when it is someone you've never met.

</comment><comment><USER14> Having an idea stolen sucks. I empathize with you. It's rough and I've gone through it with a business partner of sorts. It hurts to think that something you worked hard on and thought through is going to benefit someone else who doesn't deserve it. At the end of the day though, you can either man up and out code them or learn from it and move onto bigger and, hopefully, better things.

Additional thought:If you had followed your own advice as soon as you came up with it, your post wouldn't have ever been made.

</comment><comment><USER15> Be a sports,try to work on ur idea...let them market it first...learn from their mistake and compete...may be they r better coders but biz is more than coding..."steve jobs" was put out from his own company once....its not that bad really...

</comment><comment><USER16> You're not an idiot for talking about your idea, you're an idiot for not executing better/faster. At some point you have to launch, they could still out-execute you after that. First mover advantage is mostly a myth on the web.

<comment><AUTHOR> That still isn't a very good answer to the conventional wisdom of "Don't worry about telling people your ideas."

Tell people, then execute faster? If you're in stealth mode it wouldn't matter.

</comment></comment><comment><USER17> Business ideas are worthless.

Proof: Try and sell an idea.

If their implementation succeeds, they've done you a favour by doing the hard work and establishing a market. You can avoid their mistakes, build a better (or more niche, or prettier, or better marketed) implementation and profit.

If their implementation fails, they're done you a favour by either demonstrating that there isn't a market, or by highlighting fatal mistakes in their implementation.

</comment><comment><USER18> I'm with execution over ideas. Shutting up and hacking it before talking is a great point but isn't this simply mind over matter?

</comment><comment><USER19> Let's see your original post and their post.

</comment><comment><USER20> Be a faster/better coder than them.

</comment><comment><USER21> Actually, ideas don't matter, execution matter. If you're not executing, but only giving ideas away, be aware, someone will put the idea on execution and you'll never get cited on the app.

</comment><comment><USER22> Is your surname Winklevoss?

</comment><comment><USER23> There are over 250 million programmers in this internet connected world. Its not the idea its the fast execution that is unique. He or she copied the idea..so effing what? Make it unique by your execution!

<comment><USER24> 250 million programmers in the world? Isn't that kinda too much?

For those interested, here is one link on the subject: [http://programmers.stackexchange.com/questions/19720/where-c...](http://programmers.stackexchange.com/questions/19720/where- can-i-find-statistics-on-worldwide-developers-and-software- companies/20300#20300)</comment></comment>


Ask HN: Will self-employment sink my resume? - <AUTHOR>

Hi all,
I'm currently at a job that, like many posters plumbing the well of Ask HN for wisdom, I'm less than excited about. I exist in a limbo between developer and marketer, but usually write more than I code, and about subjects that don't interest me at that. I like my coworkers alright, but have been thinking more and more of going my own way. Although I'm a junior dev, there's really no one to learn from as no one in our IT department can code (all great people, just not much for me there) and the rest of our work (that I don't do) is contracted out to remote workers.
Right now I'm blessed to have insanely low expenses - a product of sharing an apartment in one of the cheaper neighborhoods of Austin and driving a beater. That, combined with some savings and what I know I can reliably pull freelancing, mean I'm more than confident I could cover all my expenses for the next 6+ months (if not indefinitely). I have tons of ideas, both for development and more writing/journalistic projects and have already started to draw a small monthly income for some of my work.
My question, for all the HR people and tech recruiters out there: Will this sink my employability long-term? Although I think it's bullshit, I could see some future recruiter looking at my resume and thinking I'm too much of a bleeding-heart, anti-establishment type (which wouldn't be far off) and not worth the risk. Truthfully, the greater autonomy is why it appeals to me so much.
And if I do get dinged, is there anything I could do to lessen the pain? I'm active on Github and plan to OS some of my projects. What else can I do? I blog and try to do all that jazz when I can. <comment><USER2> I'm probably not the best person to answer this question, but I do some experienced hiring into technology and business fields, and a fair amount of recruiting overall. YMMV.

Two main points:

1\. Don't worry about your resume too much. You're probably not going to get your next "real" job off your resume alone, so your accomplishments, projects, relationships are going to be more important _anyway_.

2\. As in any position, you have to clearly and concisely show what you did and the impact you had. That's almost easier to do as a freelanced because _you did it all_. There's value in that: it's just at a different scale than a larger business. I'd wonder if doing something simple like incorporating your freelance business (so it shows up as "Buzzword Consulting" and not "Self- Employed" on your resume) might yield a stronger emotional response. ("He owned a business!")

<comment><AUTHOR> Thank you especially for that second point. I've only been thinking about incorporating from a financial perspective (from what I can tell, it seems to be clearly worth it if you're in a product business handling money, but maybe less so if you're just a freelancer).

I hadn't thought about it as looking better, and more polished, from an HR- point of view. Great insight.

</comment></comment><comment><USER3> Hands up, real quick, everyone who would NOT like to hire a reasonably competent developer, who actually understands what marketing is asking for, and is capable of coming up with a satisfactory solution & deploying that solution in time for it to actually help with the goal marketing needed it for.

You might end up bouncing off a few more HR firewalls, but those are mostly not the places you would be happy working anyway. Your goal in finding new gigs is mostly to bypass HR until they've been given an instruction to walk you through your hiring paperwork.

</comment><comment><USER4> hiring manager here. Someone who is successful as a freelancer for several years with demonstrable accomplishments always catches my attention.

the details of what projects you took, and why matters a lot though.

For example, don't be the freelancer who ends up doing a bunch of drupal customization and payment gateway integration if you want to be a developer in the future. Do projects that are going to make sense in a portfolio.

</comment><comment><USER5> I'm not the most qualified to answer, but let's say you do freelance for a while, then decide to look for a job again and you see that your resume plays against you. Then, could you say that you were employed in a consulting firm and mention all the contracts you did? That would still be the truth, the only thing you don't mention is that you were the owner of that consulting firm.

</comment><comment> Warewolf-ESB If you are contributing to OS projects like you say you are, and managing to do a variety of freelance work for an extended period of time (min 1 year) it looks good. I would not recommend freelancing for a few months then trying work - it could make you look a bit lame. But if you can sustain it and show all your activity on GitHub it can work in your favor. Good luck!</comment>


Are there any guides to using social media - <AUTHOR> I guess I must be some kind of misanthrope.  HN is the only social medium I use.  I don't really understand social media.  I need to promote my side-project using social media.  Can you recommend any books or websites that would help me understand? <comment><USER2> These twitter tips I assembled for MAKE magazine might be helpful.

[https://makezine.com/2014/02/14/how-to-follow-smart- people-o...](https://makezine.com/2014/02/14/how-to-follow-smart-people-on- twitter/)

Accompanying screencast video - [https://www.youtube.com/watch?v=sZUw53DiFAs](https://www.youtube.com/watch?v=sZUw53DiFAs)

</comment><comment><USER3> "Let's be careful out there." This line is spoken by Sergeant Phil Esterhaus, played by Michael Conrad, in the TV show Hill Street Blues (1981-1987).

Why not stand outside the bars and watch, before entering?

