Bring employees out of the dark - <AUTHOR> https://medium.com/@henrysward/bring-employees-out-of-the-dark-a4abfe9dcf83

<comment><USER2> Is this to show your employees how much of your company is owned by various other companies?

<comment><AUTHOR> This is to show how much employees own of the company they work for. The vast majority of employees do not have access to this information today, unbelievably.

Full disclosure: I work at eShares (and love it).</comment></comment>


What Your 16-Hour Workday Says About You - <AUTHOR> http://jessiechar.tumblr.com/post/2927541471/what-your-16-hour-workday-says-about-you <comment><USER2> And nowhere on this is "You like what you do." Is that really so hard to imagine?

<comment><USER3> Even then you'll be better at what you do if you learn to balance your life a bit. Go outside and enjoy the sunshine every now and then.</comment></comment>


Tiny Toy TOTP Generator in 18 Lines of Python - <AUTHOR> https://github.com/susam/toytotp <comment><USER2> In practice, clocks are often out of sync enough that you want to give some leeway and accept some codes on either side of the current code. The implementation I use for sourcehut is similarly tiny:

[https://git.sr.ht/~sircmpwn/meta.sr.ht/tree/master/metasrht/...](https://git.sr.ht/~sircmpwn/meta.sr.ht/tree/master/metasrht/totp.py)

<comment><AUTHOR> Yes, in fact the RFCs for both HOTP and TOTP have a section each dedicated to resynchronization of counter/clock to account for client and server being out of sync. Here are the relevant sections:

\- RFC 4226 (HOTP): Section 7.4 (Resynchronization of the Counter): [https://tools.ietf.org/html/rfc4226#section-7.4](https://tools.ietf.org/html/rfc4226#section-7.4)

\- RFC 6238 (TOTP): Section 6 (Resynchronization): [https://tools.ietf.org/html/rfc6238#section-6](https://tools.ietf.org/html/rfc6238#section-6)

In case of HOTP, the client's counter could be ahead of the server's counter if a user requests multiple HOTPs from the client before the user presents the HOTP to the server. Therefore the server should look ahead according to a permissible look-ahead window to see if any succeeding HOTP value matches the HOTP presented by the user or client.

In case of TOTP, there is of course the problem of clock drifts. Therefore the server should look backward as well as forward by a few time steps to see if any TOTP backward or forward matches the TOTP presented by the user or client.

<comment><USER3> In the past, when I've implemented TOTP on the server, I've allowed for a couple of time periods of drift. But I recorded the time period that last matched, and only allowed subsequent authentication attempts to be strictly greater than the last successful time period, to prevent replay attacks.

<comment><AUTHOR> Yes, RFC 6238 requires this too. Quoting from [https://tools.ietf.org/html/rfc6238#section-5.2](https://tools.ietf.org/html/rfc6238#section-5.2):

> Note that a prover may send the same OTP inside a given time-step window > multiple times to a verifier. The verifier MUST NOT accept the second > attempt of the OTP after the successful validation has been issued for the > first OTP, which ensures one-time only use of an OTP.

</comment></comment></comment></comment><comment><USER4> Plugging my hotp/totp python library hotpie[0]. Written originally in 2010. Around 100 lines including comments and tests against the RFC. Available on Pypi for python 2.x and 3.x.

The beauty of HOTP/TOTP for me is its simplicity. And being able to write a simple implementation makes it easy to test, debug and be sure that there are little or no holes.

[0] [https://github.com/gingerlime/hotpie](https://github.com/gingerlime/hotpie)

<comment><USER5> I remember having fun implementing that rfc and having a sort of Google authenticator on my Linux box besides Android.

[https://github.com/bjornua/totp.py/blob/master/totp.py](https://github.com/bjornua/totp.py/blob/master/totp.py)

</comment></comment><comment><USER6> Being of a certain age and in the UK, I was disappointed to find this is not an 18 line Top Of The Pops generator... :)

<comment><USER7> Comes with mandatory "whole lotta love" algorithm and bad lip sync

</comment></comment><comment><USER8> 5 most important lines:

      import base64
      import hmac
      import struct
      import sys
      import time

<comment><USER9> I get your point but equally the point of programming languages is to abstract away the harder stuff. The question is just how much abstraction developers want between the code and the execution.

I mean, you could make the same claim about one written in C because it doesn't include stdio.h. So where do you draw the line? Assembly?

<comment><USER8> My point is that saying that something is written in 18 lines of code when actually all the heavy lifting is done by the libraries is misleading. That doesn't mean I don't appreciate Python's expressiveness and rich standard library.

<comment><USER10> Yeah, but that comment can be made about literally every software in existence. Even core language keywords are doing a lot of heavy lifting in the interpreter.

In Python, the stdlib is effectively part of the language, so as long as they're not installing third-party libs, I don't see how it can be misleading.

<comment><USER11> I think you both raise valid points.

This was an interesting thing to look at to see get a quick idea of how TOTP works.

On the flip side, though, if this we had this hypothetical implementation:

        import totp

        if __name__ == '__main__':
            totp.generate()

Well, we probably wouldn't be here discussing it.

<comment><USER12> Well, the key part essentially _is_ just like that, it's the single line

         mac = hmac.new(secret_bytes, counter_bytes, digest).digest()

and everything else is just converting data to/from the proper format for this function.

<comment><USER11> Well sure, but given that TOTP is itself just formatted HMAC, that "everything else" of formatting is the essence of TOTP.

Otherwise you probably wouldn't say you're implementing TOTP, you'd say you're implementing HMAC.

</comment></comment></comment></comment></comment></comment></comment><comment><USER13> Along with micropython-hmac (MicroPython doesn't include hmac), and the touch sensor on an ESP32 I threw together an authenticator with the same inspiration as this project. It seems to work quite well, overall.

<comment><USER14> I haven't used MicroPython in a long time, but it seems to include hmac: [https://github.com/micropython/micropython- lib/tree/master/h...](https://github.com/micropython/micropython- lib/tree/master/hmac) right?

<comment><USER13> micropython-lib packages aren't included in the base MicroPython (well, not the main one. The Pycopy fork does), and are published on PyPI under micropython-x. You've found the source for the package I named.

<comment><USER14> Ah, didn't know that, TIL!

</comment></comment></comment></comment><comment><USER15> Here is one in 4 lines: [https://github.com/stolendata/totp/blob/master/totp.php#L42-...](https://github.com/stolendata/totp/blob/master/totp.php#L42-L45)

</comment><comment><USER16> The RFCs for HOTP[0] and TOTP[1] are very readable.

I built a small cli utility to manage my TOTP logins easily using them as reference.

[0] [https://tools.ietf.org/html/rfc4226](https://tools.ietf.org/html/rfc4226)

[1] [https://tools.ietf.org/html/rfc6238](https://tools.ietf.org/html/rfc6238)

</comment><comment><USER17> Am I the only one who found the use of acronyms here a little annoying? Like, use the whole word expansion at least once before introducing the acronym. That should be standard practice regardless of discipline and audience.

<comment><USER18> Which acronym? Expanding "TOTP" isn't going to help anyone; what you really want is the short sentence that simply explains what TOTP is.

<comment><USER19> I didn't know what it meant, and looked it up. "Time-based One Time Password" explains a hell of a lot more that "TOTP." From just those 4 words I figured out we were talking about the kind of thing that powers 2-factor auth implementations where get a time-based one-time code.

Before I looked it up, I thought it was somehow related to NTP.

<comment><USER18> My point is that "time based one-time password" doesn't really tell you anything about what TOTP is; what you want is the phrase "the protocol code- based 2FA applications like Google Authenticator use", after which you don't care anymore about the stupid name the protocol has.

It's a little bit like expanding "transport control protocol". I mean, sure, I guess it's marginally better than the acronym TCP? But really, that's not the clarification you want to provide to someone who doesn't know what TCP is.

Also, obviously, if you don't know what TOTP is, you might just not be the audience for the article. Remember that most people don't write their personal blogs (or, in this case, their Github personal projects) specifically for an audience of Hacker News people, even though HN sometimes makes it seem that way.

</comment></comment></comment></comment><comment><USER20> >However, doing so defeats the purpose of two-factor authentication (2FA).

There are still some 2FA benefits from this. The biggest one is for people who reuse passwords. Some websites might put you into a higher security tier if you have 2FA. Also if you have to choose between SMS vs this, this has some benefits, for example it can't be hijacked by social engineering your phone provider.

Also it says regular TOTP protects you from keyloggers. That's not fully true, because the keylogger could steal your TOTP code as you enter it into the website. If the keylogger is realtime, it could log into your account before you're able to. Or if you assume there's malware on your computer, it could steal your cookies, or perform whatever account actions it wants directly on your computer.

<comment><AUTHOR> The README does not say that TOTP protects us from keyloggers. I was either not clear in writing that paragraph or you may have misundertood that paragraph. Here's what the README says,

> If your desktop/laptop device is compromised, then both authentication > factors would be compromised. The attacker can steal the first > authentication factor that only you should know (e.g., password) by running > a key logger on the compromised device. The attacker can also steal the > second authentication factor that only you should have ...

What I mean here is that generating the TOTP on the same system that we would use to log into a website with 2FA defeats the purpose of 2FA because the attacker can steal the TOTP secret key in addition to stealing the password (keylogger being one way to steal the password).

<comment><USER21> I think the grandparent is just trying to say that while it defeats one of the purposes behind 2fa, it doesn't defeat all of them. Security is all about trade-offs and defense in depth and 2fa is still valuable in this sense even with the 2fa secret stored on your laptop. That is, it trades off some security for convenience but is still more secure than not having 2fa.

<comment><AUTHOR> I agree. I think it is acceptable to trade some security for convenience and in this case the convenient solution is still more secure than not having 2FA at all. However, the fact that some security is being traded for convenience should be documented in the README, otherwise one can criticize that the README is promoting a less secure usage of TOTP.

</comment></comment></comment></comment><comment><USER22> If we don't have to follow PEP8, how many lines can we condense it to? I am going to try.

</comment><comment><USER23> Readability is more important than your ego.

</comment><comment> tedk-42 MFA - what you have.

I personally prefer this golang library to generate my OTP codes [https://github.com/pquerna/otp](https://github.com/pquerna/otp) as it's much faster than running a python script.

My personal computer is the 'what I have' to do the second factor of authentication for most sites via a shell script, followed by xclip (linux) or pbcopy (mac). I prefer this over browser extensions using javascript to paste in your OTP code for you.

