Benefits of talking to strangers - <AUTHOR> https://www.bbc.co.uk/news/world-48459940 <comment><USER2> I'm in San Francisco for work and yesterday an elderly man made a comment about the heat outside of a Walgreens.

I didn't really have much to do, and I really enjoy walking around San Francisco with it's beautiful light pastel palette, rolling hills, and masonry so we walked and walked for about 3 hours.

I was a bit tired by the end, and his story was a bit sad at times but when we finally departed I'd learned a tremendous about one man's life, his struggles and his triumphs.

I finished my night off at a little sushi joint where, unprompted, I recommended a piece of sashimi to the couple next to me I'd never had that I really enjoyed from my platter. They turned out to be engineers from Square and Amazon who hailed from Seattle and we talked about tech and the world and had a few good laughs. Maybe they'll see this.

Then I wandered back to my hotel where I saw James, and Alexis who I'd met and had become pleasantly intertwined enough with that they'd invited me out with them after their shifts the night prior.

Finally on the elevator up to my room I briefly chatted with Ruiz, a banker in town for work.

I can't recommend talking to strangers enough. Sometimes they prompt you, sometimes you prompt them, but it's a beautiful world out there filled with billions of stories, and they all add just a little spice to life.

<comment><USER3> I'm the guy that if you're in the line at walmart with me, I'm going to start talking to you. I've met some down right interesting folks this way. I also travel for work a lot. Talking to people in the hotel lobby is one of my favorite hobbies. I've met CEOs, truck drivers and people on vacation, all of them really interesting folks.

Everyone has a story or a piece of advice to give you. Just ask.

<comment><USER4> How do you generally start your checkout line conversations?

<comment><USER5> By not forcing it I guess. You just start thinking aloud. If it's hot, you say it's hot. If you dropped something you say somenthing about that.

</comment></comment></comment></comment><comment><USER6> First, as always you get better by practicing. Second, you don't need to be witty or spontaneous at all. You can think of a nice thing beforehand ( * ) and just use it when there is an opportunity. You can also make sure that the possible downside is low by e.g. talking when it is clear that you don't have to spend half an hour sitting next to another in, then, awkward silence. Some sort of reason for initiating a conversation also helps, in my opinion, so that talking about something doesn't come as much as a surprise (e.g. talking about some thing in view or an event that just happened).

Simple example: "Your groceries look a lot healthier than mine" in the queue at the super market started nice conversations for me.

It was clear that we'd just have stand next to each other for two minutes if the other didn't want to engage in conversation. It was a sort of compliment (you are shopping better things that I do) and it had a at least some sort of reason (there are real goods on the conveyor belt and they differ in healthiness).

Oh and _really_ : limiting the risk by choosing temporary situations really helps to avoid the fear of having to spend time in awkward silence if the attempt at chatting fails.

( * ) Just anything can work here: "And I wondered whether I should bring an umbrella today" to someone actually having one; "Looks interesting" to your neighbour at a street performance; ...

<comment><USER7> As an Indian in the US, I do not understand what is acceptable, and what is not.

Eg: An elderly woman was sharing Uber pool with me. She was complaining to someone over the phone about how Uber's new app does not have an option. I knew that the option was present, just that they moved it to a different page in the app. Should I communicate this to her after her phone call? What if she thinks I'm listening to her private conversation? I finally didn't tell her anything.

<comment><USER8> > As an Indian in the US, I do not understand what is acceptable, and what is > not.

Maybe just ask her.

I remember a conversation I had with an Indian coworker - he asked me, "Why do Americans get so upset when I honk my car horn at them in traffic?"

That led to an interesting conversation.

</comment></comment></comment><comment><USER9> This has been the largest personal growth I've experienced in my lifetime and it has been a direct result of living a city that is walkable.

Before moving to San Francisco I hated talking to strangers and I would rarely engage in more than a few words with anyone on the street or in stores. Now I find myself cherishing small moments of conversation that occur in Ubers, on the MUNI, at communal tables in restaurants and in random interactions on the street, even with the homeless who I try my best to not ignore and treat like real people.

I can't believe the difference it has made in my mood, my feelings about this city and my general mood. Like so many things in life it's hard to know what exactly caused the shift in my behavior but it's brought me an incredible amount of happiness and deepened my appreciation of where I live.

<comment><USER10> I'm not sure it's the fact that it's walkable. London is very walkable but unless it's the last train home on a Thu/Fri/Sat night and everyone is very 'merry' then talking to strangers just does not go down well.

I'm relatively new to SF but find the random interactions here beneficial in much the same way with regards to personal growth, and they seem to happen all the time. In the UK it felt like you can't talk to strangers - here it feels like you can't _not_ talk to strangers.

So not sure if it's SF, California, or Americans in general, but it's refreshing for someone who is usually quite introverted.

<comment><USER11> I'm very much introvert and talking to strangers does not come easily to me, but at times I've experimented with engaging strangers in conversations, largely because while I don't feel a need to constantly talk to people I wanted to get over my hangups about it, and I largely have. I still mostly don't talk to strangers because I find it exhausting and it doesn't interest me that much.

But when I do, in London, I've never once had a negative experience.

On the contrary, as soon as people here realise you're not trying to sell them something, or get anything from them, they tend to fall over themselves to be nice, and I've had people start pouring out their life story after just a simple 'how are you today?' to a shop assistant I'd only seen once or twice ever, because I actually waited for an answer.

I think a lot of people in London go around so starved for any kind of contact that as long as you're not acting totally creepy most people will be very open to it.

The hard thing with London is that you need to actually actively push past an _expectation_ of not talking to people.

I actually find California more frustrating because while it's easy to get into a conversation, it's impossible for me to tell what is just pleasantries from when people are actually invested in a conversation.

</comment></comment></comment><comment><USER12> I find the only strangers who ever try to talk to me in public are the ones who want something. This means I'm always suspicious of people who approach me, and have an aversion to being seen as the same.

<comment><USER13> Your worries about being seen as the same are silly, people can usually tell whether you want something from them a few sentences in and after that a pleasant conversation is usually in progress. It's worth it to strike up conversations with randoms. On the elevator one time I had a fun talk with an optical engineer about detecting methane leakages with lasers and whether it had applications in space.

How often do you get to enjoy that?

</comment></comment><comment><USER14> I do it all the time... on Twitter and Reddit.

In real life I would never even look at eyes of a stranger.

Probably some people here can relate.

<comment><USER15> I can. But I don't think that should be the default state, nor is it healthy.

I'm really trying to do better in this regard, but it's proving difficult to improve at.

</comment></comment><comment><USER16> The biggest thing I miss at my current job is interaction with people I don't work with. When I commuted from Oakland to San Francisco I would talk to people on BART, at restaurants when I went out for lunch, and sometimes just made conversation with people on the street.

Now I work at a large company in the south bay. Lunch is provided and I ride my bike to work. There is basically zero chance to interact with anyone outside my workplace unless I make it happen deliberately.

</comment><comment><USER17> I'll believe it, the problem is I'm rarely in a situation where I'm near people and have the time to chat. The only times I've talked to strangers, have been, for example, when a crosswalk signal is taking an unusually long time to change. I'm normally at work or at home, and when I'm out, it's normally to quickly grab something to return to one of the two.

Also it's so much easier to strike up a conversation with one stranger rather than a group (which is what I usually encounter going out leisurely. Oddly I found the opposite with established friends / acquaintances. I can talk and converse with a group of my now friends much better than a single friend

</comment><comment><USER18> Many people feel invisible and ignored. Just listening to someone can be therapeutic for them.

</comment><comment><USER19> I used to do this. Now I don't because my online reputation is messed up, so as soon as they inevitably Google me they'll see a terrible first page of search results. Looking for a way to free myself of this, aside from changing my uncommon name and 20 years of career history. I agree it's all in my head and I shouldn't let it dominate me, but I have largely given up still. Tangent, but this is the evil of a permanent record; even school kids know to fear it.

<comment><USER20> I just googled you and found nothing negative about you at a cursory glance at your first page of google results, unless I searched the wrong terms. I mean I found a little civil dispute about noise complaint (assuming that's you) but I can't see how anybody would care about that.

I think you're overthinking the importance/impact of this to other people because you're falling prey to whatever the fallacy is called where one tends to expect people to care more about themself/pay closer to attention to one's self than they actually would. Like when you have a pimple if you normally have clear skin and you don't want to go outside because of it even though most people would hardly notice.