</comment><comment><USER4> maybe Holloway guide to twitter?</comment>


Ask HN: Why don't you plant a Giant Sequoia today? - <AUTHOR> One giant sequoia can store a lifetime of carbon emissions. For $7 at amazon you can order a live tree seedling and plant it today.
The General Sherman removed 1438.892 metric tons of carbon dioxide from the air. Divided by the American yearly CO2 footprint of  16.6 metric tons ,we get 86.7 years of CO2 sequestered in a single tree!
The giant sequoia grows 4 feet (1.2 m) in height or more per year Given excellent conditions the growth rings could approach 2 inch (5.1 cm) doubling the 100-year total to 34 feet (10m) in trunk diameter.
This is an idea to seed a new forest full of giants up to a length 275 feet (86 m) high. A forest that grows across the world and is going to live there for thousands of years. Who wouldn't want to grow up near a forest like the Sequoia National Park in America?
https://dewharvest.com/carbon-dioxide-stored-by-general-sherman-giant-sequoia.html
https://en.m.wikipedia.org/wiki/Sequoiadendron_giganteumI <comment><USER2> [https://news.ycombinator.com/item?id=20594207](https://news.ycombinator.com/item?id=20594207)

A previous discussion on the empress tree. More climate options for growing. The top comment on the thread:

> So basically each american would have to cultivate about 0.196 acre of > empress trees (792 sq meters, or 8522 sq foot) to become carbon neutral.

For me, I'm looking into where I could put some.

<comment><USER3> I'm very torn with this. Empress trees are invasive.

</comment></comment><comment><USER4> > The General Sherman removed 1438.892 metric tons of carbon dioxide from the > air. Divided by the American yearly CO2 footprint of 16.6 metric tons ,we > get 86.7 years of CO2 sequestered in a single tree!

Although it took around 2500 years to do so. If your calculations are right, the American should presumably plant 30 of these trees rather than one in order to have a more real-time impact. This is also assuming that each tree planted will follow something like the growth trajectory of the largest tree in the world.

I'm also not sure that this calculation is right, for example because using the approximate mass of the tree as the amount of CO₂ fixed by the tree neglects the contribution of the H₂O that was also an ingredient for the tree's cellulose content.

(I fully support people planting sequoia trees, though!)

</comment><comment><USER5> Hope these two articles help with:

[https://www.airqualitynews.com/2018/07/30/plants-and- trees-n...](https://www.airqualitynews.com/2018/07/30/plants-and-trees-not- the-solution-to-air-pollution-in-cities/)

[https://www.goodnewsnetwork.org/how-many-trees-to-plant- to-s...](https://www.goodnewsnetwork.org/how-many-trees-to-plant-to-stop- climate-crisis/#.XStF79lYYa0.linkedin)

Indeed the tree and where we plant them is important

And today when some countries like Switzerland have carbon capture technologies why more trees which needs more watter?

</comment><comment><USER6> For the host of reasons listed in other comments (and others too), it will never pass that everyone plants a giant sequoia. This means the "ideal" proposed solution is not possible.

Therefore, why not aim for a more realistic goal: 1\. plant trees in vacant spaces (such as highway medians), any kind of tree 2\. Plant 1 extra tree instead of more lawn in your yard.

I'd guess these goals are more attainable and though would not offer a full solution, would be better than no option.

</comment><comment><USER7> I love trees, well most trees, not a fan of pine trees, as they seem to plant those everywhere ....

So after the tree grows, and captures the carbon, then what? Do you let it die, rot and release its carbon?

If carbon is the problem, because the earths total carbon is pretty much constant, then is not the problem how to get rid of carbon, or at least keep it in a captive state?

All the carbon, was captured in the ground as oil. Why not put carbon back in the empty oil wells? As in yard waste?

</comment><comment><USER8> I'd love a sequoia forest, but:

Not suitable for my climate.

Planting trees isn't the problem - the challenge is having them live to maturity.

Bigger trees store more carbon more rapidly, as they perform more photosynthesis ([https://journals.plos.org/plosone/article?id=10.1371/journal...](https://journals.plos.org/plosone/article?id=10.1371/journal.pone.0181187)) so work to preserve existing big trees.

</comment><comment><USER9> Where are you going to plant these millions of trees? What existing land suitable for sequoia growth is not currently full of sequoias? If that land is suitable, but not forested, why? If it's being used for something else, what are you going to displace?

Like many feel-good solutions to major issues, there are a host of reasons why they're not already happening or why they wouldn't actually solve the problem.

</comment><comment><USER10> Can you link the amazon listing?</comment>


Five reasons why Ruby made sense for our highly concurrent app (SuperIMAP) - <AUTHOR> https://github.com/rustyio/super-imap#why-ruby <comment><USER2> Great post, very interesting. I am not a seasoned engineer like the OP but I do like my Python and without having to learn the hard way, I have the same conclusions laid out here. It's easy to get excited (I'm very interested in Erlang myself), but there's a lot of practical matters.

I was left wondering, it was noted that 3 servers are used and another language may only utilize 1. If Python was used, you could use PyPy and possibly keep a "commodity language" like Ruby but get to keep it possibly with the performance boost. I use PyPy for everything.</comment>


Ask YC: Sign of the Times - An Advertisement Preloading a Lightbox - <AUTHOR>

Is it just me, or is it a horrible sign of the times that when reading an article, I clicked a thumbnail to a software screenshot, only to be greeted by an advevrtisement and the text "please wait while we load your picture"
I had to wait, to see a fullsize screenshot just so the site owner could show me a completely irrelevant advertisement.
Don't get me wrong, I know the power of ads and their place when it comes to supporting your blogs or whatever, but I think this is pushing it.  Advertisers still don't seem to have gotten the point of how to market their services without completely ruining user experience.
Thoughts? <comment><USER2> What, just because we have a new way to communicate, you think there will no longer be idiots, greedy sons, and people with bad taste? :)

To scale, one usually must decouple components. To scale traditional advertising they decouple the interests of the advertiser, publisher, creator and audience. The most efficient (ie most profitable and easiest to create) advertising regime is one that crams a volume of ads just below the endurance of a large percentage of the audience.

Just below.

The _particular coefficients_ in the formula may be different now that there are more alternatives, but the _formula itself_ has not changed. There may be better _regimes_ but creating them takes above-average smarts and effort.</comment>


The Apologies of Zuckerberg: A Restrospective - <AUTHOR> https://allthingsd.com/20111129/the-apologies-of-zuckerberg-a-retrospective/ <comment><USER2> It baffles me how Zuckerberg can remain disdainful of our very consistent feelings toward privacy, while arrogantly suggesting that he knows better. It doesn't take a privacy law scholar, an Internet security expert, or someone with a 150 IQ to realize that there's something _profoundly different_ about socializing online.

More specifically, the presence of an all-knowing middleman/service undermines trust; no matter what, we will never trust Facebook as much as the members for whom we maintain a profile. Facebook wants us to completely open our private lives to a corporation notorious for its lack of transparency and openness. Facebook is entirely self-serving, as evidenced by its metastasis into even more of our lives. Masquerading as a selfless company innocently trying to connect people, Facebook continues to shove invidious technologies down our throats for one reason only: $$$.

That said, I truly hope that its FTC settlement portends a turning point for the social web.