<comment><USER10> If you want raw speed, oathtool is hard to beat. Only 132KB to load to memory, compared to the megabytes of the typical Go binary. But unless you're playing an FPS where you have to input TOTP codes to shoot, this script is probably fast enough (80ms on my old laptop).

<comment><USER24> _Only 132KB to load to memory_

It's amusing to see people think 100KB+ is small, when the whole TOTP algorithm, including SHA1 (probably the biggest part), and the input/output conversion, likely needs only a few KB of code. With the exception of SHA1, everything else is doable in dozens of bytes.

<comment><USER10> True, but I'm just talking about the sizes of the binaries generated by the default settings of common compilers (gcc, in the case of oathtool), for comparing orders of magnitude. I'm sure there's plenty of fat you could trim by simply tuning the compilation a bit.

(Oathtool also supports SHA2, since it may be used by other implementations, per the RFC. )</comment></comment></comment></comment>


The little-known patterns on British streets - open-source-ux https://www.youtube.com/watch?v=cdPymLgfXSY <comment><AUTHOR> Interesting. As a cyclist I guessed the cycle path/footpath pattern.

I'd noticed the other markings before though.</comment>


Facebook Gives $10 Million in Free Advertising to Small Businesses - <AUTHOR> http://www.facebook.com/marketing?sk=app_244881505558365

<comment><USER2> What a load of BS. How is this different than the $100 free credits they hand out everywhere? Oh that's right, it's not.

<comment><USER3> Exactly. But you have to admit that it is a clever spin of their PR department to counter the growing amount of negative PR.</comment></comment>


The Power of Data and Collaboration to Improve Traffic Safety - <AUTHOR> http://www.datakind.org/blog/the-power-of-data-and-collaboration-to-improve-traffic-safety <comment><AUTHOR> case study: "Creating Safer Streets Through Data Science"

[http://www.datakind.org/projects/creating-safer-streets- thro...](http://www.datakind.org/projects/creating-safer-streets-through-data- science/)</comment>


Structural Tags in HTML5 - <AUTHOR> http://orderedlist.com/our-writing/resources/html-css/structural-tags-in-html5/

<comment><USER2> Pretty ambiguous.

> <section>

> section is a thematic grouping of content, typically preceded by header…

> <header>

> The header of a section…

So do headers go before or inside sections? Or both?

The article also fails to mention that <header> is completely different from the way most of us use the #header ID in documents — <header> can be used over and over in HTML5 so the meaning is different than a lot of people would assume.

I know the example makes it less ambiguous, but come on.

</comment><comment><USER3> If you found this blog post a bit abrupt, you might want to look at Mark Pilgrim's take on HTML5's semantic elements.

<http://diveintohtml5.org/semantics.html>

</comment><comment><USER4> Great that it's possible to starting using it now but would doing so improve or hurt SEO? Anyone know if search engines are setup to parse this data better?

<comment><USER5> I serve on W3C's HTML5 Working Group. This certainly would help search engines along the road. I wouldn't think this would hurt SEO in any way, may actually end up helping. I am not too involved with SEO stuff, but I can help with other stuff you might be interested in with focus to HTML5.</comment></comment>


Cory Doctorow: Inaction Is a Form of Action - <AUTHOR> https://locusmag.com/2020/01/cory-doctorow-inaction-is-a-form-of-action/ <comment><USER2> Decision by indecision. Not to take a side was to take a side.</comment>


The call of Kraken, GSM cracking software - <AUTHOR> http://lists.lists.reflextor.com/pipermail/a51/2010-July/000683.html <comment><USER2> Is it possible to use a common phone to sniff the GSM traffic? Or something like a GNU-radio capable external device is absolutely required?

GSM and GSM security are interesting topics but really hard to touch with your hands because of the difficulty of reading what's passing over the air. The more hackers will have access to equipments, the more secure will be our conversations in the long run.

<comment><USER3> To use a regular phone you would have to reverse-engineer a significant part of the (low-level) software, est. cost > $1m

Even then you would have to get lucky with the hardware, as it is not designed to sniff all the meta data and pass it up for capture. It might do some of the stuff in hardware that you want done in software.

<comment><USER2> Thanks for the clarification

</comment></comment></comment><comment><USER4> I dont know much about GSM protocols. Can somebody here explain what might be possible applications for this thing? Would it be possible to decode recorded GMS calls around you? Is it significant vulnerability?

<comment><USER5> A5/1 protects the over-the-air voice stream in GSM. Details on the protocol and cryptosystem:

<http://everything2.org/user/Jetifi/writeups/GSM>

I don't think this is quite as big a deal as it's made out to be, since that A5/1 and /2 were both broken almost a decade ago, and most GSM providers have replaced these two ciphers with others since then. It might still be useful in places outside of Europe and the US though.

<comment><USER3> Care to tell us where we can find info on the ciphers actually in use?

</comment></comment></comment><comment><USER6> From last year's Chaos event:

[http://events.ccc.de/congress/2009/Fahrplan/events/3654.en.h...](http://events.ccc.de/congress/2009/Fahrplan/events/3654.en.html)

 _"From the total lack of network to handset authentication, to the "Of course I'll give you my IMSI" message, to the iPhone that really wanted to talk to us. It all came as a surprise -- stunning to see what $1500 of USRP can do. Add a weak cipher trivially breakable after a few months of distributed table generation and you get the most widely deployed privacy threat on the planet."_</comment>


California Attorney General delays .org sale - <AUTHOR> https://domainnamewire.com/2020/01/31/breaking-california-attorney-general-delays-org-sale/ <comment> ISO-morphism From the AG letter:

> 24\. If ICANN approved the removal of the price cap for registration fees > for .org domains, provide a detailed explanation how this occurred, > including when and who initiated the process to remove the price caps and > how it was ultimately approved;

...

> 35\. Your conflict of interest policy.

I think it's a good sign they're asking for specific individuals. Really looks like they're not fooling around.

<comment><USER2> I'd love it if they required the de-redaction of some of the individuals involved. I think that could prove entirely enlightening to some of the _real_ motivations at play.

<comment> ISO-morphism > 5\. PIR's unredacted response to ICANN's request for additional information > regarding the acquisition of PIR by Ethos Capital

> 27\. Identify all individuals at ICANN involved in analyzing and/or making > recommendations regarding the removal of the price cap for .org domains

Seeing the words "unredacted" and "individuals" makes me hopeful for this. Feels like they're saying "not gonna fly" to "orders were orders."

> 34\. Provide the names and contact information of all of ICANN's members of > its Board of Directors, including all non-voting members

And at the same time no to "it was a rogue employee "

</comment></comment></comment><comment><USER3> It's nice to read some good news for a change.

From the article:

> The current deadline for ICANN to approve or deny the sale is February 20. > It is asking Public Interest Registry to extend this to April 20 as a result > of the attorney general office's request.

> This is perhaps the biggest wrinkle so far in Internet Society's plans to > sell the registry for $1.135 billion to a private equity company.

Are the details outside the amount public and is there any clawback amount if the deal does not go through?

</comment><comment><USER4> Looks like the AG is considering that case seriously, they're asking a very extensive list of information, including information on how the decision to remove price caps was made, the names if individuals involved, and confidential details of the deal with Ethos Capital. They definitely already studied the case to ask the pertinent questions. Hopefully this is treated as seriously as it is for the Internet and any decision where corruption was involved, or that is detrimental to the interests of non-profits, is not allowed to go through.

<comment><USER5> It looks like this scheme is going to collapse now. The next important thing is to reinstate the price caps.

<comment><USER6> What i would like to understand is what's California jurisdiction is

<comment><USER7> From the letter the AG sent:

> *The Office of the Attorney General has the duty to supervise charitable > organizations under [law#]. The [ICANN], as a registered nonprofit in > California, is subject to regulation by the California Attorney General.

Sort, IANAL answer: They are incorporated in California, making their corporate conduct subject to California's laws.

Source: This PDF, starting on page 3.

[https://www.icann.org/en/system/files/correspondence/jeffrey...](https://www.icann.org/en/system/files/correspondence/jeffrey- to-nevett-30jan20-en.pdf)

</comment></comment></comment></comment><comment><USER8> Here's the audio interview with one of the ISOC trustees attempting to defend his vote for the sell [https://www.techdirt.com/articles/20200115/11301343739/techd...](https://www.techdirt.com/articles/20200115/11301343739/techdirt- podcast-episode-234-mike-godwin-defends-selling-org.shtml) His mental gymnastics there are just incredible.

<comment><USER9> Mike Godwin make several claims that the only way for the .org tld to survive is that it requires capital to improve. Another point that is repeated is that PIR (current owner of .org) is constantly making a surplus of money. The reasoning for this disparity is that a non-profit cannot use money it generates to improve itself. Is this a valid point, and if so why?

<comment><USER10> Nonprofits in California are allowed to take out loans to acquire capital. They are also allowed to spend money to improve the service they offer in the furtherance of their tax-exempt purpose, so long as the capital expenses don't count as self-dealing (like the .org sale, allegedly). There's no legal basis for either of those claims. The thing they can't do is go out and sell equity for VC money on their core purpose, or exceed the legal threshold for unrelated business income. But neither should be necessary to improve the nonprofit, especially given that it already has a surplus of money.

<comment><USER11> > Nonprofits in California are allowed to take out loans to acquire capital.

Just as point of clarification, California non-profit corporation law wouldn't apply to Public Interest Registry. It is formed and domiciled in Pennsylvania. That said, Pennsylvania law appears to permit non-profit corporations to take on debt in the same way that any other corporation formed under PA law can do (subject to rules found in the organization's bylaws or formation documents, which I've not read for PIR). Title 15 of Pennsylvania's consolidated statutes, section 5502(6) reads that a non-profit corporation has the authority "[t]o borrow money, issue or incur its obligations and secure any of its obligations by mortgage on or pledge of or security interest in all or any part of its property and assets, wherever situated, franchises or income, or any interest therein."

I can't think of a reason why PIR, with a surplus of annual income, would have any trouble receiving a loan from any number of financial institutions. In fact, the vast majority of credit unions would be tripping over themselves to make such a loan, based on what I've seen of PIR's financials. Taking out a loan against surplus income to make cash-intensive improvements to the non- profit in furtherance of its mission is basically the whole point of running a surplus that isn't distributed back to members.

</comment></comment></comment></comment><comment><USER12> AG Letter is page 3 of this pdf: [https://www.icann.org/en/system/files/correspondence/jeffrey...](https://www.icann.org/en/system/files/correspondence/jeffrey- to-nevett-30jan20-en.pdf)

<comment><USER13> "35\. Your conflict of interest policy."