</comment></comment><comment><USER21> This is only welcome if you're an attractive person. I used to do this all the time and thought I was pretty good at it but really people were just humoring me.

</comment><comment><USER22> maybe that is only the case in chicago. I would find it immensely irritating if some stranger tried talking to me beyond "hello"

<comment><USER23> Well, the whole point of the article is that most people feel the same way you do, until it actually happens.

<comment><USER22> it has happened to me and it was most annoying as i used to use that time to read or watch coursera videos

</comment></comment></comment><comment><USER24> Wish that this is true everywhere. Unfortunately, talking to strangers is very uncommon to some cultures.

<comment><USER25> Where are you that it would be that much of a problem, if you don't mind me asking?

Cultural normals are one thing, but on a personal level people do tend to enjoy interacting with one another.

<comment><USER26> I'm from the US but I've spent a deal of time outside the US, primarily in Eastern Europe. In my experience, it is extremely uncommon to strike up conversations with strangers in Eastern European countries.

My wife, having spent a great deal of time in Eastern Europe as well, described it best to me - Americans are extremely good at having a surface- level chat with just about anyone. However, it is neigh impossible for people to get beyond the surface-level friendship. Deep, true, and lasting friendships are hard to come by. Eastern Europeans, conversely are extremely distant and cold at the onset, but with a little persistence, you break through that cold exterior and become almost family.

I could not hide my American-ness abroad and I often was the recipient of stares and mouths agape, but I love chatting with strangers. Everyone has a story to tell and many of those stories are downright fascinating and humanizing.

<comment><USER27> I would say striking up conversations is possible in EE and US (and everywhere else?) to about the same extent, but just like language, social norms, attitudes, social clues can subtly differ in various places, and a strategy that works in one place may not work in the other, as you say the American style may come across in some societies as a bit aggressive.

source: someone who spent 1/3 of their life in EE and 1/3 in US.

</comment></comment></comment></comment><comment><USER28> You ever sit there wanting to strike up a conversation with a random stranger, and have no idea where to begin?

I think that has more to do with the observed self-imposed isolation than is given credit in the article.

<comment><USER29> I have a friend who is excellent at this. He starts talking about whatever, someone's clothes, how his day is going, the weather, anything vaguely relevant to the situation.

People often look slightly uncomfortable at first, but they seem to quickly get over it and start to chatter away enthusiastically. I find it fascinating because I'm totally incapable of doing the same thing: usually I'll be standing next to him squirming with embarrassment at the potential for an awkward moment.

<comment><USER30> I've seen people "get away with murder" \- corny jokes, terrible cliches. The term "sheer force of character" comes to mind - if you're confident enough in yourself, you can usually lead social situations/protocols against the grain as if you can establish that fundamentally you mean well most people will eventually go with the flow.

YMMV though, the people I know who can do this were able to do this from very young in age and I liken it to having a skill, except that it's hard to teach and not many people explicitly value it as something to "learn" \- people would rather assume it's something innate

</comment></comment></comment><comment><USER31> I'm currently building an app that enables this, but don't have a technical background. Anyone have knowledge of BLE, GPS, iOS, and backend (including aglo dev)?

If so, firstname.lastname@example.com

<comment><USER31> This is also a good summary of approaches people are taking to address this:

[https://www.sandiegouniontribune.com/business/technology/sd-...](https://www.sandiegouniontribune.com/business/technology/sd- fi-social-friends-apps-20190107-story.html)

No one has succeeded.

</comment></comment><comment><USER32> I've always wanted to be that person. It's some of those things easy to say but very hard to do when you don't have the social skills.

<comment><USER11> You don't need social skills for it. It's a good way to get them.

Here's a simple experiment to start with: make a point of every time you have a 'captive audience' such as a bus driver or cashier:

1) look them in the eye (take your cash out in advance etc.). This instantly sets you apart.

2) Say 'hi, how are you?' and smile, and actually pause for an answer.

You'll be surprised at the result. So many people in service jobs are so used to being treated as objects that they'll often jump as chances to have real human interactions and just a little eye contact and a pause that suggests you actually care about an answer makes a huge difference.

I've had cashiers literally run over to open a lane when they saw me coming after a couple of brief conversation, and people starting to tell me all kinds of personal details.

You don't need to have social skills at all other than that initial question, and trying to remember a detail or two and ask them about it another day. Enough people will talk enough about themselves to get you started.

And the bonus is you can often tell it makes people cheer up.

I don't really get much out of social conversations with people, and it's a big effort for me, but the things above are simple enough, and big enough impact to be worthwhile.</comment></comment>


Ask HN: College: Full Courseload vs. Less Courses + Extracurriculars - <AUTHOR>

I'm a current college student trying to decide what would be the best path to take:
1. Graduate with a major in Economics by taking ~15 credits per semester (this is the school average)
2. Graduate with a major in Economics and a minor in Computer Science by taking ~21-22 credits per semester
Option 1 clearly leaves me with more free time to pursue extracurricular activities, internships, etc. Also, I would likely end up with a higher GPA.
Option 2 would allow me to immerse myself in a field I'm passionate about (computer science), but would likely come at the expense of no free time and a lower GPA.
Career-wise, I'm passionate about finance, technology and entrepreneurship. I've been exploring career options at VCs, tech startups, etc.
In light of my aspirations, which do you think is the better option? <comment><USER2> I'm sure the range of answers on this one are going to be widely varied, but I'll give you my perspective (basically option 1). I graduated Cum Laude with a CS degree in June. Going into school I had ~30 math and writing credits from HS so by the time I started my Sophomore year I was at the point where 12 credits/term (we were on quarters) would allow me to graduate on time. I held a job the entire time I was in school (just noting an additional time commitment) and having less credits/classes each term was probably the best thing that could have happened to me. Stress levels drop extremely when you don't have to worry about multiple tests a week or have more than two finals on a single day.

It allowed me thoroughly enjoy my college experience (ie. partying whenever I wanted, generally just doing whatever I felt like that day, etc) and never worry about having to pull all nighters or rely on adderall binges to finish assignments. I probably could have spent my time more productively (working on side projects or something similar) but basically college became 4 years of social fun with classes littered in-between.

I would say it really just depends on what you're trying to get out of your time at school. At the time I wasn't looking to differentiate myself from everyone else (I had no clue what I wanted to do) and just had a bunch of fun (which you'll never be able to experience something like 4 years of minimal time commitment and tens of thousands of other 20-somethings with no supervision anywhere else). If you want to stand out to employers post- graduation, I definitely wouldn't suggest doing what I did. I was turned down for multiple jobs due to lack of experience, but I eventually managed to land one with a startup in SV.

</comment><comment><USER3> A CS class might easily take 3x the time of a typical Econ class, if not more. The difference in difficulty is absurd - it wasn't unusual that all I had to do for an Econ class was show up for the midterm and final with cramming the day before.

This is a really big change in direction, so the question is really up to you, unfortunately. You need to find out if you really are passionate about CS, or if you really just like the idea of being a tech entrepreneur. You need to just get in there and take classes, and above all, build something. Then you will know.

If you find out it's not for you, no biggie, you just took one or two classes extra. After all, you don't have to graduate with a minor.</comment>


The paradox of soil: Land has returned as a constraint on growth - <AUTHOR> http://www.economist.com/news/briefing/21647622-land-centre-pre-industrial-economy-has-returned-constraint-growth <comment><USER2> Summary: Building & land-use regulations are creating an artificial scarcity of land in large cities, driving prices up and creating an artificial "shadow tax" that distorts labor markets.

According to a recent study, if the Bay Area got rid of its building/density regulations, the local economy would be able to support 5x the area's current population, which would boost the US' yearly GDP by $2tn. In 2009, the US GDP was 13.5% lower than it otherwise could have been if land-use regulation had been abolished in 1964. [1]

The solution? Dissolve land-use regulation, pay residents to allow developers to build new structures, and distort the market in favor of the renters by levying a land-value tax. Theoretically, this would allow for an increased supply of housing while penalizing the owners of the least-productive parcels of land, such as those who squat on empty plots in New York.

The author hints at the political problem of adopting a land tax near the end: _But there are practical problems with a land tax — perhaps the largest of which is that by its very nature it hits the well-connected rich hardest._ So we may very well never see this regulation brought up or passed given the current, money-greased machinations of the political machine.