<comment><USER3> _It baffles me how Zuckerberg can remain disdainful of our very consistent feelings toward privacy, while arrogantly suggesting that he knows better._

Facebook's popularity suggests that Zuckerberg does know better. I have yet to be convinced that the average Facebook user cares about abstract privacy at all, let alone as much as we tend to.

I can't just dismiss all the complaints and protests from Facebook users, of course, but I do have to wonder what proportion of it is simply people not liking change, rather than actual privacy concerns.

<comment><USER4> I think the vast majority of Facebook users aren't reading tech news and likely haven't heard about a lot of the privacy changes in Facebook. It's also likely that for most people the decreased privacy did not cause any practical problems. The users that have been burned by Facebook's privacy changes though are definitely complaining. The ones that aren't complaining probably haven't been burned. Yet.

</comment></comment></comment><comment><USER5> I remember when zuckerberg called users of facebook "dumb fucks" for trusting him

[http://gawker.com/5636765/facebook-ceo-admits-to-calling- use...](http://gawker.com/5636765/facebook-ceo-admits-to-calling-users-dumb- fucks)

those words will haunt the world some day

<comment><USER6> Whenever I think about Facebook and the vast number of people using it, that quote is all I can remember.

Are people too dumb to care about their own privacy or do they just not care?

<comment><USER7> I use Facebook constantly, posting photos, checkins, status updates, etc. However, I've completely disabled all privacy controls. Why? Because I don't put things on the Internet that I don't want to be public, even behind 'privacy controls'. There's no breech of privacy for me, because the data is inherently public. So no, I don't care.

<comment><USER8> When I was growing up, I was always told never to put your real information on the Internet. As I grew older, I simply changed around my "real" details a bit. So, my Facebook does not have my real identity, I like stuff that... I don't like.

Like I've said before, if you don't want people to know, don't post it on the Internet.

Funny thing is though, the people that told me not to put info up on the 'net... didn't listen to their own advice. lol

<comment><USER9> well you can put fake info about yourself but doesn't mean your friends will put fake info in for you. Also, I'm sure marketers have a special category for people who lie about their age and name and have products ready to sell to that group. There is no escape. ;p

</comment></comment></comment></comment></comment><comment><USER10> "I'm sorry, baby. I promise I won't hit you again."

</comment><comment><USER11> I still remember reading how Zuckerberg lied to a competitor he was working with when Facebook first started and later even hacked it.

<comment><USER12> He also used a Facebook user's credentials to hack into her (?) email account.

</comment></comment><comment><USER13> Fool me once, shame on you. Fool me twice...

</comment><comment><USER14> Come on, the organization made an average of 2 mistakes per year. How many other decisions did they get right? Thousands.

<comment><USER15> I totally enjoy how the only other dissenting opinions in this thread are being downvoted with no explanation.

<comment> steve-howard I think the issue is that Facebook makes _the same_ mistake repeatedly, indicating that it's not even close to a mistake. It does something its users don't like (erodes privacy, design changes, automated sharing, etc), claims it's good for them, then partially backs off.

</comment></comment></comment><comment><USER16> Listening to Mark speak right now at Stanford. Someone asked him a question about privacy. He genuinely seems like a not-evil person.</comment>


The great Verizon FiOS ripoff - <AUTHOR> http://www.niemanwatchdog.org/index.cfm?fuseaction=background.view&backgroundid=631

<comment><USER2> With wireless speeds approaching the speeds of most wired carriers this makes sense. Build for the future vs putting a huge investment into a plant that isn't really scalable.</comment>


YIMBY Hackathon - <AUTHOR> https://yimbyaction.org/hackathon/ <comment><USER2> More information on the group hosting the hackathon:

[https://yimbyaction.org/about/](https://yimbyaction.org/about/)

It looks like its intended to work on anti-NIMBY (Not In My BackYard) solutions; So YIMBY stands for "Yes In My Backyard"</comment>


A simpler, faster way to use Hangouts on your desktop - <AUTHOR> http://chrome.blogspot.com/2014/10/a-simpler-faster-way-to-use-hangouts-on.html <comment><USER2> I'm on OSX.

Occasionally when you click back to focus Chrome, your focus stays in Hangouts, then you can't use Chrome's keyboard shortcuts, as you are in Hangouts instead.

Otherwise, hopefully this works better than the old extension - when starting Chrome it kept not logging in without being disabled then renabled.

Also, why the big white box on start - couldn't that be the contact list?

<comment><USER3> I'm also on OSX.

I'm getting the focus issue as well (I get it sometimes with the old extension, but much more with this new one).

Also, there seems to be no notification at all when someone messages you. That makes it fairly useless as an IM app. At least it doesn't pop a full conversation up in front of you like the old extension did.

It also doesn't seem to support multiple accounts (the old one didn't, either).

</comment></comment><comment><USER4> Why does this software feel so horribly unpolished?

This new version doesn't even work at all when you've set the chrome zoom standard to anything other than 100%.

We use Hangouts for team communication a lot, but the chrome extension is so unstable and has weird issues that we joke that it must have been built "by the best interns money can buy".

Sadly, besides Facebook Messenger, its the best cross device chat platform that isn't Hipchat and works with most of our clients that use Apps for Business.

</comment><comment><USER5> Nothing against Chrome extensions, but I have yet to see an messaging application that competes with Pidgin. It's simple, beautiful, and perfect at what it does.

Unfortunately, Google doesn't permit Pidgin to use its current protocols. So while XMPP still works great for one-on-one chat, my group messages relegated to the Hangouts app. (As are video and voice, but that's much more understandable.) Which is odd, since XMPP supports multi-user chat.

I really like Hangouts for video chats, but I wish they'd allow me to outsource all text-based messaging to Pidgin. It's just a more elegant solution... and Google would still reap all the advertising information they can glean from my messages anyway.

</comment><comment><USER6> I'm on windows, and It's terrible! I preferred the extension much more.

I have this terrible floating icon in the middle of my screen. It's as ugly as Facebook Messenger on Android.

In the settings you can disable "Always on top". But then it requires you 2 clicks to open the Hangouts app. One click on the Windows taskbar, and then one on the icon when it appears.

Stupid developers! How about keeping the OS the way it meant to be used, with the tasks inside the taskbar. Not floating windows everywhere.

</comment><comment><USER7> Is there any way to have this auto-hide in some way?

</comment><comment><USER8> alt-tab on osx closes current chat so you have to click it again, counterproductive, deleting/not using until its fixed.</comment>


Testing is overrated? - <AUTHOR> http://railspikes.com/2008/7/11/testing-is-overrated

<comment><USER2> Interesting. To me Quality = Adherence to Spec. If the software matches the spec perfectly, then then quality is 100%. Users can eat it as far as I'm concerned. If something is written according to spec, then it is a quality product, "usability" be damned. Just my personal opinion. :-)

<comment><USER3> Not sure I'd want to use your software, Allocator2008!

I'd say that this is wrong for two reasons. I think you're right that adherence to spec is important (if the spec says "Send an email" and the app doesn't, then something is wrong). But:

1\. Within spec adherence, there is still good code and bad code. Is the code maintainable, understandable, secure? And was it written efficiently?