<comment><USER14> Does a conflict of interest actually make something illegal? I was under the impression that while best practice to declare and avoid conflicts of interest, it was not actually illegal as long as the motives for each decision were defensible.

<comment><USER15> 35 isn't a request, but a message from a powerful politician to the people behind the sale. It's hard to guess the exact meaning without full context, but I think it's "I know enough. If you want to proceed with the sale, you have to give me the names and I'll send some of them to prison." They may try to call his bluff, but they'll be sorry if he indeed knows something.

</comment></comment></comment></comment><comment><USER16> Also on The Register: [https://www.theregister.co.uk/2020/01/31/icann_dot_org_sale/](https://www.theregister.co.uk/2020/01/31/icann_dot_org_sale/)

</comment><comment><USER17> This is welcome news. Perhaps there's a slim glimmer of hope here.

</comment><comment><USER18> The question is what the private equity firm will do with .org that it thinks will earn a good profit on the 1.145 billion it is investing. And would that leave the internet better or worse off. Did ICANN even ask that question?

</comment><comment><USER19> > If it gets the answers it demands, it will get much more information than > ICANN has previously disclosed about the process and thinking behind > removing price caps on .org domain names last year.

If?

</comment><comment><USER20> Can someone help me understand why a domain name still costs $10-$13 a year to own? Even with so many tlds (presumably competition) it's still expensive. Why?

</comment><comment><USER21> How does the jurisdiction work on this? Presumably not all regions of all countries involved in ICANN have this power.

<comment><USER7> ICANN is incorporated in California.

</comment></comment><comment><USER22> Can anyone give some pros and cons on each side of this?

<comment><USER23> Of selling the .org registry?

Pro: ICANN can make a shitload of money.

Con: .org domains get a shitload more expensive.

<comment><USER24> Con: a private equity firm potentially gets to control who gets .org domains. That probably shouldn't be a private decision at all.</comment></comment></comment>


Can you hurt yourself eating chilli peppers? - <AUTHOR> http://www.bbc.com/future/story/20161020-can-you-hurt-yourself-eating-chilli-peppers <comment><USER2> I'm not sure why people go for the heat.

I'm from India and there are many hot/spicy options available. But most chili peppers are used for their flavor or color (e.g. Kashmiri Red Chilli powder is very red, less spicy) and varying the levels of heat/spiciness by adding more of less of it, instead of using the spiciest variety (like the ghost peppers that have caught the fancy of the west).

I wish the flavor component had some kind of a quantifiable unit instead of the scoville units that has fueled this craze of feeling the burn.

Don't fall for this tongue numbing "hottest wings/sauce in the world". Enjoy the flavor :)

<comment><USER3> Because sometimes you're eating some boring-ass flavorless overcooked chicken breast with no skin and you need _something_ to make it palatable distract you from what appears indistinguishable from tough, stringy cardboard. :)

But really, it's just fun. Enjoying extreme spiciness has nothing to do with enjoying food. Think of it as just a totally separate activity.

And I get that plenty of people don't find tongue-numbing to be fun at all. For all I know, there's a gene for it. But for those of us who _do_ find it fun... it's fun!

<comment><USER4> > Enjoying extreme spiciness has nothing to do with enjoying food.

I'm convinced there's a significant element of machismo: "Are you tough enough to eat this?"

</comment></comment></comment><comment><USER5> Mexican here. I find it amusing that people focus on how spicy their peppers are. They are missing the point. There are many pepper varieties and each has a different flavor. That is the interesting part and how it mixes with different foods in a variety of recipes. Focus on the flavor, not the burn.

<comment><USER6> I think it's kindof funny that people somehow associate Mexican and Indian food with being spicy. I almost think it scares them off of trying some of those dishes.

In my experience, Mexican food is _rich_ , but not spicy. Same thing with (some) Indian food. Maybe I'm trying the wrong food, though? I've only traveled in western India (Maharashtra). I would love some recommendations for dishes to try!

BBQ (from the US) is the hottest food I have ever found. Mexican and Indian food barely registers compared to that stuff.

<comment><USER7> Where are you finding BBQ which registers as "the hottest food"? I can't think of a single regional BBQ style which would qualify as needle moving at all for me.

<comment><USER8> I'm guessing you're never met "the man" direction Dixie's BBQ. I'm not a big fan of spicy BBQ but there is definitely hot BBQ.

<comment><USER9> For the curious, this is a barbecue joint in Redmond, WA, just outside of Seattle and near Microsoft's headquarters. The owner, Porter, is famous for a hot sauce called "The Man" which is served out of a small, beat-up pot with a long handled spoon. If you get him talking, he'll tell you a story about someone trying to sell him capsicum extract-based sauce for his new BBQ restaurant (there's another interesting backstory about it being a car repair place previously). But it was too expensive, so he went upstream to his supplier and started buying it wholesale. He cooks it up with peppers, but the base is prefab.

It's also near-lethal... consume with caution.

Disclaimer: was last there >10 years ago, so much may have changed.

</comment></comment></comment></comment></comment><comment><USER10> This article seems to say chilli peppers can't hurt you. However just a few days ago the Journal of Emergency Medicine reported that a ghost pepper (a very hot chilli pepper) caused an esophageal rupture - a serious and potentially life threatening injury.

[http://www.jem- journal.com/article/S0736-4679(16)30256-6/ful...](http://www.jem- journal.com/article/S0736-4679\(16\)30256-6/fulltext?rss=yes)

Why is the BBC not aware of this? A simple search would have yielded a more timely, accurate and interesting story. Somewhat disappointing.

<comment> vhost- But was this due to the heat, acidity or some other characteristic of this cross? Or was it because he swallowed a pepper whole and it tore a hole because it went down sideways? You have to remember how much and how fast people shove things into their mouths during these contests...

I can't find anything that tells me why it happened.

<comment><USER11> It's because of strain while vomiting: [https://en.wikipedia.org/wiki/Boerhaave_syndrome](https://en.wikipedia.org/wiki/Boerhaave_syndrome)

</comment></comment></comment><comment><USER12> I'd be interested to see how someone would fare by chewing on some synsepalum dulcificum aka miracle fruit [1] followed by a Ghost pepper. In theory, it should be able to block out most of the TRPV1 heat receptors as well. If only I did my thesis on this.

[1] [https://en.wikipedia.org/wiki/Synsepalum_dulcificum](https://en.wikipedia.org/wiki/Synsepalum_dulcificum)

<comment><USER13> Well, I have some old miracle fruit tablets and various spicy sauces I can try if you want... Probably not Ghost pepper, though.

<comment><USER14> I for one, would be interested in the results of that!

<comment><USER13> Alright, I tried it for you guys:

I ate one miracle berry tablet (I think the recommended dose is half a tablet, but screw it). The tablets were pretty old, so after consuming it I tested with yoghurt to see if the results held up. Indeed, the yoghurt tasted like cream and was not sour at all, so the tablet was good.

Afterwards, I tasted Sriracha sauce, Tapatio and Valentina Extra Hot. All sauces retained their usual taste, except there was no burning sensation in the tongue and mouth at all. However, the sauces retained their burning sensation in the throat, completely intact, as far as I can tell.

I'm afraid that I didn't have a control spoonful of sauce before the tablet, because I didn't think of it, but I can have some once the tablet wears out. I seem to recall, though, that a spoonful of Sriracha does normally burn my tongue.

<comment><USER12> Thank you so much!! Interesting results and basically what I expected. I'll try the same except with a habanero, wonder how far it goes.

<comment><USER13> I'm sure one of the sauces I tried has habaneros in it (probably the Tapatio, possibly the Valentina). I think the effect should generalize well.

</comment></comment></comment></comment></comment></comment><comment><USER15> Ghost peppers are the hottest peppers I've ever dared to eat directly. They are so far beyond hot that I don't even feel a burning sensation - more like pure, unadulterated pain like you'd expect from having a nail driven through your tongue. I really don't like the flavor of them either so there isn't really much motivation for me to ever eat one again. They are really great in small quantities for spicing up dishes without altering the flavor of the dish in question though.

Habanero peppers on the other hand - have a wonderfully fruity flavor. I wish I had a bit more stamina with regards to eating them. :(

<comment><USER16> It wasn't a ghost pepper, but I once at a small green pepper that was so hot that my tastebuds kind of short circuited, and all I could taste was roses. After a few seconds of that, stye came back online with the excruciating burn of a very hot pepper, but for about 3 seconds, I could have sworn I had eaten a rose.

<comment><USER17> <\-- would pay and suffer to experience this illusion!

<comment><USER6> Get yourself some "miracle berries" for something similar (although without the heat involved).

</comment></comment></comment></comment><comment><USER18> I used to be able to handle really hot peppers up in till college and then one day during college completely over did it .

I'm not sure if that "day" was the cause of my increased sensitivity or if I just age related but now I can barely enjoy red pepper flakes. Oh it goes down just fine but later... later I'm writhing in pain rolling around in the bed at night ... and then later on the toilet ... well I think you know what happens next.

As I get older it seems to get worse which seems like it shouldn't. Shouldn't the receptors be more tolerant? Or maybe it is more like allergens where there is a certain threshold and then once that threshold is exceed you become more and more sensitive (e.g. poison ivy does this).

BTW capsaicin does have a theoretical LD 50 based on mice. So yeah if you eat enough it will probably kill you but it is an outrageous amount (~ 50-100mg/kg). You would have to have it extracted to do it (some one actually went ahead and did the math here on how many peppers: [http://skeptics.stackexchange.com/questions/6810/can-you- die...](http://skeptics.stackexchange.com/questions/6810/can-you-die-from- eating-chili-peppers)).

<comment><USER19> I had a similar experience. I grew up eating spicy food, with no issues whatsoever, aside from the topside burn. At 21 I experienced a tipping point wherein my gut became sensitive to spicy foods. I had to rethink my relationship with spicy food, else cope with the symptoms you describe.

I am very curious what the physiological basis for this change is.