I was disappointed that the author of an otherwise well-researched and informative article did not get to the heart of the issue: _who owns the land_? Yes, it is obvious that urban landlords are making a killing in this market, but who exactly are these landlords? What percent of real estate in London, SF, NY is owned by actual residents vs. holding companies vs. foreign interests vs. the government? Is it a small, concentrated number of buyers in each city? Is collusion possible?

Also, how are we going to induce growth in sectors other than tech, consulting, and finance? Or do we not care if young talent continues to accrete in these fields, driving the (currently extortionate) growth of the city? Is this the best plan for long-term growth and prosperity?

[1] Perhaps this paper assumes that there is an infinite supply of highly- skilled tech workers who have taken jobs elsewhere due to high costs of rent? Seems a bit far-fetched to me.

<comment><USER3> > The author hints at the political problem of adopting a land tax near the > end: But there are practical problems with a land tax — perhaps the largest > of which is that by its very nature it hits the well-connected rich hardest. > So we may very well never see this regulation brought up or passed given the > current, money-greased machinations of the political machine.

That isn't the actual problem. Its the problem the author imagines.

The real problem with land [and property taxes] is the fact it tends to flow into the cost of rent and homeownership. Everyone in this country is impacted, it is just a question of degree. Similarly, the vast majority sees an item in their basket of purchases goes up by $X and gets angry.

Case in point: The gasoline tax. The vast majority of economists thinks it should go up to cover infrastructure but there is no political will to do so precisely because of how angry it makes their constituents.

People are far less rational than you think they are and if their entire tax burden was shifted into the rent for their house, they'd flip the fuck out.

<comment><USER2> Good point, the author never discusses what percentage of a tax increase would simply be passed on to the renters of the property. Since demand for these units is so inelastic, it would probably be near 100%.

What to do then? Subsidize construction? Force higher densities?

<comment><USER4> A tax on improvements is always passed on to renters, but a tax on the unimproved value of land cannot be passed on, because the land rent is a pure economic rent.

"A tax upon ground-rents would not raise the rents of houses. It would fall altogether upon the owner of the ground-rent, who acts always as a monopolist, and exacts the greatest rent which can be got for the use of his ground."

– Adam Smith, Wealth of Nations

"A tax on rent would affect rent only; it would fall wholly on landlords, and could not be shifted to any class of consumers. The landlord could not raise his rent, because he would leave unaltered the difference between the produce obtained from the least productive land in cultivation, and that obtained from land of every quality."

– David Ricardo, On the Principles of Political Economy and Taxation

<comment><USER2> Again, both of these classical economists are assuming perfect markets and non-sticky rent. In a perfectly rational world where prices are constantly updated as the landlord and tenant are perfectly rational beings who evaluate how much the land is worth to them on a minute-by-minute basis, then yes this theory holds.

In a world where there are significant search and movement frictions, where subsidized housing exists, where landlords and their tenants have relationships beyond renter/rentee, where a home/building has value beyond its ability to be slept in, these theories will not hold.

My hypothesis is that if an LVT was levied in SF, rent would go up by at least 50% of the value of the LVT as a direct effect of the tax.

</comment></comment></comment></comment></comment><comment><USER5> Overall I think this is a good article, but there were two things which caught my attention.

Isn't this article just taking a roundabout way of commenting that landowners in highly productive areas are choking growth and more productivity by siphoning too much money off of the non-landowners for use of the land? I understand that they're the Economist so they can't outright say that the rich are hurting the economy by hurting the poor, but come on, at least be a little more clear.

Also, a fallacy: "Where workers can be put to use at high levels of productivity labour scarcity will lead to fast growing pay packets. Those pay packets will attract workers from other cities. When they migrate and find new, high-paying work, the whole economy benefits." This is a theoretical economic concept which doesn't really apply to the macroeconomic reality of today, in which worker productivity and time commitment increases but wages stagnate and later decrease, all as a result of a race to the bottom. The exception is probably the software industry, but I'd argue that in light of the anticompetitive no-poaching agreements from the likes of Google and Apple, software industry wages are still actually much lower than they should be, despite the "labor shortage" and "high levels of productivity". Then there's the bit where they claim that the whole economy will benefit from this sort of behavior, which may be true. Keep in mind that from another perspective, this same action is highly destructive brain drain, leaving destitute cities bleeding their talent to more prosperous ones.

<comment><USER6> > [the Economist] can't outright say that the rich are hurting the economy by > hurting the poor,...

I don't think that's what the Economist wanted to say in the first place. Rather, it's more a conflict between the capitalist/industrialist rich vs the landowner/aristocratic rich. The poor just find themselves ducking in the middle of cross fire.

According to this world view the landowning rich do not produce any Value Added, they just arbitrage the [arguably artificial] scarcity of real state to bleed the capitalist rich both directly (office space) and indirectly (since employees must demand higher salaries for the same work done just to be able to put a roof over their heads).

<comment><USER2> These two classes of rich that you are describing probably intersect a lot. Once you make money in business, you need to invest it somewhere that will make you a return. Land is a popular choice.

<comment><USER6> That's right, this is not about making a witch hunt (you would not expect economists to do that, I think).

But if you think about, let's say, competing aspects or strategies for money management... I think a point can be made that one is more beneficial to society at large than the other. So, it is the same rich people at the end, but maybe you want to incentivize them to put investments in ventures that actually do something, and to tax the arbitraging away.

</comment></comment></comment></comment><comment><USER7> _The issue is not overall scarcity, but scarcity in specific places—the cities responsible for a disproportionate amount of the world's output. The high price of land in these places is in part an unavoidable concomitant of success. But it is also the product of distortions that cost the world dear_

The article is good but the title isn't great; the real story isn't about land per se, but about _land-use regulation_ : the topics are related but quite distinct (and indeed the article says, "The spread of land-use regulation is not hard to understand"). As Matt Yglesias is fond of pointing out, steel- framed construction and elevators are well-understood, century-old technologies ([http://www.slate.com/blogs/moneybox/2013/05/03/silicon_valle...](http://www.slate.com/blogs/moneybox/2013/05/03/silicon_valley_housing_boom_there_s_no_such_thing.html)).

But laws against deploying them have become important constraints on growth. The problems are really legal and political. The solutions will be (or won't be) as well.

<comment><USER8> Both land-use regulations, and land owners (ab-)using their oligopoly to drive up rents to insane levels, which combined cripple the rest of the economy by preventing growth.

<comment><USER9> Where has rent control ever worked favorably for the cities that have implemented it? It's simple economics, as value is derived from a city, the city itself becomes more valuable. A more valuable city has more valuable real estate. More valuable real estate costs more to purchase and develop. "Location, location, location" isn't just some cliche realtors like to use.

In the majority of cases, there's no conspiracy. Rent goes up, because the real value has gone up. It really is that simple.

<comment><USER10> Define "real value". Prices are driven my many-to-many auctions, and each market (housing) interacts with its supplements (transportation, food, energy, finance,...). The value varies from person to person, and much of the value is parasitic: I derive value from getting paid by my job, and my home, transport, etc enable me to do that job. If I make $100K/yr, is my home providing $10k/yr of value? Or $40k/yr? If I get a raise, is my home more valuable because it supports my higher income? Or is my transportation more valuable? Or is my food more valuable, as it keeps me healthy?

<comment><USER9> Did you skip macro economics? None of this really makes much sense when talking about rent prices in a market driven economy.

</comment></comment></comment></comment></comment><comment><USER11> Are there any examples of new, dense construction in North America that aren't ugly or dispiriting to live in?

Serious question. I live in a very dense neighborhood by North American standards. About 32,000 people per square mile, and it's self contained: people don't have to travel elsewhere to go out, shop, relax, etc. Some leave for work, but a high proportion are here during the day too.

It was built around 1900, and lots of people visit just for the atmosphere.

If we could clone this neighborhood and built it elsewhere, it would be a good thing. But we don't seem to be able to build neighborhoods in this style anymore.

Are there any new developments that are both dense and nice?

<comment><USER12> >If we could clone this neighborhood and built it elsewhere, it would be a good thing. But we don't seem to be able to build neighborhoods in this style anymore.