2\. Sometimes the spec is wrong. Documentation isn't infallible, and software should change based on users' needs.</comment></comment>


Cool your macbook by placing copper coins on it - <AUTHOR> http://wonderfulengineering.com/is-your-computer-overheating-a-lot-you-can-solve-it-by-stacking-copper-coins/ <comment><USER2> Cooling a MacBook like this seems inconvenient, but it certainly works.

However the second picture in the article - where someone is using copper coins on an internal computer component - is utterly stupid and dangerous. Copper is one of the best conductors. If one of those coins falls onto the mainboard it could easily short out something. In the best case you break your mainboard, in the worst you start a fire.

<comment><USER3> I was thinking about how convenient pennies would be an imagining a "Cool Your Macbook for Thirty-Nine Cents". Then I remembered US pennies ain't copper.</comment></comment>


Pilot of Django Fellowship Program: A Retrospective - <AUTHOR> https://www.djangoproject.com/weblog/2015/jan/21/django-fellowship-retrospective/

<comment><USER2> That's lot of work done to maintain open source project.

There were recent threads why maintainers bundle crapware to support themselves.

Companies (and we individual users) should definitely support this kind of initiative to maintain healthy community [https://www.djangoproject.com/fundraising/](https://www.djangoproject.com/fundraising/)</comment>


Is pman down? - <AUTHOR>

can anyone install the pman package from pear or did it just disappear? please help...<p>sudo pear install doc.php.net/pman <comment><USER2> Maybe you should try IRC...</comment>


Ubuntu is switching the default search from Google to Yahoo - <AUTHOR> http://popey.com/blog/2010/01/26/yahoobuntu/

<comment><USER2> Hm. A linux distro subsidized by Microsoft? Yahoo is just bing now, after all.

</comment><comment><USER3> Who cares. Anyone using Ubuntu is smart enough to switch the default browser themselves. It's the cattle that use Windows that are the problem.</comment>


A flexible and extensible calendar for android - p-v https://github.com/p-v/FlexibleCalendar

<comment> p-v FlexibleCalendar for android, now has the feature to change the cell background for three different states, i.e. day today, day selected and day regular. Stay tuned, more to come.</comment>


When Dirac meets frustrated magnetism - <AUTHOR> https://phys.org/news/2020-07-dirac-frustrated-magnetism.html <comment><AUTHOR> >Giant, unconventional anomalous Hall effect in the metallic frustrated magnet candidate, KV3Sb5

[https://advances.sciencemag.org/content/6/31/eabb6003](https://advances.sciencemag.org/content/6/31/eabb6003)</comment>


Craig Silverstein, Google Employee #1, Leaving for Khan Academy - <AUTHOR> http://allthingsd.com/20120209/googles-very-first-employee-craig-silverstein-technically-no-3-leaving/ <comment><USER2> I'll mention that we're still hiring for both full-timers and interns. Here's the job post:

Our mission is to provide a world-class education to anyone, anywhere. We already have millions of students learning every month, and we're growing quickly.

Our students answer over 2 million math exercise problems per day, all generated by our open source exercise generation framework (<http://github.com/khan/khan-exercises>, <http://ejohn.org/blog/khan- exercise-rewrite/>), and Sal's videos have been viewed over 117 million times. We're just getting started feeding this data we're collecting back into the product to help our users learn more (<http://david-hu.com/2011/11/02/how- khan-academy-is-using-mac...>). If you're interested in data, analytics, and education, this is a dream gig.

Plus, it's one of the highest educational impact positions you can imagine. We're hiring all types of devs -- mobile, frontend, backend, whatever you want to call yourself. Big plans ahead.

<http://www.khanacademy.org/jobs>

<comment><USER3> I'll just add that even though the job ad isn't up yet, we're specifically looking for you quantitative big data folk.

Apply through the ordinary software developer position for now -- but we're hunting for some passionate data engineers to do more stuff like this: [http://david-hu.com/2011/11/02/how-khan-academy-is-using- mac...](http://david-hu.com/2011/11/02/how-khan-academy-is-using-machine- learning-to-assess-student-mastery.html)

<comment><USER4> can some of KA data be made available for 3rd party analysis?

<comment><USER3> We've thought about it, need someone to go through and properly anonymize everything, etc -- not at the moment.

</comment></comment></comment></comment><comment><USER5> I wonder when they'll start hiring, well, _educators_. While engineering challenges may exist, Khan Academy's biggest scaling problem seems to be Khan's ability to produce solid content. His biology stuff, for instance, is decidedly worse than the mathematics.

Other than that: great move.

<comment><AUTHOR> Do they need to actually hire educators? I understand that it would raise the level of knowledge but if I remember correctly from the last Google Hangout Khan said that they are currently working on a platform to make it easier for anyone to add things to KhanAcademy without having to do github pull requests.

<comment><USER6> Yes, they should. However, I think they should hire doctors of education in the same way they're hiring engineers: the engineers are creating the technical infrastructure to deliver lessons, and the educators should be creating the pedagogical standards and informing the engineers about what kinds of tools to create.

<comment><USER7> A doctorate in education is of dubious worth. As an academic field education research doesn't yet have the tools of structures to answer interesting questions. In place of rigorous theories there is currently a swamp of poorly verified or unverifiable notions.

Hire teachers, hire experts, hire anyone who either has deep knowledge or experience transferring knowledge. Hopefully both. A doctorate in education, alone, provides neither.

(this comment brought to you by small sample size interactions with real-life Ed.D. dunces)

<comment><USER8> The most exciting thing about being involved with software development is that it is a practical discipline that has both scientific testing (A/B, unit tests), and fast evolution that is discovering successful organisational structures and working processes.

Education seems to test the wrong things (knowledge, ability at tests, not practical nor personal skills), and changes at glacial speeds (conservative, and aiming for politically motivated outcomes).

</comment></comment></comment></comment></comment><comment><USER9> Craig Silverstein is someone I've had the distinct pleasure of interacting with one several opportunities over the years. More important than being Google employee #1 is that he's THE Google open source person. He's always involved in Google Summer of Code and personally maintains a number of very cool open source projects on Google Code.

I wish him the best!

<comment><USER10> I'd like to second this opinion. I've had the pleasure of reading and using a lot of his code in the form of the sparsehash, ctemplate and tcmalloc projects and I know for a fact that my own projects would have been a lot harder to write and test without this code.

He's a top notch open source advocate and a great encourager of contributions from non-Google employees, so hat's off and all the best at Khan Academy!

</comment></comment><comment><USER11> Do you want to sell advertising the rest of your life, or do you want to come with me and change the world of education?

<comment><USER12> If he's the first employee, doesn't that mean he helped create the Google search engine, and thus _changed the world_? I think that's a lot closer to the truth than what you're implying. I don't think Google started worrying about advertising until years later.

<comment><USER13> I'd be interested in trying to figure out just how much Google Search changed the Internet, and by extension the world. How different would the Internet look if we were all still using AltaVista? Certainly it would be difficult for quality content to find viewers, as everyone used to pad their articles with thousands of keywords to jack up their rankings. What else would be different?

Google's been a great boon for the Internet, but i'm curious just how much Search changed things, on its own.