</comment></comment><comment><USER20> I always found it interesting that our way of rating spiciness is through the subjective Scoville scale. Directly from wikipedia:

> In Scoville's method, an exact weight of dried pepper is dissolved in > alcohol to extract the heat components (capsinoids), then diluted in a > solution of sugar water.[3][4][5] Decreasing concentrations of the extracted > capsinoids are given to a panel of five trained tasters, until a majority > (at least three) can no longer detect the heat in a dilution.[4][5][6] The > heat level is based on this dilution, rated in multiples of 100 SHU.[4]

[https://en.wikipedia.org/wiki/Scoville_scale#Scoville_organo...](https://en.wikipedia.org/wiki/Scoville_scale#Scoville_organoleptic_test)

In other words, the test is fully subjective and has been found to be unreliable:

> A weakness of the Scoville Organoleptic Test is its imprecision due to human > subjectivity, depending on the taster's palate and their number of mouth > heat receptors, which varies greatly among people.[6] Another weakness is > sensory fatigue:[6] the palate is quickly desensitised to capsaicins after > tasting a few samples within a short time period.[4] Results vary widely (up > to ± 50%) between laboratories

<comment><USER21> It's not "fully subjective" by any sensible definition. Yes humans are the measurement device, and humans differ and are unreliable, but given a sufficient number of samples you arrive at more accurate numbers.

Nobody's going to give a paprika the same rating as a Carolina Reaper. You might have some give two very strong peppers the same rating, but then you might just need more people to test it.

In any case, the practical utility of the scale is mostly to get an idea of how spicy something is, it doesn't really matter much if something is 700K or 600K, it's enough to know that it's around 2x as strong as a Habanero.

<comment><USER22> Isn't there going to be a huge sampling bias? I certainly refuse to eat Carolina Reaper, and can't be the only one.

<comment><USER23> No, the Scoville test is based on a comparison of diluted samples. Trials are rerun with increasing dilution until the testers cannot detect the sample, and the level of dilution determines the score.

</comment></comment></comment></comment><comment><USER24> As someone who enjoys a good hot sauce or pepper, I was interested in this article. Have I done damage to myself by eating 5 million+ scoville sauces?

Unfortunately, this article is almost completely devoid of real information, and doesn't answer the question at all.

<comment><USER6> What sauces exist that at 5M+? If you're talking about pure capsaicin extract that you have added to your own food (essentially making your food into a sauce), then you aren't eating anything that is 5M SHUs, since that is not how the scale works.

<comment><USER25> Some of the Blairs brand of hot sauces claim up to 16 million on the scoville scale. I have tried the 4am sauce which claims 4M on the scoville scale, and it was not a laughing matter immediately, more crying, then laughing days later. (I love this stuff though, and would do it again!)

Having said that the stuff in the millions is pretty darn hard to find, they don't stock it or even sell it regularly.

Info: [http://www.ushotstuff.com/hotSauceHeatScale.htm](http://www.ushotstuff.com/hotSauceHeatScale.htm)

</comment></comment></comment><comment><USER26> The resturant they're talking about is Burger Off, in Hove. They famously make you sign a disclaimer before you eat the burger. I've seen several people attempt it, and they've all regretted the decision.

Brighton also has an annual chilli festival. There's a chilli eating competition, and paramedics are often needed by the losers, sometimes the winners.

It's a bit stupid really, a bit like the teenage-boyish pursuit of unnecessarily strong marijuana, but whatever floats your boat I suppose.

</comment><comment><USER27> Short answer: yes Longer answer: yes, and it can wreck you

[http://www.usatoday.com/story/news/2016/10/18/ghost- pepper-p...](http://www.usatoday.com/story/news/2016/10/18/ghost-pepper-puts- hole-mans-esophagus/92350120/)

<comment><USER28> But does that really count? Eating superhot peppers won't necessarily make you vomit, let alone make you vomit enough to rip your oesophagus (which is incredibly rare, even in the most intense bouts of vomiting).

FWIW, I grow these things, and have foolishly tried eating them raw a few times, and while I really wouldn't recommend it (the pain is indescribable, both in your mouth and in your stomach, and if you forget to wear gloves when handling them, many other places too), there's nothing particularly dangerous about it.

<comment><USER27> I'm a "food enthusiast" and have had raw + cooked ghost and scorpion peppers. Somewhere on YouTube there is a video of me making a proper ass of myself while crushing a scorpion/ghost/habanero hit wing challenge at Jake Melnicks in Chicago. I'm not ever gonna try the Carolina reapers as I don't see the point, but know they will rip you up pretty good. I always eat starchy or carby food before eating super spicy stuff and know it is genuinely no joke. It wouldn't be hard to get an ulcer or worse from some of those peppers.

</comment></comment></comment><comment><USER29> Anecdote allowed?

This reminds me of the Habanero Burger at "The Swinging Door" pub (I'm not sure it had the same name when I went there occasionally over 10 years ago, the first time actually almost 20 years ago in 1997) in San Mateo, CA [0]. (EDIT: It was the Prince of Wales pub previously! Lots of Habanero Burger stories: [1])

They had a "Wall of Flame" with stickers from all people who "survived" eating one. You had to sign a release form before you got your burger (shown in [1]). As another ex-colleague of mine used to say: Good spicy food hurts _twice_...

I only ever ate one tiny piece off a colleague's plate. Initially I thought "I feel nothing, what's the big deal?" I then spent a good part of the next half hour with my tongue hung out under flowing water from the faucet in the bathroom.

The people I saw try it either ate very fast, to be finished before the full pain set in, or very, very slowly. Except for an Indian friend of mine, who seemed pretty unmoved and ate the whole burger normally.

By the way, I don't remember the day of the week, but I always went there when the "Silicon Gulch Jazz Band" was playing [2][3]. Back then the (good) singer, an old guy (like all others in that band), played a washboard, really cool. The music was really good (the singing too) :-)

[0] [http://theswingindoor.com/habanero-burger- xxx/](http://theswingindoor.com/habanero-burger-xxx/)

[1] [https://www.yelp.com/biz/prince-of-wales-pub-san- mateo](https://www.yelp.com/biz/prince-of-wales-pub-san-mateo)

[2] [https://www.youtube.com/watch?v=2mOPl4BXqD8](https://www.youtube.com/watch?v=2mOPl4BXqD8)

[3] [http://www.sgjazz.com/](http://www.sgjazz.com/)

<comment><USER30> > my tongue hung out under flowing water from the faucet in the bathroom.

Oh god. Capsaicin is not water soluble. You just removed everything from your tongue BUT the capsaicin.

<comment><USER21> I wonder if I'm the only one who finds water helps a bit. I know it's not water soluble, but it has the effect of evenly distributing the burn around my mouth, which feels better to me.

For some reason I'm a lot more bothered by extremely localized pain than evenly distributed pain, when you chew a pepper you tend to e.g. disproportionately burn on one side of your tongue. Drinking some water and swishing it around in your mouth solves that problem.

<comment><USER30> I've heard water can break down the capsaicin into smaller parts. Could be what's happening here.

</comment></comment></comment></comment><comment><USER31> Fresh off the branch ghost peppers can cause terrible tissue damage for days similar to taking a shot of 192 proof alcohol except ghost peppers can have an incredibly deep and rich flavor for a few seconds before the burn becomes overwhelming.

[http://www.theliquorbarn.com/polmos-spirytus- rektyfikowany-1...](http://www.theliquorbarn.com/polmos-spirytus- rektyfikowany-192-proof-750ml/)

The stuff sold in stores diluted in vinegar simply can not compare to freshly grown ghost peppers. There really is an upper bound which humans can not safely handle physically. For freshly grown peppers this might just be several cubic millimeters of pepper.

</comment><comment><USER6> By the way, if anybody is interested in some REALLY crazy heat, check this out: [https://en.wikipedia.org/wiki/Resiniferatoxin](https://en.wikipedia.org/wiki/Resiniferatoxin)

</comment><comment><USER32> [http://www.jem- journal.com/article/S0736-4679(16)30256-6/abs...](http://www.jem- journal.com/article/S0736-4679\(16\)30256-6/abstract)

</comment><comment><USER33> In Cambodia we have these "bird's eye chilis" [1] and they're included in many dishes. How do these compare to some of the other chili peppers and sauces discussed here? I do have a high tolerance for heat (it's no problem to eat 20-30 of these in a dish, or eat them raw) but I'm not sure I could characterize their taste in any meaningful way.

[1] [https://en.wikipedia.org/wiki/Bird%27s_eye_chili](https://en.wikipedia.org/wiki/Bird%27s_eye_chili)

<comment><USER34> Thankfully a wikipedia editor has categorised the various articles based on the scale mentioned in the article [https://en.wikipedia.org/wiki/Scoville_scale#Capsicum_pepper...](https://en.wikipedia.org/wiki/Scoville_scale#Capsicum_peppers)

ie. bird's eye chilis 100,000–225,000 SHU vs ghost pepper 1,041,427 SHU

</comment></comment><comment><USER35> Reviewing video games while eating hot peppers: [https://www.youtube.com/watch?v=cTMIgyUZDDk](https://www.youtube.com/watch?v=cTMIgyUZDDk)

</comment><comment><USER36> At least on Chrome, bbc.com is hijacking middle-clicks and opening them in the same window. Who there thought that was a good idea?!

That's the first time I've seen that one. If you're a web designer, _please_ do not do that.

<comment><USER37> It's done that for years. The BBC UK news site is the same, hugely infuriating.

</comment></comment><comment><USER38> Some of the videos I've seen on YouTube look pretty darn painful.

</comment><comment><USER39> I seems you can hurt yourself - XXX Hot Chilli Burger of Hove has sent 5 people to hospital with it's 9.2 million Scoville burger. [http://www.dailymail.co.uk/news/article-2577255/XXX-Hot- Chil...](http://www.dailymail.co.uk/news/article-2577255/XXX-Hot-Chilli- Burger-fiery-FIVE-people-hospital-diners-sign-waiver-theyre-allowed-order- one.html)

</comment><comment><USER40> _But, hours or a day or so of very serious discomfort aside, there don't seem to be long-term dangers, per se, in eating very hot peppers. Biologists have observed, however, that administering capsaicin over long periods of time in young mammals does result in the death of the pain neurons, Bryant says. Setting the neurons off repeatedly wears them out, and they don't grow back._

Pff had to almost read to the end for that.

</comment><comment><USER41> You can pop as many as you like if you're a bird - [https://www.researchgate.net/post/How_did_birds_adapt_to_eat...](https://www.researchgate.net/post/How_did_birds_adapt_to_eat_hot_peppers2)

<comment><USER42> Unfortunately, no bird will ever read this.

</comment></comment><comment><USER43> "Any headline that ends in a question mark can be answered by the word no."