It's not that we're unable, it's that North Americans have chosen not to. Nice dense developments are bad for cars, and car-lifestyles are what North Americans have culturally designated as the marker of success. Therefore you see a false correlation: dense developments are only built to house those too poor to participate in car culture.

<comment><USER13> > ...and car-lifestyles are what North Americans have culturally designated as > the marker of success.

This is no longer uniformly true. Some of the hottest, highest-priced residential real estate in the US is explicitly tied to more walkable environs. In the urban cores of cities like Portland, OR, Boulder, CO, and Austin, TX, there are definitely extraordinarily expensive ("marker of success") residences that are impractical (or at least very time inefficient) to live in unless one eschews a car-centric lifestyle. The developers have noticed, and there is a boom going on right now in those and similar cities by the developers to increase density; however, often neighborhood associations and land-use regulations tend to hold back the density of the proposed developments.

<comment><USER11> Yeah, this is what I was getting at. The old, dense neighborhoods are getting expensive. But we can't seem to build them anymore.

</comment></comment></comment></comment><comment><USER14> I feel like land is such a good example of the destructive powers of a good with a heavily deflationary value (deflationary due to policies and not by nature). It just leads to hoarding and benefits the early buyers, while at the same time hindering innovation because people who can make better use of the land cannot afford it. Land use regulations are probably one of the biggest blunders in modern capitalist economies. And the worst of it: The problem is not even visible to a lot of people: Very restrictive building codes in European city centers are rarely ever questioned - this wouldn't be of much concern if we talked about single digits km^2, but usually they affect huge districts. Incidentally land ownership was for many historically despised "capitalists" the goto way of acquiring wealth: If you have an emerging company which requires lots of labour, the best investment you can make is building company housing for your employees, that way a part of the salary you pay ends up right back in your pocket. All you have to do then is lobby for restrictive building regulations and your family's wealth and estate is secured for centuries to come.

</comment><comment><USER15> > But for the tight limits on construction in California's Bay Area, they > reckon, employment there would be about five times larger than it is.

This is farcical. One reason people flock to the Bay Area is precisely because of the tight limits on construction. People like sprawled-out, low-density development. They like to have yards. They like spacious homes. They like to see the sky and the mountain vistas and the water.

You could lift the limits on land use and densify the area like Manhattan. But there are only so many workers who will flock to a Manhattan-like locale...and those workers are already flocking to Manhattan itself. Many American workers simply do not want to live in dense environments like Manhattan.

Like an earlier Economist article I think this one misses the possibility that tight controls on land use can make those places more desirable while driving some jobs elsewhere. Maybe some jobs simply do not exist due to tight Silicon Valley land controls. But other jobs simply move elsewhere, just as all finance jobs are not in NYC and London.

<comment><USER16> > They like to have yards. They like spacious homes. They like to see the sky > and the mountain vistas and the water.

People flock to the Bay Area to have a yard and a spacious home? The lack of those things is the reason I _left_!

Maybe the very wealthy have yards and large houses in the Bay Area, but most everybody else is living in Manhattan-sized apartments without the benefits of living in a high density area like Manhattan (more walkability, public transit, etc).

<comment><USER15> You are making my point. If you left to get more space, why would the Economist think that the place could have five times more workers if they lifted building restrictions? The Bay Area with no building restrictions would be even less desirable.

<comment><USER16> The Bay Area with no building restrictions turns into Manhattan. I'd rather live in Manhattan than the Bay Area. If I'm not going to have much space, I'd rather the city be designed for that kind of life.

</comment></comment></comment></comment><comment><USER17> I wonder why cars don't come up in this debate. A typical car space is 20 m². Usually the amount of parking spaces needed is greater than one (parking at several shopping locations, at work, ...). Parking often uses vertical space just once. So with a multi-storey house these 20 m² become enough for a flat housing a few people. And this still ignores public and non-public (like driveways) roads.

</comment><comment><USER18> The only way out is up. Don't forget that urbanizing populations is also the most effective way to lower their carbon footprint!

</comment><comment> rm_-rf_slash Shockingly absent from this essay was a consideration of the effects of climate change. In a hundred years or so, Miami will be a fairy tale. Where is the factorization of costs associated with high value land that's here today and gone tomorrow?

<comment><USER19> Interestingly denser growth is one of the most effective means we have of reducing the carbon footprint of our cities. Shorter commutes mean less driving. Shared walls mean less heating and cooling energy use.

</comment></comment><comment><USER20> The really sad thing is that we build on our best farmland. If you want to grow apricots, the best place is San Jose. That whole area in fact is mighty good for farming.

People need to eat! Californians ought to be living in the foothills of the Sierra mountains. This puts them close to water and saves the more farmable land for farming.

Good farmland is flat, is not full of annoying boulders, and has nice weather. We thus pour slab foundations for giant 1-story McMansions and dig holes for giant swimming pools. Doing that in the foothills would be a short-term expense, so instead we'll destroy our best farmland forever.

<comment><USER21> Well, farmland exists to support the population, not the other way around. If farmland exists in adequate and sustainable quantities now, which it does, there's no need to push people to live in less pleasant locations to make room for more of it.

</comment></comment><comment><USER22> Oh yes. A big mystery to me is why New Hampshire (and I suppose the rest of New England) is so expensive. We are in a rural setting, and there is plenty of land, we are an hour from Boston, but even if you go farther a way, the house prices are very high. The problem are the lot sizes. Houses are around 1,200 square feet, but the lot sizes are 20,000 square feet. Compare that to cities like Austin where the lot sizes are around 3,000 square feet. The land is clearly underutilized; many houses are old; and people just keep going farther and farther away. The high house prices also drive up the rest of prices. It is a lose, lose for every body, and the problem has existed for generations. It even destroys the forests, because big areas are cut down to build just one house.

<comment><USER23> New England is more forested now than it has been in at least 100 years, possibly since before the Civil War. Between the industrial revolution and the shift of agriculture westward to the Mississippi and beyond, due to railroads, industrial food processing and refrigeration, the vast majority of the land that used to be cleared for farming has grown back up as woods.

<comment><USER22> That is a good point. Still, If we used the land more effectively we could have more trees.

</comment></comment></comment><comment><USER24> Why do innovators like to congregate in Silicon Valley? Because other innovators like to congregate there. VCs and other people feeding off the phenomenon end up there because they can find innovators there. In other words, there is no resource whatsoever that attracts anybody there. They are only attracted by each other. The inclination of congregating there costs a lot of money. Housing prices and rents are very high in the area. In other words, these innovators are forking over way too much money to other people for no good reason at all. At the same time, they are not stupid either. My take is that at some point they will start moving elsewhere.

</comment><comment><USER25> So laws which create artificial scarcity lead to an increase in prices.

Wow, color me surprised.

</comment><comment><USER26> The final paragraph mentions "Virtual reality and social networking" as something that might eventually abolish the problem, and this rings true to me. Several years ago, it seemed that perhaps Second Life would accomplish this, but I suppose it wasn't immersive enough.

Perhaps next year's commercial launches of the Oculus Rift and Vive would finally allow for sufficient presence to begin making daily VR telecommuting a reasonable option.

</comment><comment><USER27> Buy land. They've stopped making it. - Mark Twain

<comment><USER4> Yep, land has a vertical supply curve. Although, valuable land is what is truly in high demand. There's lots of land, but not a lot of valuable land. But the lack of a commons of any quality is quite concerning. One cannot just exist without owning land or paying rent.

We pay the biggest chunks of our income to the gatekeepers over that valuable land, which you need access to in order to get a job or do business.

Let us just be thankful that these landowners worked so hard to produce this land, ex nihilo.

</comment></comment><comment><USER28> Fertile soil was always a limited resource. I assume this is one of the reasons of the current civil war in Ukraine. Someone wants that soil.

</comment><comment><USER29> Visit Kansas!!!</comment>


How "../sms" Could Bypass Authy 2-Factor Authentication - <AUTHOR> http://sakurity.com/blog/2015/03/15/authy_bypass.html/

<comment><USER2> That rack-protection library Sinatra apparently uses is clearly wrong: how does that "protect" against directory traversal, rather than "cause" directory traversal? It essentially makes escaping not work correctly. In what scenario is this possibly a security measure?</comment>


Show HN: 23 Ideas for Your Next SaaS (150 Pages Book, discount in comments) - <AUTHOR> https://www.saasforge.dev/books/23-ideas-for-your-next-saas <comment><AUTHOR> Hello, author here.