<comment><USER14> Websites would probably be stuck with "pay for inclusion" and all the other nastiness of the early days of search. Google also labeled our ads clearly; the FTC had to warn ~8 other search engines not to label paid results as "partner" listings and similar things. We also took a stand against pop-up ads in the early days when many other major search engines were doing pop-ups on their site. Not to mention that search engine spam was pretty bad in those days.

Certainly I'm glad that Google disclosed DMCA complaints (instead of dropping them, which every other major search engine did), push backed on overly broad DOJ subpoenas that tried to get 2 months of user queries, worked hard not to partner with scumware/malware companies, helped to push back on things like SOPA, and launched a transparency report to shine a light on government requests to take down information around the world.

Google has also been a major proponent of open source (e.g. Summer of Code, Android, Chromium), not to mention espousing principles like data liberation: <http://www.dataliberation.org/> . Overall, I think the web would have been quite a bit worse without Google: slower, less organized, more closed, and definitely spammier.

</comment></comment></comment></comment><comment><USER15> I am going to make a wild prediction right now. Taking into account that 2012 seems to be the year of the "legit" free online schools. I am going to predict that within 5 years a person will be able to get a high-school or college degree (possibly accredited) from Khan Academy...and it will be recognized as legit by peers and employers alike.

<comment><USER16> I hope they don't try for traditional accreditation.

<comment><USER17> Why not? I would hope for some sort of certification program.

<comment><USER16> To me, Khan Academy represents a break from the traditional educational model. I would rather they focus on innovating than proving themselves as being just like every other school.

</comment></comment></comment></comment><comment><USER18> Is this another sign that the new sought-after perk is meaningful work? The time of beer and ping-pong tables maybe coming to an end?

<comment><USER19> I sort of see this as the natural progression of people's careers

<comment><USER18> Totally - if the supply of talent becomes more: productive / wide applicable / sought-after - it only makes sense that they'll move up Maslow's Hierarchy into the highest fulfillment: meaning itself.

</comment></comment></comment><comment><USER20> Absolutely amazing for the edtech space to see high profile, tech elite join the industry.

</comment><comment><USER21> Wow, First John resig and then This, salman Khan must have some great charisma

<comment><USER22> I think it is more the desire to have an impact. Seriously as you get older and interact with more and more people you see the choices and opportunities that lead them to the current space-time co-ordinates. And you get a little bit sad sometimes that folks who could have been great have become de-railed due to some addressable issue into crime, or poverty, or drug addiction.

It is hard to sit at a company working really hard to fill jobs and to listen to all the folks who are out of work but not qualified for your jobs. Its hard to listen to the stories of good, decent people who work hard and are certainly capable, unable to break the chains of poverty because they can't both get an education and stay off the streets. Its hard to listen to young people, now young adults, who suddenly realize that it wasn't learning they hated it was the school and now they are trying to make it as adults without a solid foundation.

KA is has three things going for it, the founder is passionate about the cause (so its not going to sell itself suddenly), the technological sub-pieces have finally come into existence across a critical mass, the availability of 'self funded' (which is to say folks who no longer have to work if they don't want to) individuals to volunteer efforts for it.

So being remembered for lifting some fraction of the world (no matter how small) out of poverty by providing educational opportunities, or being remembered as someone who worked at one of the companies that formed the Web as we know it. Easy choice.

</comment></comment><comment><USER23> I hope they can make learning biology, calculus and programming as hours- consuming addictive as modern first person shooters are to teenagers.</comment>


TikTok sent US user data to China, lawsuit claims - <AUTHOR> https://www.bbc.com/news/business-50640110 <comment><USER2> And how different is it when US companies like Facebook and Google send Chinese user data to the US?

Ridiculous media and legal beat-up. Mountains out of mole-hills. "Sauce for the goose is sauce for the gander." Etc, etc.</comment>


Microsoft creates Kinect-like system using your laptop speaker & microphone - <AUTHOR> http://www.extremetech.com/computing/128735-microsoft-creates-kinect-like-system-using-your-laptops-built-in-speaker-microphone <comment><USER2> If you would like to avoid extremetech, go directly to the source: [http://research.microsoft.com/en- us/um/redmond/groups/cue/so...](http://research.microsoft.com/en- us/um/redmond/groups/cue/soundwave/)

</comment><comment><USER3> > The Doppler effect, if you remember high school physics, is where the > frequency of a sound alters depending on your distance from it [...]

Wat!? Is there no hope for science reporting?

<comment><USER4> There's no history for any reporting. It's always someone whose speciality is anything but the subject they're reporting on, because their speciality is journalism.

This is likely written by a guy who wanted to be a journalist, and liked all those gadgets he got to play with so when he couldn't get hired at a real journalism job, he went to a job he thought he'd get to report on all those cool gadgets and toys he loves, but the pay is utter shit (as most journalism jobs are) so he doesn't have time to fact check his own work. He's not at a major publication so it doesn't get read by an actual fact checker. And the editor likely gives it a 30 second look for any glaring formatting errors and rubber stamps it.

</comment></comment><comment><USER5> While I can't hear above 16KHz, lots of people can hear up to 20KHz without any trouble. To them this would sound like the highest pitch ringing you could imagine. And don't let any dogs in the room, this would be a continuous dog whistle to them. Very annoying.

<comment><USER6> Yeah, I would have a real problem with this. I can't be around those sonic rodent repellers or anything similar.

<comment><USER4> The ironic thing is I can hear those sonic rodent repellers at the very top of my hearing range, yet my dogs are completely not bothered by it. Neither are my friends dogs, one actually goes and sleeps by the one in my living room (I don't believe the devices work, but I have yet to have a reason to bend down and remove it since I moved in).

</comment></comment></comment><comment><USER7> Sounds pretty neat but I find it hard to be excited since the times I've used Kinect itself, it was actually pretty annoying.

Perhaps it was the setup or something about the room, but I found the response rate slow and the accuracy terrible.

Though maybe combining the two approaches would improve the experience for more conditions and situations.

<comment><USER8> I agree with this, but it seems to be a software issue in the games themselves. When I view the little stick figure version of me during calibration, that tracks my movements extremely well. So I would expect the games to get better and better as the devs iterate.

Side-note: I really need higher ceilings in my family room. I nearly knocked myself out jumping into the ceiling once. Once.

</comment></comment><comment><USER9> This kind of little speaker-microphone 'sonar' is the kind of project we would give to undergraduate students as an afternoon practical. It's simple stuff to get going. The real magic that would make this useful is the signal processing and tracking algorithms which turn the extremely inaccurate raw data into something that provides a good user experience.

A few kHz (the gap between what the speakers can do and human hearing) isn't much bandwidth, so this system is going to be highly affected by the tradeoff between range accuracy and Doppler accuracy. If they are attempting to do bistatic (two transmitters) tricks to derive spatial position, then this information will be similarly inaccurate.

<comment><USER10> I would imagine that most of the real magic will lie in making it work, and work well, as an input method - the video makes it look painfully awkward to use. Even Kinect which works relatively precisely is extremely annoying for anything else than kicking balls around on a screen. Even without interruptions like your children walking in front of the TV, getting Kinect to register an interaction correctly is a process of carefully performing some strange gesture like a wizard executing a spell while on LSD, and then doing it 5 more times until Kinect deems it precise enough. Personally I don't imagine this becoming more precise in the near future than to be useful for perhaps turning pages on a reader or tablet.