[https://en.wikipedia.org/wiki/Betteridge%27s_Law_of_Headline...](https://en.wikipedia.org/wiki/Betteridge%27s_Law_of_Headlines)

</comment><comment><USER44> tl;dr: Nothing long-term, but pain neurons might die off by prolonged/repeated exposure based on animal tests.

<comment><USER45> Meaning your tolerance doesn't wear off, and you only become more bad ass the more you keep eating close to your tolerance level.</comment></comment>


Zune, Google Glass, and the Newton Still Have a Lot to Teach Us - <AUTHOR> https://onezero.medium.com/grave-robbing-in-the-product-cemetery-923885982a97?source=rss----444d13b52878---4&gi=e8d9c36dbbb4 <comment><USER2> Some wise old man told me that "everything has a purpose, even if it's just to be the 'before' exhibit". I saved a piece of a Zune review from when the Zune debuted.

This is Andy Ihnatko, on the Zune:

"Avoid," is my general message. The Zune is a square wheel, a product that's so absurd and so obviously immune to success that it evokes something akin to a sense of pity...

Yeah, the Zune has a lot to teach us. I doubt anyone other than Linux fanatics among us will take the lesson.</comment>


Font Awesome 5 - <AUTHOR> http://five.fontawesome.io <comment><USER2> I quite like Font Awesome, but it strikes me as a bit bloaty to include 200 KB (best case) of files (i.e. all the icons) just to add a few icons.

Would the old method of a bunch of small png files in a directory work much better, now that HTTP/2 is here?

<comment><USER3> I just wanted to plug Icomoon ( [https://icomoon.io/](https://icomoon.io/) ) -- They will let you assemble your own custom font icon set using subsets of public glyphs such as FA, and your own SVG images. I Hope this helps someone.

<comment><USER4> I use icomoon and it is definitely helpful but I must say the UX for creating icon sets is quite scary to use. Clicking on an icon by default removes or adds it to the icon set, so its incredibly easy to exclude an icon you are using already (meaning next time you publish your font, that icon will no longer render on your page)

<comment><USER5> Yeah, I've done this countless times, only realising once I have packaged it into my project. I ended up creating a Webpack loader which takes a small JSON file and creates an icon set for my project. I could consider releasing it on Github if there is interest in something like this?

<comment><USER6> That would be awesome, I'd definitely be interested in having a look.

</comment></comment></comment></comment></comment><comment><USER7> The commercial is great! Who helped produce the video? I'd love to hire them for something like this.

<comment><USER8> Knox Avenue out of Los Angeles. Imagine getting a Sandwich Video made before they were astronomically expensive.

Ping me over email and I'll make an intro. Amazingly talented and honestly my favorite human beings I've met in the past month. CANNOT recommend them highly enough.

<comment><USER9> Out of pure curiosity, what's the ballpark cost of a commercial like this?

<comment><USER10> I haven't worked with this agency specifically, but it depends on a variety of factors - e.g. # of animations, actors/actresses, reshoots, reviews, etc. and how in-demand the agency is. It can usually run you low to mid six figures.

<comment><USER11> If I understand, Font Awesome paid >$100'000 for a video, in order to ask for $30'000 on kickstarter? Or do you think that this video was cheaper? (good will because of the open source nature of the project, or some other factor)

</comment></comment></comment></comment></comment><comment><USER12> This video alone merits my support. Well done. Well done.

<comment><USER8> Aw, thanks. We had a LOT of fun doing it.

</comment></comment><comment><USER13> I like FA because

1) it's FA and looks alright as it is

2) can't beat free, so I don't need to worry about licenses for every single web project

A completely redesigned, larger, commercial library might be interesting, but it is a new project and has practically nothing to do with FA 4.

<comment><USER8> Font Awesome Free isn't going anywhere. Re-design is largely due to changing the base size to 16px which requires a re-design to keep pixel-perfection.

<comment><USER13> Thanks. Remaking all of FA Free sounds like a lot of work for little benefit, but I imagine it makes sense in the light of all the extra icons you're adding to Pro.

<comment><USER8> Honestly, the grid system in 4 is quite inconsistent, especially with vertical centering. But that happens over time with an open source project. Things wander each commit.

Been jonesing to start over for a while. Super excited.

<comment><USER13> Looking forward to it! Can't go wrong from a user's point of view, like this we get both FA4 and FA5.

</comment></comment></comment></comment></comment><comment><USER14> I had submitted an issue about the removal of the non-identifying direct CDN link to FontAwesome in favor of a user-identifying JavaScript embed, and it was closed. I tagged in to another issue to make the same point,

[https://github.com/FortAwesome/Font- Awesome/issues/9245#issu...](https://github.com/FortAwesome/Font- Awesome/issues/9245#issuecomment-224039112)

Still no answer. Am I the only one that cares that the current state of FontAwesome encourages tying your email address (via a unique token) to your site's specific FontAwesome usage?

<comment><USER8> There are plenty of places to serve Font Awesome from a CDN for free. All the old options are there (and still listed in the documentation).

[https://www.bootstrapcdn.com/fontawesome/](https://www.bootstrapcdn.com/fontawesome/) isn't going anywhere anytime soon.

(Also, 4.7 was released today with 41 new icons. If you had one of our unqiue CDN links, you'd be able to upgrade without pushing any code.)

</comment></comment><comment><USER15> Using plain svgs nowadays, never looked back.

<comment><USER16> Yes, using fonts for icons was always a wee bit of a hack. The only real major advantage over SVGs was easy sizing for being inline with text.

<comment><USER8> The implementation with the :before class definitely qualifies as a bit of a hack. No question.

Some of the icons themselves represent something of a universal language for websites. Using those symbols in a typeface is similar in some ways to character based languages like Japanese or Chinese. So I might argue that icons as fonts are quite an appropriate use.

</comment></comment></comment><comment><USER17> I work for a corporate. A South African based company with inroads' in England and the USA. Should I donate in my personal capacity or ask the company to contribute? Yes, we use fa on our front-end projects.

<comment><USER8> The licenses follow the person or organization. If it's for a personal project, then you'd want to have one. If for the company, then the company would want one. :)

</comment></comment><comment><USER18> Well at least now I know why they've held back so many useful icons from the free version.

This one's a classic: [https://github.com/FortAwesome/Font- Awesome/issues/1958](https://github.com/FortAwesome/Font-Awesome/issues/1958)

</comment><comment><USER19> I feel the free version has been neglected ever since the commercial versions were born.

Also, there are too many unnecessary brand icons (e.g. skyatlas? houzz? most people aren't gonna use those).

Donated $5 anyways.

<comment><USER8> Appreciate the pledge! As it turns out, we get far more requests for brand icons than anything else.

And you're right. It is a bit neglected. That's why we're re-doing everything. :)

</comment></comment><comment><USER20> Have thought for awhile that fontawesome is excellent and was sucked in by the great kickstarter video - you get my first kickstarter backing!

<comment><USER8> Thanks for the kind words! We had SO much film writing and filming that thing!

</comment></comment><comment><USER21> I love fa, I don't see an explanation as to why it's necessary to redesign the set though. Does anyone know?

<comment><USER8> 16px grid system is the biggest reason. Currently, FA is at 14px. To do it pixel-sub-perfect, we'll need to do it all from scratch.

Oh, and the icons aren't that consistent. It happens over time as you do 40-ish icons per release. It wanders a bit and you lose consistency.

We're fixing all that.

<comment><USER21> Treading dumb question territory, what's wrong with 14px to demand the switch to 16?

<comment><USER8> Mostly the base font size on the internet is changing. For instance, old Bootstrap 3 is 14px. New Bootstrap 4 is 16px.

<comment><USER22> It has been 16px as default for as long as I can remember. People _designed_ at 12-14px and it has been trending larger, 18-22px, for quite some time now - at least since 2012-2013. I think larger screen sizes plays a big part in the change, or maybe marketing people realized people dislike small text/prefer larger text? :)

Coders have learned that it's best to not touch the default font size, or resize html/body font size. The ugly 62.5% (16-->10px) is also dying out for accessibility reasons.

</comment></comment></comment></comment></comment><comment><USER23> Big fan of Font Awesome - I use it for all my client projects. Just pledged $20 on the KS.

</comment><comment><USER24> I'm a huge fan of Font Awesome and have been a user of it for years. I'm quite excited for the new version, and am proud to pledge for the development of FA5!

</comment><comment><USER25> Any idea why there's no FA icon(s) to represent police, sirens, badges? Anything relating to civil authorities? (well, I guess there's some fire stuff).

<comment><USER8> We normally prioritize from top to bottom based on number of requests and upvotes. For these, there just haven't been enough.

I really like that icon category though. We'll add it to the potential stretch goal icon category packs.

<comment><USER25> Oh hey, thanks! It was not a complaint, but I wasn't sure if perhaps there were other factors (concern about representing life-saving activities via your icons, for example).

There are some security apps a family member is working on, and having some more related icons would help make his app better. We were talking about it this morning, and then this post arrived.

Thanks!

</comment></comment></comment><comment><USER26> They are calling it pro as I imagine their other offshoot didn't work or make any money. It was that black bar at the top of the screen each time you go to the site. This makes sense, but maybe they shouldn't have tried to name it something different in the first place.

</comment><comment><USER27> Even pledgers to the $5,000 tier have to choose between mug and t-shirt! Throw in a mug, will you? :p

<comment><USER8> No, they get 5! They get to choose if they want mugs OR shirts. :)

(Seriously, those mugs are going to be awesome. Enamelware lasts forever and we found this fantastic place to make them. They'll probably outlast me.)

<comment><USER27> You're tempting me now.

</comment></comment></comment><comment><USER28> Any ETA on when backers will get private repo access? Super excited for this!

<comment><USER8> We'll add folks when everything clears through Kickstarter. Should be just a week or so after the campaign ends.

Already have a huge start on things.

</comment></comment><comment><USER29> I just wonder how licensing for the pro version works in regards to open source projects? If I buy the license, can I use it for my open source project?

Also the option to commission your own icon is really exciting! :-)

<comment><USER8> I'd say just don't put the commercial version in a public code repo where other folks could easily use it. But if you avoid that, open souce projects would definitely qualify for our $20 non-profit license.

And Font Awesome 5 Free will be pretty awesome too. Your pick.

<comment><USER29> "if you avoid" \- you mean if I just include specific icons from the Pro version?

<comment><USER8> Well, the real problem is that every resource is available for folks to use, even those that aren't intended (typefaces have the same problem).

Ping me offline. We'll get you something for the open source project you're happy with where you can use Pro.