This book contains 23 ideas that I gathered during several years. Every idea has the following sections: 1\. A problem that this SaaS app can solve 2\. Existing solutions 3\. Who are end users 4\. How it works 5\. Features 6\. Existing competitors and how to differentiate from them 7\. Ways to implement / components 8\. Technologies used 9\. Ways to monetize 10\. Challenges and obstacles

Also, every idea has a tip for SaaS founders (borrowed from my own experience or from successful founders).

For Hacker News readers there is a $5 discount - use the coupon "hackers" (without quotes).

Questions? Suggestions? Critique? Feedback?

Thanks!!</comment>


Employees Can't Be Fired for Facebook Complaints, Judge Says - <AUTHOR> http://www.forbes.com/sites/mobiledia/2011/09/08/employees-cant-be-fired-for-facebook-complaints-judge-says/

<comment><USER2> It sounds like a rather toothless precedent, since the employer can just wait a week or two and use something else as an excuse for termination. Even if the employee keeps the job, the bridge is thoroughly on fire.

Not that I have much sympathy for the employee in most of these cases. You don't air the dirty laundry in public unless there's a damn good reason.

<comment><USER3> From my reading of the article, I think what the judge is saying is that Facebook isn't public. It probably should be treated as a public forum, but most people don't.

<comment><USER2> Probably the case, which may have the judge and the employees in question both making the same error.</comment></comment></comment>


Notch is coding live again - <AUTHOR> http://www.twitch.tv/realnotch <comment><USER2> I'm happy to see him using Paint.NET to edit the graphics. I've yet to see a free image editor that remotely compares in usability and power; I just wish it were available for Mac and/or Linux.

Not affiliated with it or anything.

<comment><USER3> GIMP?

<comment><USER2> I tried it on Ubuntu a while ago, and it was the most inhumanly difficult program I've ever used. It always seemed none of the tools looked anything like what I wanted to do. It probably exceeds Paint.NET in its capabilities but would take far longer to learn.

</comment></comment></comment><comment><USER4> I cannot believe how addictive this is to watch. Really makes me feel like I am wasting my time though.

<comment><USER5> <http://en.wikipedia.org/wiki/Flow_(psychology)>

</comment></comment><comment><USER6> Something about 9000 people watching a guy write code amazes me. I understand reading the source and all that, but is this something commonly done now? Watching others code live? I am somewhat amazed by how fast he seems to be moving, I find I have to sit and think about things a lot more most of the time.

<comment><USER7> He'd probably have to stop and think more often if he hadn't built a dozen or more similar games before.

<comment><USER8> This is a perfect example of how to attain 'flow'. He's done the same (or very similar) thing before, so there is no distress or despair. The 48 hour window provides the necessary, low-key stress stimulus necessary.

MCN (an unusual motorcycle magazine) had a series on this. To attain flow, you need some stress, but too much stress will stop flow. This is probably why we find many parts of coding to be fun, but debugging and navigating poorly documented APIs to be painful.

</comment></comment></comment><comment><USER9> At one point, I saw a huge switch statement comparing the value of "col" to a list of twenty or thirty long hexadecimal numbers and returning objects like "LockedDoor". Is that kind of thing common in game development? It looks like a nightmare to maintain, but maybe that doesn't matter in a 48 hour competition?

Also, what is the engine that's rendering the maze for him? Is it a publically available library?

<comment><USER10> The huge switch statement is probably because that's the easiest thing to do with a simple 48 hour game. There is no point in wasting time writing clean maintainable systems with a lot of glue code when you're writing a simple game in 48 hours that you are the only developer of and will probably never look at again after the compo. Even in a larger commercial game it wouldn't be too hard to maintain that stuff (maybe clean it up by defining constants). I've written similar code for LD48 map loaders.

There is a good chance that the "engine" that's rendering the maze for him is something he wrote during the competition. Its not too hard to write a simple maze renderer using OpenGL or even an oldschool raycast software renderer like wolfenstein's pretty quickly. All final LD48 entries must submit source as well, so once Notch is done you could take a look at what he's doing. Probably not anything you can easily turn into a library or reuse :).

<comment><USER11> One thing I've noticed is that he tends to put a little extra energy into the quality of everything - say 20% more than the minimum. And I mean Everything - from consistent naming and semantics to the visual touches (like the color of the cloud over the moon). This fractional boost to the quality of so many components really adds up.

</comment></comment></comment><comment><USER5> Playable game: ( with source code )

[http://www.ludumdare.com/compo/ludum- dare-21/?action=preview...](http://www.ludumdare.com/compo/ludum- dare-21/?action=preview&uid=398)

</comment><comment><USER12> I wish I could see what music he's listening to.

<comment><USER13> Commenter on twitch.tv: <http://www.di.fm/> Electro House station

</comment></comment><comment><USER14> Pretty cool, any reason why he is doing this? Also would be awesome if someone recorded this from the start.

<comment><USER15> Sadly because he had to switch streaming providers, the actual recording is split between livestream and justin.tv/twitch.tv. However, you can definitely go back and replay it all if you know where to look. Markus is also taking screenshots ever x seconds (sorry, no idea how big x is) which he'll use to make a video for his entry. That should give you a 10,000ft view of the process he went through to develop his game.

<comment><USER16> I believe that he permanently deleted his livestream account due to huge charges that were racked up due to the high traffic of the broadcast (something along the lines of $4,000 I want to say?), so the recorded video is no longer available at livestream last time I checked.

<comment><USER17> More like $17,000 I believe.

</comment></comment></comment></comment><comment><USER18> Is there a reason to draw in-game font except for fun factor?

<comment><USER19> if your basic/permitted libraries don't include a way to render orthographic text, I suppose. I didn't see the beginning, but in comments in the previous threads, he's written the whole of the 3D FPS system to a fairly low level as well.

<comment><USER15> Yup, he did everything from scratch. The first 4 hours were scary. And beautiful.

</comment></comment></comment><comment><USER20> Why doesn't anyone tell me about these 48 hour game coding competitions? I'd definitely like to join. Been a while!

<comment><USER5> _"Ludum Dare Events are held every 4 months; Every April, August, and December. Dates are announced 1-2 months before the start time. The best way to stay informed is via the mailing list. Alternatively, you can follow ludumdare on twitter."_

<http://www.ludumdare.com/compo/rules/>

<comment><USER5> All game:

<http://www.ludumdare.com/compo/ludum-dare-21/?action=preview></comment></comment></comment>


CT scans confirm 17th-century medical mannikins are mostly made of ivory - <AUTHOR> https://arstechnica.com/science/2019/11/micro-ct-scans-reveal-the-secrets-of-17th-century-anatomical-manikins/ <comment><USER2> Why on earth does this article use _three different spellings_ of "mannequins"? Jeez. Pick one and stick with it.

<comment><USER3> Note that headlines are almost _never_ written by the authors of articles, whether in a publication like this or the _New York Times_. (Something to remember before reacting to a headline.) The headlines are written by someone at the publication who's often less well-informed than the author, or has a different opinion, or is maximizing for eyeballs (clickbait), etc.

In this case, the article consistently uses "[medical] manikin" for its topic, and only once uses _"These are not the department-store mannequins familiar to most of us today"_ to distinguish this from a different topic. It is only in the headline (and thus you know it to be introduced by the headline writer) that you'll find the variant spelling "mannikin" (which outside of this article is more often used for a kind of bird).</comment></comment>


We are going to make the largest distributed library in the world - <AUTHOR>

I'll post a link to the website in the comments.
What is a distributed library?
It's basically being able to see what other people have in their personal library via an online database. So for example, I could go on your profile and see all the songs you have in your music library.
What's the point?
The point would be to follow your friends and other people you care about and browse their profiles to see what they have in their media library. And if you want something they have, you can just contact them. They can send you the file via Dropbox or any way they want. They can even give it to you on a USB flash drive.
Two ways you can help:
1. If you're a Ruby on Rails programmer, you can help with the source code, which is available on Github (see the link in the comments).
2. Look at the albums you have in your music library and suggest them by creating an "issue" on Kopibibli. I will add them to the database. You will then be able to mark them as owned.
Any feedback is welcomed. <comment><USER2> Can you give us a preferred format for information? CSV? Or if you can outline the database structure, I don't mind contributing if you can tell me the preferred data format (to make it easier for you to import).