</comment></comment><comment><USER11> It looks like this system has absolutely no idea in which direction your hand is moving. Just the speed towards the mic.

Note how they do tetris by fast and slow tapping, and use tapping to reverse the scroll direction.

</comment><comment><USER12> interesting attempt with mic, but wouldnt it be easier to make the kinect cheaper and smaller and embed it in computers or sell it as a smaller unit?

<comment><USER13> Yeah, this looks like a step back. I remember reading about Win8 and how its going to integrated with Kinect and how OEMs like Lenovo were already building "Kinect lites" that could fit in a laptop. I wonder what happened to that.

Everything about Kinect on PC is a bit underwhelming. I really don't want to wave at the thing a few inches from me, but I'd love to have it be able to track my eyeballs and be able to click or run macros via lifting fingers, blinking, or moving my jaw. We may be a year or two away from some really exotic UIs.

Kinect for media center looks pretty promising. I have a windows mediapc running windows 7 and am tempted to buy the PC version of the kinect just to control everything via gestures.

<comment><USER14> I wouldn't call it a step back. That sounds rather pessimistic. It looks like an experiment, like many great things that come out of Microsoft's research.

The Computer Vision field has certainly gotten far with head-tracking and object recognition.

With a bunch of relatively simple code, you can have a piece of software that tracks your jaw and blinking gestures with a cheap webcam and run whatever macros you choose.

I'm not sure about eyeball following, it depends on the camera's resolution and how much you train the program.

I have myself experimented with head-tracking to replace mouse-look in FPS games. It is very fun to try, save for an eventual headache in Quake 3's Q3DM17 :)

Now, these kinds of experiments are not for the average consumer, but they have been simplified so much over the last few years that the amount of excuses for not trying it out is decreasing.

<comment><USER15> Could you please provide a little more detail; specifically the "blink gestures"? What libraries, any papers and/or online tutorials? A quick DDG search turned up only one paper from Princeton dating back to Fall '08. Thank you.

</comment></comment></comment></comment><comment><USER16> Wonder if it could be combined with more typical ultrasound measurement techniques (time-of-flight, amplitude) to get distance -- combine this with Doppler-derived velocity using a Kalman filter, use stereo microphones for reception, two speakers emitting slightly different frequencies for left-right disambiguation, and you could probably get pretty good absolute measurements.

</comment><comment><USER17> Related: <http://iqtainment.wordpress.com/acoustic-ruler/>

</comment><comment><USER18> Cool hack, but why would I want to wave my hands at my laptop? Maybe my imagination is too limited...

<comment><USER19> I can think of a few examples. Controlling your music player while in another program. For Wii-like games but also for example for making signals to teammates in FPSs. As the article said, presense detection. Perhaps for desktop switching to free up screen real-estate.

<comment><USER20> All of those things except presence detection can be done by tapping one key or another. For example, most computers have keys for controlling music players, they're just not integrated properly. As the article says, it feels a bit silly to wave you hand in front of the screen what you can just move your finger a couple of inches from whatever you were doing and achieve the same result with a lot less energy.

If we worked like Tom Cruise does in _The Minority Report_ , we'd have a far bigger problem than carpal tunnel syndrome.

But maybe we could use something like this to bring mouseover effects back to tablet computers? Hover your finger above a button and watch it spin before you tap it!

</comment></comment></comment><comment><USER21> Doesn't Doppler calculation assume that the microphone and speaker are practically the same device (same point in space?). I reckon very few laptops have a setup like that..

<comment><USER22> No, it makes no such assumption. It's about motion and uses velocity, not position.

<http://en.wikipedia.org/wiki/Doppler_effect#General>

</comment></comment><comment><USER23> Didn't Morgan Freeman create this circa 2008?</comment>


Show HN: Bamboolib – A GUI for Pandas – Free on Kaggle - <AUTHOR> https://www.kaggle.com/tkrabel/bamboolib-titanic-df-wrangling <comment><USER2> Awesome work! Thanks for making it free on Kaggle!

<comment><AUTHOR> You are welcome. :) Do you already have a dataset you would like explore with bamboolib?

</comment></comment><comment><AUTHOR> bamboolib is a Python library for exploratory data analysis and data transformation.

Kaggle does not support saving Widget state to the static HTML notebook. This is why the code lines are commented out in the Kaggle notebook.

Happy to answer any questions.

</comment><comment><USER3> really cool, guys!

<comment><AUTHOR> Cheers. Do you already have a use case for bamboolib in mind?</comment></comment>


Programming and Minimalism - <AUTHOR> http://www.infoq.com/presentations/dahl-programming-minimalism

<comment><USER2> One of the most interesting points he makes in this talk is about separating out what Eric Evans might refer to as supporting generics (AFAIK) from the applications to write into separate libraries and open-sourcing them.

To me that's almost certainly the way for truth and good but fails to acknowledge that good libraries take a _really_ long time to write; ages. And then you have all this issue over being unable to change published interfaces because people rely on them now and dependency management etc. We need better programming languages before I'd be comfortable advocating that advice.

</comment><comment><USER2> I watched this a while ago. I already practise a lot of what he says but I know there are scores of programmers that don't. My programming improved immensely when I really starting taking minimalism seriously in an extreme way.</comment>


Mathematical Ghosts of the 20th Century - <AUTHOR> http://www.distilnetworks.com/mathematical-ghosts-20th-century/

<comment><USER2> Not sure about the whole "if you can't picture it, do you really understand it?" idea - a very touchy subject on that one....but interesting point

<comment><USER3> From a mathematics point of a view, the entire premise is based on picturing it in order to understand it...</comment></comment>


Would you accept cheaper rent in exchange for a monthly Amazon purchasing quota? - <AUTHOR> https://alexdanco.com/2019/06/12/would-you-accept-cheaper-rent-in-exchange-for-a-monthly-amazon-purchasing-quota/ <comment><USER2> You forgot to mention the magic. If you have to spend 400 on Amazon for a 500 rent discount then Amazon has a forced monopoly. Nobody can compete. Today there's at least the illusion of competition with Amazon, but in this scenario there is none. Amazon just wins.</comment>


Ask HN: Does Google plan to allow casting iOS/Android Chrome tab to Chromecast? - <AUTHOR>

I'm an idiot. I bought a Chromecast thinking I could cast my iPad's Chrome tab to my HDTV, but you can only cast a PC/Mac Chrome tab.. not mobile.<p>Anyone know if Google plans to allow mobile tab casting? <comment><USER2> I wouldn't hold my breath on anything official but it's a pretty natural feature to expect and it would give them a $65-cheaper feature on par with something Apple TVs do.</comment>


Your templating engine sucks and everything you've ever written is spaghetti code - <AUTHOR> http://www.workingsoftware.com.au/page/Your_templating_engine_sucks_and_everything_you_have_ever_written_is_spaghetti_code_yes_you An interesting, simpler and more designer-friendly approach to templating. <comment><USER2> This is why I love Enlive[1], Enfocus[2] and Kioo[3] (and Enliven[4] is looking awesome too!).