<comment><USER29> Super! Thanks.

</comment></comment></comment></comment></comment><comment><USER30> Just have to say, that Kickstarter video is hands-down one of the funniest I've seen. Wonder how much they spent on that.

<comment><USER31> I love how he just stands with his axe for a while in the end, taking in the room, and enjoying the bouquet of his glass of sprinkles.

</comment></comment><comment><USER32> I don't understand why someone would choose the student license over the small business one.

<comment><USER33> The small business license is only available for a limited time only.

<comment><USER32> Isn't the student one also for a limited time as well?

</comment></comment></comment><comment><USER34> Really cool video! Can anybody guess how much it may have cost them to make?

</comment><comment><USER32> Can we get a backer reward to get both the t-shirt and mug?

<comment><USER8> Yes! Just add an extra $30 to your pledge and we'll take care of the rest during the survey phase!

</comment></comment><comment><USER35> Why are they running a Kickstarter if they actually have a "PRO" business model thing going? Shouldn't they just focus on building their business, instead of raising money? The video is cool-hip-quirky but... I don't get why they need to stick out their hands and ask for a handout here.

<comment><USER36> They totally lost me when the video announced a PRO version. Sorry, you can't claim to be open source while a few seconds later showing a paid-for version. Shame.

<comment><USER37> Open source doesn't necessarily mean free

</comment></comment></comment><comment><USER38> Still no Node.js or npm icons after almost 3 years? Thanks but no thanks.

\-- Edit: not trying to be sarcastic or blaming anyone. I'm saying what I feel about Font-Awesome. If you don't like my thoughts, you just have to live with that. As a member of the community, I guess I also have rights to ask for something, which I do, and I guess I also have all the rights to talk about something that I've been waiting for, for a long time.

Thanks for the downvotes. I hope you can ever understand what was written in the future before downvoting it.

<comment><USER8> We prioritize based on number of upvotes. Most everything in 4.7 was over 100 upvotes and some even almost at 300.

In FA5 we're adding a good number more brand icons. Entirely possible they make it in.

<comment><USER38> Wow, didn't know that. At least for the 100+ part. Thanks for the clarification.</comment></comment></comment>


$50K bounty for practical robocall-killing technology. - <AUTHOR> http://robocall.challenge.gov/ <comment><USER2> I dispute their contention that an "ideal" solution would not block political or charity robocalls. Ideally we close these loopholes in the No-Call List, so these all are illegal.

It seems to me a lot of the problem results from allowing the caller ID information to be spoofed. Any serious attempt to fix this problem would seem to involve tracking down real numbers, defeating the spoofing.

Most satisfying (and effective!) thing I have ever done to eliminate a repeated scam call (to lower credit card interest rates, never admitting who they're with, except some vague reference to imply they're associated with the credit card companies) is to string the guy along, when I am "going to get my credit card", setting the phone down and going about my other business, until it's clear he finally hung up. Then he called back, and I said "when I got back to the phone you weren't there!", and repeated the game a bunch of times over the day, with the guy getting more & more exasperated. Funnily enough, I never get those calls anymore...

<comment><USER3> Caller ID spoofing is a true misfeature. The ability should be removed, or consumers should have out-of-band access to the real number in order to be able to _at least_ blacklist it.

<http://www.catb.org/jargon/html/M/misfeature.html>

<comment><USER4> Phone numbers are to the telephone network like IP addresses are to the internet. Caller ID is to phone numbers as DNS is to IPs. I don't think getting rid of caller ID would really help anything, and you can't fix the caller ID to specific numbers, as phone numbers are as transient as IPs -- they can terminate to an IP phone in Pakistan one day, and to a Twilio gateway used by some other company's apps the next day. Blacklisting the number can be both ineffective and harmful.

Letting the caller set the caller ID is the only way someone calling you from Comcast about your bill can have Comcast show up on the ID. Most large companies like that don't own the numbers they call from, or the call centers -- they outsource both inbound and outbound phone support and sales. Typically to multiple phone center companies at the same time, who all have to call "as" Comcast, and ramp up or scale down with more or less phone numbers as needed. They'll use autodialers too, with real people rather than recordings, to minimize the delay between one outbound call ending and there being another person for that now-available rep to talk to.

<comment><USER5> The ability to set caller-id is important. I was surprised by how easy it is. With the free X-Lite SIP softphone and a flowroute.com account, I can set an arbitrary caller-id number and place a call to anyone. This is very useful, as it lets me place cheap VoIP calls "from" my mobile phone number. It could also be used to get into voicemail and other systems that trust caller-id.

<comment><USER6> Businesses can detect your billing number, the ANI. Having been involved in a system where employees logged in and out of work via the telephone it was very important that we could prove where they were. We had many people attempt to spoof it which never worked.

So the information is there. However it is worth a lot of money to the phone company and they sometimes resell that information to others who repackage it. They also in turn don't always give you this information even when you pay for caller id which is similar but not the same. Originators can block paid caller id, I have never seen a case where you can block ANI subs

<comment><USER3> I was under the impression that ANI was forced on WATS lines, but that it didn't necessarily exist for residential, shall I shift my understanding? I think this could actually be a good lever, putting the problem purely into the policy domain.

</comment></comment></comment></comment></comment></comment><comment><USER7> All that I want is this.

Right after I get a call I don't want, have another number that I can call. If I call that number, I'm telling the government, "My last call was an unwanted robocall."

Trace that call to its source (as best as that can be determined). If that source has generated a lot of calls recently, and is not on a white list, it is blocked. Any attempts from that number to make a phone call go to a recorded message saying that it is blocked, with instructions for how to get unblocked.

Any phone number that gets blocked several times in a week is permanently blocked.

<comment><USER8> After I get an unwanted robocall, I want to dial "*RC" for "RoboCall". I get a credit on my next phone bill for 25 cents. The phone company charges the originator 50 cents. Now the phone company has an incentive to track all robocalls. And I have a little compensation for my time.

<comment><USER9> If the phone company is going to charge the originator, they'd have to verify that the call you reported was actually an illegal RoboCall. Some dishonest people might report people whom they know but don't want to hear from as RoboCalls. Others might erroneously report organizations that are legally allowed to call them, like companies with which they had a business relationship or political candidates. Verifying that each claim was valid would probably cost the phone company much more than 50 cents.

<comment><USER10> > If the phone company is going to charge the originator, they'd have to > verify that the call you reported was actually an illegal RoboCall

If I'm getting unwanted calls, I don't really care whether the government thinks they are legal, I just want them stopped.

How about this solution: if the caller ID is on a whitelist, it goes straight through. If not, the caller gest asked a question (which should filter out robots). If there are determined human unwanted callers, a second line of defence would be to ask them to key in a 4 digit code (and I'd only give the solution to people who wanted to call me).

<comment><USER11> Google voice lets you do something along those lines. I personally found it incredibly tedious and quickly turned it off.

I think the grandparents idea of *RC is spot on. Verification can be done through volume; i.e. a one-off may do nothing but repeated reports indicate something is up. Just like reporting spam in email.

Along those lines, some sort of charge-to-call system may work. Like calling collect in reverse, but the receiving party can decide to not charge the fee if its someone they know (or flip it, hitting # within 30 seconds of an inbound call will capture the fee and disconnect)

</comment></comment></comment></comment></comment><comment><USER12> I don't just want robocalls killed. I don't want calls from politicians, charities, pollsters or any other exempt organizations either. I don't want calls from the debt collectors trying to reach the person who used to have my number. For me, and people like me, a telco-based solution won't work because they have to adhere to the regulations that have these giant exemptions.

In volume, you could make a device for landlines for probably <$50. Connect the device to the primary incoming line. Connect phone(s) to the device.

User dials #4321 (some non-secret activation code, printed in instructions and sticker on device) from house phone. Follows prompts to record (a) his name, (b) names of other individuals at the house, (c) one or more bogus names. May also follow prompt to enable a bypass code. May also follow prompts to add CID numbers to whitelist (see below; this is for DESIRABLE robocalls, e.g. from the school district in case of emergency or school cancellation). User hangs up; device is programmed.

Incoming call, 2 rings, CID/CNAM captured (FWIW), house phones do not ring. Device answers: "Calls may be recorded. Press 1 for Bogus John, 2 for Real Alice, 3 for Real Bob, 4 for Bogus Carol". Caller presses 1/4, "Please leave a message after the tone", tone plays, incoming voice goes to /dev/null for 10s, call is dropped. Caller presses 2/3, house phones ring, stored CID/CNAM is provided.

If the incoming caller uses the bypass code, the call goes straight through.

Bonus: distinctive ring for Alice vs Bob.

Bonus: after an annoying human caller "leaks" through, user can hang up, pick back up, and dial #5432 [some other non-secret access code]. Incoming CID put on block list. Calls from blocked numbers are unanswered (will go to VM if user subscribes to VM from telco).

Bonus: similar to blacklist, user can dial #2222 (for "whitelist to Alice") or #3333 ("whitelist to Bob") to whitelist a just-received call. Whitelisted calls immediately go through. DR means that I don't have to check CID to know it's my MIL calling for wife. Numbers can be whitelisted during programming (see above) because desirable robocalls (e.g. kids' school) will otherwise never get through and can't get #2222 treatment.

Bonus: pressing ## (or some other code) during a call starts a recording. Saved as <cid>-<date/time>.wav to removable flash or USB on the device.

Bonus: insert flash/USB, dial #9876 from house phone. Device upgrades itself from the flash.

</comment><comment><USER13> We use an answering machine to screen calls. I put SIT tones (the tones usually followed by a network message such as "we're sorry but the call cannot be completed as dialed" -- google SIT.WAV) at the beginning of our outgoing message. We don't pick up until the message ends.

We get a lot of 'ghosts', calls dropped before the message is done -- those were automated calls. We get callers which are partway through delivering a canned spiel at that point because their delivery system triggered on the tones as if 'your-turn' beep -- those were automated calls intended to be left as recorded messages.

It's not exactly what the contest is about, but it does provide some personal relief on a landline.

</comment><comment><USER14> So AT&T has the technology to bill each subscriber down to the bit of data used, but they can't detect when an entity is making 10s of thousands of calls . . . . ?

<comment><USER15> 10s of thousands of calls isn't necessarily illegal, nor unwanted.

Phone companies will probably claim to be just a pipe for data, and that they cannot interfere with that data, and that regulation is for other people. They'll stop you if you're damaging their network.