<comment><USER2> I love this idea (it's resonating with me because I've been investigating whether library management software packages provide APIs).

I'm concerned though that if you need people to email you so that _you_ can add info to the database, you're going to be in for an awful lot of work if this thing takes off, maybe beyond your ability to provide.

The other thing I was wondering is if kopibibli will provide any kind of API itself, so other applications can query your database? There's a world of potential for third parties there if so.

(reposted as reply to my earlier post)

<comment><AUTHOR> People don't need to email me. How it works is that once you create an account on Kopibibli, you can create "issues". So if you have an album that is not on Kopibibli, you just have to create an issue with the name of the album. On the front page of Kopibibli, people can upvote issues. So I'm always focusing on the issues with the most upvotes. And I delete an issue once it is resolved.

I agree that if it takes off, I would need to find a better way to add content to the database. I was thinking of maybe letting people add content, but it wouldn't show up on the site until I approve it.

As for providing an API, I would definitely like to do that.

<comment><USER2> I'd probably separate out "bug" issues from adding data.

Even if it doesn't 'take off' right away, you'd do yourself a huge favour by allowing people to add their own entries. If you need to add user submitted data to a moderation queue that you have to check yourself, that's still better than you having to enter things in. By allowing people (who maybe can't help with the programming) to add to the database itself, you are then freed up to do things like, say, work on an API ;o)

(edited for better clarity)

<comment><AUTHOR> I've just updated the app. Now users who are signed in can add new artists, new albums and new songs, even if they are not admins.

You're right, I guess I should remove the issues section. I just need to find what I would put on the homepage instead. Maybe a feed of the latest songs in the database?

Edit: I've removed the issues section. As you can see on <http://www.kopibibli.org/>, the homepage now displays the latest songs that were added to the database.

</comment></comment></comment></comment></comment><comment><AUTHOR> Update: I've removed the issue section. Now every user who is signed in can add new artists, new albums and new songs to Kopibibli. But only admins can edit and destroy existing artists, albums and songs.

</comment><comment><AUTHOR> <http://www.kopibibli.org/>

<https://github.com/kopibibli/kopibibli>

</comment><comment><USER3> But, but, I really don't want my friends to know about my secret stash of Milli Vanilli...

<comment><AUTHOR> Well if you don't want to tell people that you have that, you just have to not mark it as owned.</comment></comment>


Ask HN: What are some fun projects I can do to justify my too powerful computer? - <AUTHOR> I just built a PC for a quarantine project. It's got way more CPU cores than I need, way more RAM than I need, more GPU than I need. I hate to see my resource usage in ytop sitting so slow constantly.<p>What are some fun projects I could do to justify having such a powerful computer? The only one I've thought about is crypto mining which seems kind of silly if it only makes me $2 a day. <comment><USER2> Folding@Home[1] or some other distributed compute project that you would like to support?

[1] [https://foldingathome.org/](https://foldingathome.org/)

</comment><comment><USER3> Keep it running cold most of the time so it can Turbo when you need it.

</comment><comment><USER4> GIMPS (Great Interger Mersenne Prime Search)</comment>


Ask HN: BP is up 7% in London today, but only 1% on NYSE. Why? - <AUTHOR>

http://www.google.com/finance?q=LON:BP http://www.google.com/finance?q=bp<p>The pound is up 1%, which explains part of it, but doesn't come close to explaining the entire difference. <comment><USER2> LON.BP * 187.87M = NYSE.BP * 3.13B * $/£

The LHS represent the market cap of BP at the LSE, the RHS the market of BP at the NYSE. Both sides should be approximately equal because 40% of BP shares are listed in London and 39% in New York.

<comment><USER2> The above is an explanation as to why the prices in New York and London are always in sync.

But the direct answer to your question is that the rise in the share price is shown relative to the closing price on the day before. And the LSE closes at 11.30AM EST and NYSE closes at 4.00PM EST.</comment></comment>


Nexus One Sales Continue to Lag: Just 80,000 in First Month - Nexus one sales - <AUTHOR> http://gizmodo.com/5465326/nexus-one-sales-continue-to-lag-just-80000-in-first-month <comment><USER2> I've been flirting with the idea of getting one since it came out. I am OK with the price and all the other stuff.

The problem? I can't handle the phone before buying it. I've looked in 3 stores that sell T-Mobile but none o them have a Nexus one that I can hold in my hand and examine before buying, and I'm reluctant to spend >$500 based only on a picture on the website. They don't even have it at the flagship T-Mobile store in San Francisco and nobody I know owns one.

So I've renewed my existing service for my current craptastic phone for another month.

<comment><USER3> Best Buy has display models, but at least at my local Best Buy, none of them actually work. Last I was in there they had 3 Droids on display, and all of them had static images (stickers) on the screen. I'm not even sure if they were actual Droid phones.

I'm guessing they're saving on power costs, but it seems mind numbingly obvious that a working display model will lead to more sales... granted, unless the phones are crap to use (which is not a comment on the Droid specifically, just the typical phone sold at Best Buy over the past decade).

</comment></comment><comment><USER4> I think one of the reason behind success of iPhone is the bundled iPod and integration with iTunes infrastructure. Android phone makers need to understand the fact that just putting 3.5mm jack is not going to make it a music phone. Android's media player still sucks, not sure about the audio quality. For iPhone there are plenty of docks and portable speaker systems available. Android might catch up on app store, but they still have lot to do. Not to mention different version of Android OS on all the Android phones.</comment>


Does pushing "buy local" work? - <AUTHOR> http://online.wsj.com/article/SB10001424052748704509704575019331766302678.html

<comment><USER2> Buying local works for things that are unique and unavailable outside the "local" context. So, the local pizza joint or local dining chain may be successful in getting people to "buy local" but the mom and pop retailer selling Tide detergent or Whirlpool will likely not, since they add no value aside from being a local business.

Local businesses must provide something beyond what can be provided by national or regional chains. People will not spend more money simply to subsidize an inefficient business.</comment>


An Autistic Way of Thinking Powers Silicon Valley - <AUTHOR> http://www.wired.com/opinion/2013/05/silicon-valley-coders-and-autism-and-asperbergers-maybe-its-a-new-kind-of-design-thinking

<comment><USER2> I'm going to come out and say it. Mostly when people are rude and inconsiderate it's because they haven't been trained and have gotten away with selfish behavior from over indulgent parents.

Aspergers is a RARE condition. It needs to be diagnosed properly (not over the internet and from movies).

Most people who are rude and inconsiderate are simply rude and inconsiderate - never having been trained that other people matter and encouraged by competitive parents to look out for number one.

I don't want my children growing up in a world where it is OK to be rude and inconsiderate with a cluster of people sitting at the sidelines claiming that this is excusable because they 'think different'.

We need to teach children, before it is too late, that social graces exist because though we are all imperfect at being considerate THERE is NO EXCUSE for being inconsiderate.

Sorry, that's my thing, my button. This fiction that there are some people, like the kings of old who had divine right, who have some kind of faux modern divine right, to be inconsiderate because they have some powerful brain that can't be bothered.

<comment><USER3> I didn't see anything in the article condoning rude and inconsiderate behavior. The last sentence makes a mention that it would be difficult to "train" a person with aspergers, but it doesn't ever say rude behavior is acceptable.

</comment></comment><comment><USER4> Pointless article. The author gave a talk at a high tech company, some coders in the audience described how they wrote code, which reminded her of a small subset of the autism spectrum, thus Silicon Valley is powered by an autistic way of thinking? Doesn't make any sense.

To me it looks like it's a desperate attempt by the author to make her book appear relevant to tech workers.

<comment><USER5> It might be worth your time to read up on Temple Grandin: <http://en.wikipedia.org/wiki/Temple_Grandin>

Also, she actually is substantially autistic, despite all of her work and achievements.

</comment></comment><comment><USER6> Regardless of what Jobs may have thought or felt, the AppleLaser writer was not the first laser printer.

</comment><comment><USER3> This title is mostly flamebait. Obviously, they are talking about a very, very high functioning Autistic way of thinking and not talking about the non-verbal (stimming and behavior issues) end of the spectrum.