Your logic stays in your code, the _templates_ are snippets of pure HTML. Dynamic content is generated by manipulating and composing the snippets in code. Snippets can be defined in one large HTML file or many files - up to you. The code uses CSS selectors to choose which parts of the HTML to use and transform.

For example, lets say I have a blog application:

Welcome to my Blog

My post

Post content here

A comment

Then my code might look something like this:

        (enlive/defsnippet comment-snippet "myfile.html"
          [:.comments]
          [comments]
          [:.comment] (enlive/clone-for [comment comments
                        (enlivecontent comment))

        (enlive/defsnippet post-snippet "myfile.html"
          [:#posts]
          [posts]
          [:.post] (enlive/clone-for [{:keys [title content comments} posts]
                     [:.title]    (enlive/content title)
                     [:.content]  (enlive/content content)
                     [:.comments] (comment-snippet comments)))

That is, parts of snippets are selected and transformed in some way (changing the content, adding/removing css classes or styles, setting attributes, prepending or appending content, wrapping or unwrapping tags, duplicating for each element in a list, etc). This lets you write your page elements as mocked up snippets with dummy data and then merge them together, fill in content, dynamically update attributes and classes all without putting any logic into the HTML.

This also makes it very designer friendly because they can work in pure HTML and CSS without worrying about templating - they only need to make sure to follow your basic structure outline (ie making sure your selectors match the right thing).

[1] [https://github.com/cgrand/enlive](https://github.com/cgrand/enlive)

[2] [https://github.com/ckirkendall/enfocus](https://github.com/ckirkendall/enfocus)

[3] [https://github.com/ckirkendall/kioo](https://github.com/ckirkendall/kioo)

[4] [https://github.com/cgrand/enliven](https://github.com/cgrand/enliven)

<comment><AUTHOR> Nice, didn't know about all that happening in the Clojure universe. The scary part is that now your view code is tied to the structure of the HTML. The logic gets brought up in the code, where it belongs, but so does a lot of markup structure knowledge. Seems like an even worse outcome. Maybe it isn't, but I've never tried the approach on any real project.

...anyway, the thread died as this is never really a hot topic, people just use whatever templating language is "default" in their fav framework and don't like to overthink this, I guess :)

<comment><USER2> _The scary part is that now your view code is tied to the structure of the HTML._

I haven't really found this to be the case as long as you only use id's and classes as selectors. That is, in my example, I don't care what a post looks like, as long as it has a _.title_ , _.content_ and _.comments_. In large projects, I use naming conventions to designate certain classes as data elements (ie elements whose content will be overwritten with data), some as non-data content (ie elements which will be duplicated), some as page elements (containers for other elements) etc

The reality is that all templating has logic and HTML structure married in some way (in most templating systems its the reverse as the code is in the HTML), but I find that as long as you don't need complex selectors that rely on which span is contained in what div or whatever, then I don't care about the structure - I only care that certain id's and classes (sometimes sets of classes) refer to a snippet I wish to modify. At the end of the day, in a real application, there is likely always going to be a little coupling, but I haven't noticed it to be a big deal (at least, not yet).

I also find that in large applications, you may have a lot of self-contained reusable components (dialogs, widgets, etc). In these cases, I don't mind having the code and HTML coupled, as long as the components can be styled to suit my application externally (ie purely with CSS). For example, in an app I'm building right now, I have a table widget - the code and HTML are tightly coupled, but I can reuse the widget without touching either because I can style it using CSS. This is obviously only the case for self contained widgets that don't need to be changed and not general UI components.

Final thoughts: my current application is written with Om (one of the ClojureScript libraries for using React), which treats the rendering as a function of the state: _f(state) - > UI_

I use Kioo to construct my components in template-free HTML and my ClojureScript code manipulates it based on the data. The logic is really simple - its a one-way system: data -> logic -> template (raw HTML) -> page (processed HTML)</comment></comment></comment>


Marelle: logic programming for devops - <AUTHOR> http://quietlyamused.org/blog/2013/11/09/marelle-for-devops/ <comment><USER2> I'm skeptical, because there is already a configuration management language that is strongly influenced by Prolog and logic programming - Puppet - and the results are not that great.

The secret of configuration management is that ordering NEEDS to be a first class feature and ordered manifests should be the default, not the option. Puppet suffers hugely from the influence from the fact that ordering is unpredictable and that you have to use arrows or requires to add order. People accidentally forget to add ordering, the resulting code works most of the time, and then one day you start running into an issue because some implicit dependency either didn't happen, or happened in the wrong order. In as much as all logic programming involves not explicitly controlling flow, I think they're inappropriate for configuration management. Sadly, I'm still stuck with using Puppet because of the organisation I work in.

Having worked with Prolog in the past, I would also suggest that an important feature of a configuration management language is that the syntax make it hard to make typos and other minor errors because the feedback loop of deploying your code against a local vagrant machine is already long enough. I vividly remember the annoyance of having missed the full stop to end a block. I'm not desperate to repeat that experience.

<comment><USER3> I second everything said here.

In my internship last summer, I arbitrarily chose Puppet to automate the configuration of the company's developer environments. Puppet's unpredictable ordering should be a write-and-forget benefit, but in reality it's very difficult to reason about. In the end, my script imposed a top-to-bottom ordering with requires.

Also, developing configuration scripts against Vagrant is a huge pain. While `puppet parser validate` checks for syntax errors, most of the logical, dependency-based errors reveal themselves after Vagrant takes a good minute to fire up.

Anyway, hopefully my Puppet-Vagrant scripts aren't causing any maintenance nightmares...

<comment><USER4> Puppet has implicit ordering (for example, a file will depend on its parent directory) as well as explicit (arrow syntax, new in 3.0, I think).

But really, I don't understand the complaint. Writing explicit dependencies literally what Puppet -- or any other config management system -- is about. Puppet cannot possibly know what your intent is. So you have to tell it. Just like you have to tell the OP's system. It's simple enough.

Having used Puppet for a few years, my biggest complaint is that it's not quite modular enough. For example, in one system I have a way of declaring an "app". An app may have some dependencies (Postgres, Memcached), settings, users, etc. I have two choices, I think; either have one large, monolithic define allowing me to instantiate the app from a bunch of config:

        apps::app {
          "someapp":
            environment => 'production',
            uses_unicorn => true,
            db_name => 'someapp_production',
            db_user => 'someapp',
            memcached_servers => [...],
            # etc.

...which means that every setting has to be a variable that's passed around and used by the define. Or I can split it up into pieces:

        apps::app {
          "someapp":
            environment => 'production';
        }
        apps::memcached_config {
          "someapp":
            servers => [...];
        }
        apps::db_config {
          "someapp":
            host => ...,
            db_name => ...,
            db_user => ...;
        }
        apps::unicorn_config {
          "someapp":
            ;
        }

The problem with the latter approach is that eventually, much the configuration needs to be collected into just a few actual config files. Let's imagine that the app uses a single "app.conf". Normally you would build it using a template. But with the second approach, you would have to build it out of fragments that come from multiple defines; probably you would collect them in a conf.d type folder, and then use an "exec" definition to concatenate them into "app.conf".

Puppet is very modular, but it's a bit awkward when it comes to this level of modularity -- or I haven't found a better way.