Cynically I'd say that a company making tens of thousands of calls is worth more to the telco than me, making very few calls. (I doubt that's actually the reason.)

</comment></comment><comment><USER16> Help me out here as a UK person: What sort of Robocalls are there ?

Here in the UK there are variants.

      1) Pause to hear you pickup, then they connect to a human salesperson

      2) Full blown automated call

      3) Human on the other end but how did they get your number ?

I have a solution, but can't enter as I'm outside the US :(

<comment><USER17> Still you choose to keep your solution to yourself? :)

<comment><USER16> I figured I'll wait until the competition is over.

When I see the announcement of the winner, it may be better than my implementation and I will congratulate them.

If not, then I'll post mine and see.

</comment></comment></comment><comment><USER18> There should be a Kickstart project for this. Lots of people would pitch in. I'm sick of these daily robocalls.

</comment><comment><USER19> Please robocall-kill "Ann from Account Services". I must get an average of 4 calls a week from that scratchy-voiced hag.

</comment><comment><USER20> I feel like robot calls used to be much more common. I think I only get maybe 2-3 a year now. I think most recently they were from DirecTV and GNC. I tend to give out my Google Voice phone number to businesses and non personal contacts so I can block them if they sell my number or start robo calling it. Although I've only had to block maybe 1 or 2 numbers on google voice in the last few years.

I wish the iphone had a way to create a black list and block callers. I'm not sure why they've never implemented this. I know it can be done by jailbreaking but it seems like it should be part of the os.

<comment><USER21> On Android: Mr Number and other call screening apps exist. I use this, though the app has been getting a lot more snoopy/annoying of late.

</comment></comment><comment><USER18> Penalty should not just be on the illegal robocalling telemarketers, but should also on the businesses contracting the telemarketers. Cut the funding off from the sources.

</comment><comment><USER22> They should let people pledge donations to increase the bounty.

</comment><comment><USER21> An endpoint-based fee-collection system.

"To complete this call, a payment of $NOMINAL_AMOUNT is required. This may be refunded at the discretion of the caller."

In actuality, you'd whitelist numbers not required to make payment, and/or clear other numbers at the end of your billing cycle if desired. Payment options would be provided. The call would not ring through until authorized or paid.

This would increase the costs of phone spam markedly.

Survey organizations would have a bit of a problem. Oh well.

<comment><USER21> Erm: discretion of the callee.

</comment></comment><comment><USER23> Would it be possible to use the same technology of SSL with phones? Have the telco, who presumably knows the endpoint of the call can either apply an SSL certificate (or equivalent) to the call so that the receiver can confirm their validity?

Or, alternatively, much like how websites currently operate, the person making the call would have to attach their certificate which the receiver could check against CA(s). This would be nice because if certain CAs had rules where they wouldn't sign up certain numbers (telemarketers, politicians), you simply wouldn't use that CA to validate calls.

</comment><comment><USER24> I definitely know where you're coming from. I get calls like that a lot and I With all the consumer complaints these nuisance calls created, I don't understand WHY these companies still operate!

Well, yeah, there's that thing they call the freedom to "advertise" but what the ____?? They're already trespassing into our freedom to privacy!

I don't know anybody who'd disagree but if these companies continue this unethical business practice, I would surely be happy to see them shut down!!!!

</comment><comment><USER25> Can anyone explain why this is hard, technically?

<comment><USER26> Sure. If you plan on implementing this as some sort of end-user device that would be hooked up to a phone handset or a software "app" you would install on a smart phone, then all you've got to work with is caller ID. Caller ID can be blocked by the caller (e.g., by dialing *67 first) and spoofed, including the purported outgoing number. In fact, VoIP systems like Skype have made spoofing caller ID and now even ANI, a toll network analog of caller ID, trivial.

So even if you keep some sort of constantly updated database of numbers used by robocallers, you are still relying on the robocallers 1) not blocking outgoing caller ID and 2) not spoofing the numbers of legitimate users resulting in them getting blacklisted.

<comment><USER27> >VoIP systems like Skype have made spoofing caller ID and now even ANI . . . trivial.

Is there any way for hardware connected to an ordinary phone line to distinguish between an incoming call from a VoIP system versus an incoming call from an ordinary phone line?

</comment></comment></comment><comment><USER15> You pass a law saying that all robocalls must comply with ROBOCALL_STANDARD.

You include a regulator in that law. The regulator is responsible for updating the standard as needed, and for taking reports from people who receive a robocall, and for imposing sanctions on companies who i) do the robocalling and ii) ask other companies to do the robocalling for them.

Sanctions include fines for the companies; potential prison time for the directors of those companies (obviously this would need to go through court) and 'blocking of numbers by telecom companies' (not sure how realistic that is.

The regulator has an "opt out" list. Every one with a phone who doesn't want to receive calls registers on that list. New numbers are added by default. (They can maintain an "Opt in" list, so people who want to receive junk calls can).

Then the regulators set up a website. This site contains a simple report form; the opt in and out lists; links to the current standard; links to the law; links to previous adjudications.

If CompanyX uses a robocall company in a different country you can still go after CompanyX. Not sure what you'd do if both CompanyX and the robocall company are overseas with no US presence.

</comment><comment><USER28> Hey, Shazam there's an almost "free" prize waiting for you. Just make an app that hooks into you calls on demand and records & forwards suspected robocall's to match them against validated malicous ones. Someone else might figure out the telco backtrace part with timestamps and so on.

</comment><comment><USER24> And guess what? All you trespassers out there, be aware that I am reporting your phone numbers to Callercenter.com every time you call. Just so you know, in case you start wondering why your calls seemed to be blocked.

You want publicity by harassing me? I give you just that. Negative publicity!

</comment><comment><USER29> I believe Google Voice has already solved this problem. Just as with email, click report spam and the whole user-base benefits. I suppose Google could share that phone number list with others providers.

</comment><comment><USER30> This just reeks of the FTC abdicating its responsibilities to enforce the existing laws. Show me the budget the FTC spends on prosecuting violators of the law and maybe I'll change my mind.

</comment><comment><USER31> What I think would be cool is to be able to forward the call to a smart enough bot that wastes like 5 minutes of their time every call. This will surely kill their spammy business model

<comment><USER12> Robocalls aren't necessarily interactive. You can't waste their time.

</comment></comment><comment><USER32> Why does a company need at least 10 employees to compete in the Federal Trade Commission Technology Achievement Award?

<comment><USER27> You're reading it wrong: if the winning team has fewer than 10 employees, the team gets $50,000. 10 or more, the team gets no cash, just bragging rights.

</comment></comment><comment><USER33> Just ban robo-calls. Make it illegal.

<comment><USER34> They're already illegal. This is an enforcement problem.

<comment><USER35> And why isn't this a problem in Europe? E.g. Germany? I'm not getting any unsolicited phone calls anymore - robot or not (this used to be a problem 15 years ago, but not isn't anymore).

<comment><USER36> There are national do-not-call registries. Companies are required to check those before calling. If they don't then they get fined, which usually starts at around 25,000 euro.

This is for The Netherlands, but I believe it's similar throughout Europe.

<comment><USER37> The U.S. also has a do-not-call registry that you get fined for violating (donotcall.gov). The problem is that they don't know who to fine, because it's really easy to spoof caller ID and the businesses aren't dumb enough to identify themselves.

<comment><USER38> How can those businesses try to sell you something without identifying themselves?

Also, there must be some weird political or legal reason why they can't (or won't) get the identity from the phone companies. It can't be a technical reason, because they're already capable of tapping everything, and the phone companies are already in full cooperation with that, even developing and providing specific technical interfaces for law enforcement.

And, maybe someone can tell me if this is actually possible (as opposed to a "CSI" type exaggeration): In many police series you see them requesting full cell-phone logs of all incoming and outgoing calls to a certain phone in the past few weeks or so.

In case that's realistic, I certainly hope that it can't be foiled by something as simple as spoofing the caller ID? Because, you know, that'd make it really easy to frame someone.

<comment><USER37> I haven't seen or heard one of these calls actually play out, but they might not even be trying to sell something - they could just be scammers out to steal credit card information. (I get one all the time that's a prerecorded message from "Rachel from Cardholder Services")

I'm sure telephone companies could _technically_ stop them if they really wanted to, but telephone companies make a profit from these people. What incentive do they have to stop them? Same with text message spam. If they tracked it (which they surely collect enough money per message to do), they could easily notice one number sending a hundred spam texts and stop it before it sends tens of thousands of them. They don't, though, because each of these messages means anywhere from another 5 to 25 cents in their pocket. Most people don't even contest getting charged for receiving spam texts, because who's going to argue over a quarter?

The biggest issue seems to be that all of this data is ephemeral - even if they had a "more powerful" caller ID (which I believe 911 dispatchers do), you would have to catch them in the act and personally have access to check where the other end of the call is terminating, and you'd have to do it before they hung up. For IP calls, I think it's unlikely they would even be able to fully trace it.

<comment><USER38> > What incentive do they have to stop them?

That it's illegal? (the ones that are)

<comment><USER37> It's not illegal for the telephone company to not try stopping them.

</comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER39> "Contestant further represents, warrants, and agrees that any use of the Submission by the Sponsor, Administrator, and/or Judges (or any of their respective partners, subsidiaries, and affiliates) as authorized by these Official Rules, shall not:

a. infringe upon, misappropriate or otherwise violate any intellectual property right or proprietary right including, without limitation, any statutory or common law trademark, copyright or patent, nor any privacy rights, nor any other rights of any person or entity;

b. constitute or result in any misappropriation or other violation of any person's publicity rights or right of privacy."

(<http://robocall.challenge.gov/rules>)

I find this clause rather disturbing, I think I know what they meant to say, but they instead wrote something so overly general, that if enforced, effective makes this competition un-winnable. Maybe someone else can weigh in on this.</comment>


New York City's MTA Exposed (2005) [pdf] - <AUTHOR> https://events.ccc.de/congress/2005/fahrplan/attachments/594-paper_MagneticStripeTechnology2.pdf

<comment><USER2> "Interestingly enough, track 12 does not only contain information pertaining to the last use, but also to the use before that."

This might explain why the system sometimes asks you to "Swipe again" when going through the turnstiles. maybe the write failed?

In the 90s the system had tokens. Someone figured out a cheap way to game the system using inexpensive South American coins..

[https://news.google.com/newspapers?nid=1955&dat=19951206&id=...](https://news.google.com/newspapers?nid=1955&dat=19951206&id=XVwxAAAAIBAJ&sjid=hKYFAAAAIBAJ&pg=2338,4467511&hl=en)

<comment><USER3> Wouldn't the most likely reason to "Swipe again" be that the read failed?