</comment><comment><USER7> This article is total horseshit!</comment>


Using Google to Monitor? Warning: Google Doesn't Really Care About Free Accounts - <AUTHOR> http://www.voodooalerts.com/blog/solely-relying-on-google-analytics-to-monitor-your-conversions-warning-google-doesnt-really-care-about-free-accounts-2/ <comment><USER2> A product competing (at least in part) with Google Analytics is criticizing Google Analytics. Please.</comment>


Google Update Goes Open Source - <AUTHOR> http://google-opensource.blogspot.com/2009/04/google-update-goes-open-source.html

<comment><USER2> _Omaha checks for updates in the background, when it won't interfere with the user, even if an application isn't running._

They do the same thing on a Mac and this is why I've blocked it and removed the daemon. Google's explanation for doing it is complete BS. They should do what every other app does: check for updates when you start the app.

<http://blog.wired.com/business/2009/02/why-googles-sof.html>

<comment><USER3> I disagree. Whats wrong with their reasoning: "Omaha does not perform updates when an application launches, because we understand people want to use the software when starting it up, not perform maintenance tasks first."

I don't like having to wait for, say, firefox, to install new updates when it starts up. Why not have it update itself when its not in use?

<comment><USER2> It's _very_ simple: Google update takes away control from users. This is absolutely the _wrong_ way to handle this.

Say I'm at a coffee shop with wi-fi or using my notebook through a cellular 3G/EDGE network and this update starts downloading a large Google Earth update that I never asked for. Why should I be paying for the charges because Google wants to update their software without telling me?

Another issue is versioning. If I'm working in one version of the software and don't want to use the newer version until others thoroughly test it and fix the critical bugs, why should i be forced to upgrade? I've used a lot of newer versions of software and many were actually worse than their older versions. Again, why should they force users to upgrade? Why not ask?

This Google Update is bad news all around. It installed itself like a virus rootkit on my machine with Google Earth installation and I was never notified (yeah, a note is probably buried deep in a TOC somewhere). Luckily, LittleSnitch told me about it and I removed it from the Launch Daemons... and I also removed Google Earth because of it.

Finally, why should Google get updates about my location at all times? Every time this thing pings their server, my IP is inevitably transmitted to them.

Sparkle does this perfectly. You can completely disable update checking or allow it to check on periodic intervals. And when it finds an update, it informs you with an update window and shows you exactly why it is updating and what was fixed and what more you get. This Ohama thing gives you none of these options and it also runs at all times like a virus.

If MS did this, people would be all over MS. But when Google does it, people defend them.

Any software that adopts this Omaha crap will be blocked from my machine as well.

<comment><USER4> While the control issue does have some relevance, I think that Omaha is definitely a step in the right direction. I typically put off updating any of my products, simply because they notify me about it instead of just doing the update in the background. I always want the new versions, especially since so many of my browser/OS updates are security updates, but because I'm always notified about it when I either start the application, or when I close it, I never want to do it and spend extra time waiting while it does the update process when I had something in mind I wanted to do.

Making it open source is definitely the right direction. If it gets modified so that there is a control panel of sorts so that you an control the updates I think it will be considerably better for people.If it is set up as it is now (Updating at some time of low computer usage), with options that can be changed to only update through a specific connection, to only update when the computer has been idle for X amount of time, and similar times.

Look at the recent Conficker worm. There are estimates that over 10 million computers were infected with it (and are now having that annoying fake antivirus software downloaded onto it), because they hadn't installed a security update that was published in October. If they would just push the update after 1-2 months (Assuming that no major problems have been reported) to all Windows computers, much of the spread and potential damage would have been avoided. Since you use a Mac, you might not be used to this kind of problem. Windows always has some sort of a security hole, which is constantly being exploited. Anyone in IT can tell you how much of their time would be saved if Microsoft would stop nagging users about the security updates and just install them after they've been verified as stable. At the end of March we lost quite a bit of time having to scan all of the machines, and then going out and removing it from the one that had been infected, all because a higher up had heard about Conficker and was worried about what might happen on 4/1.

</comment></comment></comment></comment><comment><USER5> I hope this doesn't lead to one instance of the application for every program that needs updating. What would be more useful is a way for third-party applications to work with the existing Google Update. That way, you could update all your applications from a single interface. This would be a better experience than being asked to update an application it starts (and you're probably in a hurry to start using it).

Of course, you'd need to figure out some standard way of locating available updates. Is there anyone out there doing this sort of thing?

</comment><comment><USER6> I much prefer Sparkle's approach of opt-in, in-application updates, and I sincerely hope that Mac application developers will not adopt Omaha.

<http://sparkle.andymatuschak.org/>

</comment><comment><USER7> Having a background daemon running to automatically update software without informing the user is a poor solution, but trying to solve the problem introduced by checking for updates on startup and thus interrupting the workflow of the user is a good idea.

</comment><comment><USER8> This is terrible news. If every other windows application starts using their code, you can expect hundreds of megs of RAM flushed down the drain on your system (each google updater process takes up about 10 megs). I hate this process always reviving itself after I kill it. Having multiple instances of it will be a nightmare.</comment>


IBM's Early Computers - <AUTHOR> https://mitpress.mit.edu/books/ibms-early-computers <comment><USER2> This, and "IBM's 360 and Early 370 Systems" are two of my favorite computer- related books. I wish other historical books were as thick and as thorough and well-written.

<comment><USER3> Seconded. They are both great books. Some really amazing stories in there, like the development of the first hard drive.

</comment></comment><comment><USER4> If you're interested in documentation on early IBM computers, including the rare 600/700 series, there is a ton of stuff here: [http://www.bitsavers.org/pdf/ibm/](http://www.bitsavers.org/pdf/ibm/)

</comment><comment><USER5> I'm reading this book right now and it's glorious- it goes into a ton of detail on the history and design of early mechanical punchcard tabulators, sorters, multipliers, etc, in order to get you to the motivation to make it all electronic, etc.

Highly recommend it.

Also- this "printing" is really more a xerox of the original- and the "print" quality stinks. I got an older hardcover version off of amazon that was actually typeset and much easier to read.

<comment><USER6> Clutch advise. I just bought the last old used copyin Amazon. For about half the retail.

</comment></comment><comment><USER7> Oh, cool. My grandfather's name is listed in the index.

</comment><comment><USER8> Why did you post a link to the overview of an out-of-print book? That's fairly pointless.

<comment><USER9> If you found the overview interesting, you can get the book from the library.

<comment><USER10> And the link directly takes you to a "how to buy". There are multiple copies available. A bigger question is why we in the computer field let important histories of our profession go out of print so quickly.</comment></comment></comment>


Tell HN: Someone should build a site that sorts Mixergy videos by topics - <AUTHOR>

This came up because I am trying to find some good resources on how to get my first paying customers after having recently launched.
I love Andrew's interviews, but there is so much data there that it's hard to quickly sort through.
If someone wrote a script that, say, parsed the transcript for each of the videos and sorted them into a variety of buckets.
"Getting first customers", "Sustainable Customer Acquisition", "Marketing", "Learning Programming", "Hiring", etc.
Just many different buckets and topics that might be useful to the community.
I think that would be a nice value-add, and I (for one) would definitely use it - a lot. <comment><USER2> I keep trying new ways to do this, but so far nothing has worked.

A reader offered to lead a small group of curators who will tag as many posts as they have time for in exchange for full access to everything on the site.

I'm hoping that will work.

I would love to tag the posts myself, but I'm obsessive about the quality of the interviews and if I take on any more work I'm worried the interviews will suffer.

<comment><AUTHOR> Tag them in WP ?

</comment></comment><comment><USER3> I doubt any automated process would work very well. This is a good candidate for "crowdsourcing" though.

Create a simple tool that "hands out" an episode and allows you to create timestamped tags. Predefine the the most important tags. Announce on HN. I'd do a couple episodes.

<comment><AUTHOR> Hrmm....that's actually a great idea.

<comment><USER2> Thanks. Looks like this will be the way we do it.

If you're interested in giving it a shot, email me: <http://mixergy.com/contact>

</comment></comment></comment><comment><USER4> [http://www.google.com/search?q=first+customer+site:mixergy.c...](http://www.google.com/search?q=first+customer+site:mixergy.com)

<comment><AUTHOR> The issue with this is that Google lists them according to titles.

But there are many videos with nice nuggets that don't appear in the title.