<comment><USER2> > Writing explicit dependencies literally what Puppet -- or any other config > management system -- is about. Puppet cannot possibly know what your intent > is. So you have to tell it.

Other tools just execute manifests top to bottom, which is a much less error- prone approach.

I agree that finding the right abstraction level for modules (and for reuse) is not well solved.

</comment></comment></comment></comment><comment><USER5> It's been a while since I've studied Prolog, but it's good to see it getting some press. I learned Prolog before ever dabbling in Scheme or ML, and it was just as much of a paradigm shift from imperative style. It's kind of like FP- style pattern matching, but taken to a whole new level, such that the pattern matching itself is pretty much the entire computational engine.

Rather than using functions, which take a number of arguments and return a result, you use predicates on a number arguments. You build your program out of clauses, which are conjunctions of predicates. A process called unification [1] finds the argument values (if any) that satisfy an entire clause. By sharing constants and variables between predicates, the valid results that unification can produce are restricted to what the logic of your program allows.

So your algorithms end up being, in many ways, description of what a valid results look like, and the Prolog engine goes out and finds them. This paradigm clearly maps nicely to domains with lots of rules, like decision engines, parsers, and such. Sounds awesome, right? One caveat is that, in practice, you as a programmer have to have a pretty good understanding of how unification works in order to write performant algorithms.

This is all from several years-old recollections and a little bit of Wikipedia to refresh my memory, so someone please chime in if I'm incorrect someplace or leaving out key concepts.

[1] [http://en.wikipedia.org/wiki/Unification_%28computer_science...](http://en.wikipedia.org/wiki/Unification_%28computer_science%29#Application:_Unification_in_logic_programming)

</comment><comment><USER6> Prolog's a surprisingly good fit for many every-day tasks where people otherwise invent DSLs or poorly-defined state machines and pattern matching algorithms.

So how come we don't use it more often? Well, the reason is actually quite simple:

Prolog's incredibly difficult to reason about once you grow past trivial facts and clauses like in the OP's article -- the examples given by him would've been introduced to you in the first lesson on Prolog in, say, University. The complexities of green/red cuts, backtracking and the procedural nature of Prolog makes it a really difficult language to truly learn -- much less one to specify complex programs in.

I've never programmed in a language where 5-6 lines of errant Prolog code could stump myself, a post grad and a professor before until I did Prolog.

<comment><USER7> It is a shame really. Declarative programming is so much simpler to think about and extremely powerful. I've been working on trying to make declarative programming more accessible and while I personally have seen 60x improvements in ability, I have been unable to convince any of my teammates to give it a whirl.

<comment><USER8> @keenerd try to build a DSL ontop of prolog and they'll come & play.

<comment><USER7> It is a library that works with any language, no need to learn a new one. Two people can even work on the same problem in different languages and seamlessly combine their work into one result.

<comment><USER8> interesting! what is it for?

</comment></comment></comment></comment></comment><comment><USER9> Also like the bootstrap.sh - very nicely structured and easier to verify than many others I've seen. I'd still prefer these scripts to output missing dependencies that calling sudo -- but otherwise very nice.

That is, rather than:

          function install_git() {
              echo 'Trying to install git'
              case $(uname -s) in
                #...
                Linux)
                  if has_exec apt-get; then apt_update
                    sudo apt-get install -y git
                  #...
                  else bail "Unknown linux variant"
                  fi
                  ;;
                *)
                  bail "Unknown operating system $(uname -s)"
                  ;;
              esac
          }

Simply aggreagate a list of missing packages, and ouput (based on a similar case-statement for detetining host):

        echo Please install missing packages:
        echo sudo apt-get install ${missing-deps}

[https://github.com/larsyencken/marelle/blob/master/bootstrap...](https://github.com/larsyencken/marelle/blob/master/bootstrap.sh)

<comment><AUTHOR> Thanks! :)

It's a little aggressive in calling sudo mainly because I'm using it to bootstrap new systems non-interactively. I don't want it to ask any questions at all, just to go.

</comment></comment><comment><USER10> Prolog does seem a reasonable fit for the problem space.

That said, even CFEngine's long winded syntax (born of its commitment to "promise theory") isn't so bad. In my experience I don't feel expressiveness of the available languages is the problem most I need of solving.

The real problems not being tackled by the existing configuration management tools are testing bundles/(play|cook)books/modules, cleanly injecting metadata to facilitate reuse and the bundle debugging workflow.

<comment><USER11> What kind of metadata would facilitate reuse?

Have you seen the latest verbose mode in CFEngine (as of 3.5, June 2013)? It's more compact to facilitate debugging.

How else could debugging workflow be improved?

<comment><USER10> Say I have a simple bundle for inserting lines in /etc/security/limits.conf, it'd be good to have the bundle agent / edit_line which describes how to make the change, completely separate from the data that describes user1 gets a hard nofile of 64k.

There's lots of ways to achieve that from just doing selective usebundles from various bundle files containing only vars to more flexible approaches; In our deployment we've provided this as part of our bundle framework (we inject the parameter data via modules protocol - so a box in location A applies different data than a box under line of business B), they both reuse the exact same (comprehensivly tested) code.

This means no code release for a data change. No need to train everyone in CFE syntax just to allow an app developer to express that user c on box d is allowed more open file handles.

The point though is that It'd be good to have as a first class language feature instead of each cfe site reinventing a separate framework for the same functionality.

Haven't had any hands on with 3.5 so not familiar with that, but better print debugging isnt where I was going with the idea. I want to be able to step through a bundle, I want to be able to break when global class X is set. I want to then be able to set class X while stepping through. Kinda like making debug logging level interative and with higher signal to noise ratio on screen.

If there was language support for unit testing my bundles I could use that to reason about what I expect to happen. Diego Zambonis book proposed one way to do that with the existing facilities but its just a proof of concept, e.g. it cant guarantee environment cleanup after a show stopping error in a test.

</comment></comment></comment><comment><USER12> The meet/met notation instantly made me think of babushka: [http://babushka.me/](http://babushka.me/)

The base principle seems to be the same except that babushka is a ruby DSL and that the dependency solving is part of the library instead of the language.

<comment><USER13> Babushka seems to be one of the inspirations. The article says "Still, Babushka made me uneasy: all this ceremony and complex templating, just to describe a few facts and simple rules?"

</comment></comment><comment><USER9> Very interesting. I wonder if it would be viable to build an entire package management system (like apt) in a similar manner -- and if there are any (semi-recent) improvements to prolog-like systems that might improve dependency resolution "for free"?

<comment><USER8> These are the package management systems that I use. A new package management systems just does this [http://xkcd.com/927/](http://xkcd.com/927/) What we need is a cross-platform cross-applicaton meta package management system which comes as configuration management that evolves to a general purpose package manager without relying on any external package manager.

I'm not fanboy enough and would happily replace:

emerge, equo, apt-get, aptitude, ipkg, dpkg, zypp rpm, yum, tazpkg, pacman, homebrew

tar/gzip, slackpkg (Yeah, you, Slackware, we were friends and you helped me for long enough. You shouldn't do all my work anymore, you're old. Take a rest)

pip, cabal, bundler, gem, composer, pear, cpan, ctan, cran, maven, vundle – haven't you also a love hate relationship with these?</comment></comment>