<comment><USER4> The display sometimes reads "Swipe Again At This Turnstile," which might imply that data corruption would occur if you swiped elsewhere...

<comment><USER5> I once saw that when using a pay-per-ride metrocard and swiped at a different turnstile. I ended up having two rides deducted instead of just one, so I lost a swipe.

</comment></comment></comment></comment><comment><USER6> MTA cards are terrible. So is MTA's customer service. I lost $60 (2 7-Day Unlimited cards) because the two cards were demagnetized. They weren't next to each other, but both were kept close to cellphones. I went to the MTA booth and they staff said to mail the cards so I can get a refund. This may work for NYC residents, but foreign tourists will never see that money again. The card and system is so bad, that one may actually think they want this to be bad so they can profit more.

<comment><USER7> I'm not sure what the booth staff are even there for. Every time I've had an issue when visiting NYC, they tell me to mail stuff to the MTA. Machine ate your twenty dollar bill? Write a letter. Card not swiping? Write a letter.

<comment><USER8> Giving directions, help with non-working cards (I've had them fix a card before), etc. The usual agent at High St. also says hello to me when I'm coming home at 2:30 in the morning.

Maybe they can't fix every problem, but overall, not bad to have around.

</comment></comment></comment><comment><USER9> The tone the turnstile makes when it successfully reads the card, and fails to read the card, are the same. Don't be blind!

<comment><USER10> The tone _lasts for infetesimally longer_ when it fails to read the card. Good luck telling the difference, even if you're blind.

</comment></comment><comment><USER11> What would happen if you used your own blank plastic magnetic card? Would it be more durable? Would the vending machines refuse to load your fare onto them?

(I imagine the MTA doesn't have enough money for upkeep, let alone upgrading the turnstiles with NFC readers.)

<comment><USER5> The MTA has planned to upgrade to a tap-to-pay system in its 2015-2019 capital program, but that budget has a huge shortfall. Regardless, last I heard the metro cards are getting too costly to maintain so the rollout may still happen.

</comment></comment><comment><USER12> Does anyone know if the original requirements documents for these systems was ever published or archived?</comment>


VMware acquires Heptio, the startup founded by 2 co-founders of Kubernetes - <AUTHOR> https://techcrunch.com/2018/11/06/vmware-acquires-heptio-the-startup-founded-by-2-co-founders-of-kubernetes/ <comment><USER2> For me it looks like IBM and VMWare are reinventing themselves trough these aquisitions. If you work with enterprise customers, you can see how much they hate these kind of vendors, and how eager they are to understand open-source solutions,and to adopt the fast pace of internet companies. IBM and VMWare understood this too, and now they are adapting to this new landscape. I am confident that when IBM will say to my customers: hey, we can deploy and support Kubernetes for you (with the same agilty as your existing small vendors) they will go for it, just to get rid of the bureaucratic burden generated by their purchasing departments, and us, the small vendors will have to reinvent as well, and this is how innovation happens.

<comment><USER3> Is that any different than

Microsoft - PowerPoint, Hotmail, FrontPage, Windows Live Messenger, Visio, Bungie, Rare, Lionhead, Mojang, Dynamics (Great Plains, NAV), Skype, Defender, Perceptive Pixel (Surface Hubs), Yammer, LinkedIn, Acompli (Outlook Mobile), GitHub, Xamarin, Beam (Mixer)

Facebook - Beluga (Messenger app), Snaptu (Facebook for Every Phone, Facebook Lite), Instagram, Atlas, Parse, WhatsApp, Occulus, LiveRail (video monitization)

Adobe - PageMaker, After Effects, Photoshop, FrameMaker, GoLive, Audition, Echosign (Adobe Sign), Macromedia (who itself acquired Freehand, Dreamweaver, Flash, ColdFusion), Fireworks, plus its entire Marketing Cloud: Omniture, Day, Auditude, Neolane, Livefyre, TubeMogul, Magento, Marketo etc

Oracle - ...

the list goes on and on. A lot of these products would not be where they are today (nor shuttered necessarily) without the resources (or lackthereof) poured into them after acquisition. Yahoo tried and failed miserably in its end.

Facebook may be the best example on that list. They get beat to mobile messenging, they buy Beluga. They lose screen time to mobile devices, they buy Snaptu. They get beat again to mobile (camera/photo album), they buy Instagram. The get beat by in messenging AGAIN, and they buy WhatsApp. They get beat to video by youtube, they buy LiveRail. In a panic to not be beat again they buy Occulus.

Plus, in this case they are mostly buying the Reputation and Service Contracts, not as much the product. IBM is already mostly a Service, not product, company now.

<comment><USER4> Google is a great example too. Many of Google's best-known hits began outside of Google:

* Maps (maps from Where2 Technologies, acquired in 2004; real-time traffic from ZipDash, acquired in 2004; satellite imagery from Keyhole, acquired in 2005)

* Android (founded in 2003, bought for $50M+ in 2005)

* YouTube (founded in 2005, bought for $1.7B in 2006)

* Adsense (Google acquired Applied Semantics in 2003, DoubleClick in 2007, and AdMob for mobile ads in 2009)

* Google Docs (spreadsheets by 2Web, acquired in 2005; docs by Upstartle, acquired in 2006; slides by Tonic Systems, acquired in 2007)

* Waymo (Thrun's team, 510 Systems)

A long list of Alphabet's acquisitions are on Wikipedia: [https://en.wikipedia.org/wiki/List_of_mergers_and_acquisitio...](https://en.wikipedia.org/wiki/List_of_mergers_and_acquisitions_by_Alphabet)

<comment><USER3> Even IBM Cloud is largely built from SoftLayer, Cloudant, Compose, Cleversafe etc, RedHat fits perflectly with IBMs strategy since 2014.

Interestingly enough, IBM has even left [https://www.compose.com/](https://www.compose.com/) as a standalone entity for now.

</comment></comment></comment></comment><comment><USER5> Heptio got a world class team. Congratulations to the founding team. Having played with and followed the Kubernetes ecosystem for the last couple months, I'm wondering if this was not all planned:

Find a hot niche market (Kubernetes). Play the "Cool" card on social network, and hire all the "most famous" Upstream kubernetes contributor (typically those that tweet a lot). Those newly hired contributors, make the company even cooler and there is now a perception everywhere that the company is the next big thing. The product build by the company is not as important as the hype they got (as shown by the other posts that wonders what they actually do).

At this point, a big business jumps in desperate to get some of the hype branding for that new market (Kubernetes) and pays big money for what is essentially a huge acqui-hire (mainly acquiring the Heptio reputation).

This existed before with Openstack, and other similar hype cycles.

</comment><comment><USER6> I'm sure everyone involved made some money but aren't they basically a consultancy?

<comment><USER7> Really? With all the tools they have written that are open source and on GitHub?

<comment><USER6> Are they selling them for money? Or are they just things useful in the consulting process and a way to create awareness for the company?

The website advertises professional services, training, support subscriptions, and books. Redhat model I guess.

</comment></comment></comment><comment><USER8> Surprised to see them get acquired so soon.

> Terms of the deal are not being disclosed — VMware said in a release that > they are not material to the company

Can we make an intelligent guess about the upper bound of the transaction? i.e. would it have to be < $500 million? < $1 Billion?

<comment><USER9> IIRC, public companies have to disclose above $84MM, though perhaps not immediately.

<comment><USER10> The threshold of required disclosure is based on what's material to the public company involved. This is an accounting concept that scales up as the company is bigger. But sure for many companies $84MM would be material.

</comment></comment></comment><comment><USER11> Curious what the relationship will be like with Pivotal now. It would be a little odd if Vmware makes something that competes with PKS.

<comment><USER12> Pivotal is amped up and excited about the acquisition. Check out @rseroter's Tweet: [https://twitter.com/rseroter/status/1059738266189017088?s=09](https://twitter.com/rseroter/status/1059738266189017088?s=09)

<comment><USER11> I saw that, but also saw this on Heptio's blog post about the announcement:

 _" Heptio's mission is to build a platform that accelerates IT in a multi- cloud world."_

Just feels like some overlap with PKS, and both companies being Dell owned is interesting.

<comment><USER13> I mean PKS is vmware and pivotal co-developed.

</comment></comment></comment></comment><comment><USER14> Did Heptio do some consulting for Amazon AWS? They have a guest blog post from memory, and im wondering if they helped kickstart EKS? Obviously they built aws-iam-authenticator, and as a company worked with AWS services... I would have thought Amazon acquiring them would have made way more sense?

<comment><USER15> In general, Amazon doesn't aqui-hire as much as some other tech gians. They acquire things instead of spending CapEx (Whole Foods), to vertically integrate (Annapurna Labs), or things with very good customer bases, and brands (Twitch, Zappos).

Heptio had none of these.

EKS seems like more of an "OK, fine, if you really want K8s, you can have K8s" move to me.

</comment></comment><comment><USER16> Congratulations to everyone at Heptio!

<comment><USER17> funny how these days if your company is acquired it is cause for celebration.

<comment><USER18> Why. It's a chance to cash out, which is usually a great thing!

<comment><USER19> Not for the user/consumer, usually.

This industry used to mean something.

</comment></comment></comment></comment><comment><USER20> Kubernetes companies are like the chat apps of 2018. Unlike chat apps, Kubernetes has yet to gain a serious foothold in large numbers. These acquisitions feel like FOMO.

<comment><USER21> Except everyone is using Kubernetes.

<comment><USER22> What major tech companies are using Kubernetes?

<comment><USER23> GoldmanSachs, CapitalOne, Comcast, Hauwei, Ebay, IBM, Intel, Redhat, DigitalOcean, ING, JD.com, Monzo, NYT, SAP, Squarespace, Blackrock, Box, Wikimedia

Scroll down to Case studies; [https://kubernetes.io/case- studies/](https://kubernetes.io/case-studies/) \- there are far more large corps using it that aren't listed on this of course. I'll let them toot their horns if they'd like. :)

Also, as I work with k8s I like to watch the trend of HNs "Who's hiring?" threads out of curiosity and I ctrl-f for kubernetes/k8s. Last few times I've looked 20-25+ have had kubernetes in their postings. It's been a pretty fair chunk / near-majority over the last 6 months or so.

It's a marked difference from when I got on the kubernetes train around 2015, that's for sure!</comment></comment></comment></comment>