</comment></comment><comment><USER5> that's a gerat idea dude/ mix mixergy! who wou;d expect mix3eregey itslef tobe mixed?S!!!

<comment><AUTHOR> An upvote would be nice :)</comment></comment>


2-Factor Authentication – A monster guide to securing accounts with 2FA - <AUTHOR> https://blog.shakepay.com/2-factor-authentication/ <comment><AUTHOR> Hey everyone!

I work at Shakepay (we help Canadians buy bitcoin) - we put together a guide on 2-factor authentication for our customers and figured the broader tech community would find it useful.

If you have any feedback we'd love to hear it! Thanks!

<comment> T3OU-736 A good write-up. Thank you for taking the time and the effort. Complex topic, and l believe, well covered, with a delicate balance struck between very deep details and keeping it accessible.

Some thoughts:

If possible, adding other TOTP apps to the list by name as examples of non- Google apps (which, for a long time, did not back up the entries, causing annoyance, gnashing of teeth, and despair) may be in order? Or at least mention that not all TOTP apps support backups?

Around the SMS topic and use of cells phones for auth - no mention of push- based setups? Authy and Duo come to mind. More secure than SMS (when SSL certs are _properly_ setup), and they do use the biometric auth to validate auth request. The option to indicate the authentication context (like location of the request origin from GeoIP) does help in reasoning about the request validity.

As an aside, I really do wish U2F tokens would have an option, on the device, to indicate which URL (or some other, harder-to-fake ID) of what is requesting auth. The use case I have seen is that people leave their U2F tokens plugged in, and effectively condition themselves to simply tap the button every time it blinks.

A side project for my "copious spare time" /s

 _Edit_ : fixed skipped words.</comment></comment>


Windows 7 Update appears to be compromised? - <AUTHOR> https://answers.microsoft.com/en-us/windows/forum/windows_7-update/windows-7-update-appears-to-be-compromised/e96a0834-a9e9-4f03-a187-bef8ee62725e <comment><USER2> This links to a Microsoft support thread in which several users are reporting a suspicious update distributed through Windows Update. In lieu of a title and description, the update has 108-character and 24-character base52-encoded random numbers. In lieu of "more information" and "help and support" links, it has similarly random base52-encoded domains, which currently do not resolve, in .gov, .edu and .mil. Searching for the patch title turns up a bunch of people asking about the same suspicious patch on other sites, all within the past day. The update is attracting attention because it fails to install.

[http://security.stackexchange.com/questions/101520/weird- win...](http://security.stackexchange.com/questions/101520/weird-windows- update) [https://www.reddit.com/r/techsupport/comments/3mykv1/weird_w...](https://www.reddit.com/r/techsupport/comments/3mykv1/weird_windows_update/)

This does strongly suggest a compromise of the Windows Update servers or of some bit of infrastructure that connects people to them, but also suggests that whoever the attackers are, they made a mistake - a successful compromise executed correctly would not leave so much evidence around. It's quite possible that they've been compromised for awhile, and this is a buggy update to the existing malware.

<comment><USER3> "Base52-encoded random numbers" is a rather obtuse way to describe random letters.

<comment><USER4> Base52 means capital letters and lower case letters. Base62 includes numbers (0 through 9).

We programmers like being specific. Sometimes these sorts of details matter.

<comment><USER3> This detail doesn't matter and is needlessly confusing. "Random upper and lowercase letters" is exactly as specific and accurate as "base52-encoded random numbers", but the former is more understandable while the latter is trying way too hard to sound smart.

<comment><USER5> look, this is hacker news. the author knows his audience. most people who read this will know what base52 is or will at least recognize what it might be and be able to look it up. i dont think it's meant to sound "smart", it's an accurate and concise description of the randomness

<comment><USER6> It wasn't smart since I literally thought he was saying there was encoded data.

</comment></comment></comment></comment></comment></comment><comment><USER7> Confirmed that it was a test update: [http://www.zdnet.com/article/microsoft- accidentally-issued-a...](http://www.zdnet.com/article/microsoft-accidentally- issued-a-test-windows-update-patch/)

<comment><USER8> I find it interesting that MS would use following URLs even though it was a test update [https://hckSLpGtvi.PguhWDz.fuVOl.gov](https://hckSLpGtvi.PguhWDz.fuVOl.gov) [https://jNt.JFnFA.Jigf.xnzMQAFnZ.edu](https://jNt.JFnFA.Jigf.xnzMQAFnZ.edu)

<comment><USER9> Both are well-known TLDs that can't be acquired without verification by the US government. Presumably the assumption is that these URLs can be guaranteed to never exist.

<comment><USER10> Then they should be using example.com (or .org, .net , .edu), which are actually reserved by the standard and guaranteed to never exist.

EDIT: Or, perhaps even better, the .invalid TLD which is also guaranteed to never exist.

<comment><USER11> Wow, MS didn't follow an established standard ... /s.

</comment></comment></comment></comment></comment><comment><USER12> Don't panic, it was just a boo-boo:

[http://www.zdnet.com/article/microsoft-accidentally- issued-a...](http://www.zdnet.com/article/microsoft-accidentally-issued-a- test-windows-update-patch/)

</comment><comment><USER13> If someone has managed to compromise Windows Update (which I doubt seriously based on what's presented here), why on Earth would they not bother to come up with text more convincing than the garbage on display here?

<comment><USER14> Yeah I'd say it's more likely someone or something in the update toolchain screwed up.

<comment><USER15> The other option is a deliberate "ethical" hack.

<comment><USER13> Wouldn't that also call for putting in text that at least makes it clear it's an ethical hack? The only explanation for that garbage is either lorem ipsit filler text (something never meant to get out) or the theory buffoon had about it being a hash collision.

</comment></comment></comment></comment><comment><USER16> There is a chance that the machines affected were already compromised by malware which altered the way Windows Update was working.

<comment><USER17> Several of the forum comments mention fresh installs. So possible, but fairly unlikely.

<comment><USER16> Fresh installs from what media though? "Pre-activated" Windows ISOs are freely available on any torrent search site with who-knows-what added.

<comment><USER18> That is a main issue with people who don't know how to look for the right ones. But I get my images by matching the MSDN MD5 hashes (I am not on 10 yet, even though digital river is gone the MSDN images are still out there)

/this forum is a god send

[http://forums.mydigitallife.info/index.php](http://forums.mydigitallife.info/index.php)

</comment></comment></comment></comment><comment><USER2> Does anyone have a copy of the 4.3MB file that this refers to? If so, please: (1) submit it to VirusTotal, and (2) post it here.

</comment><comment><USER19> I've been deploying Microsoft based computer networks for 18 years... this would nearly top my nightmare list! I can't imagine what the alert level is at MS offices right now, but I bet they are expending every effort to get to the bottom of this ASAP :/

<comment><USER20> Appeared on WSUS as well...

NEVER turn on auto updates on windows. Read all the KBs, then choose to install, ALWAYS. If you have a corp network, use WSUS and stop all updates and check them. If the KB is content-free like the new ones, no install. I avoided the whole CEIP bag of shit and Windows 10 upgrade notification hell thanks to that.

<comment><USER21> Always turn on auto-updates. The likelihood of you missing or delaying an update and getting hit by an a known exploit is a lot more likely than an exploit getting through the update system or enabling a new exploit.

<comment><USER20> No no no no no. I've watched entire networks of machines downed with auto- updates. Always read, always test.

<comment><USER21> It might make sense to pay a guy to make this his job for hundreds of computers on a corporate network, but there is no way in hell I'm keeping that close of track of updates on my home computer.

And when was this, over a decade ago? Also, what evidence did you have it was the auto-update system that caused the outage? Past performance is not a predictor of future performance.

Seriously folks, turn on auto-updates.

<comment><USER22> auto-updates have goosed more windows systems on me than malware. I'm not even a sysadmin.

there's been a few comments in the wild saying windows 10 can install without your permission. it may even be true, a bug.

so yeah I 'seriously' disagree with you.

[https://www.google.de/search?q=crash+tuesday+broken+windows+...](https://www.google.de/search?q=crash+tuesday+broken+windows+update)

scroll back through the years.

<comment><USER21> Eye-witness accounts are the least reliable source of evidence.

<comment><USER22> [https://www.google.de/webhp?hl=de#hl=de&q=%22microsoft+updat...](https://www.google.de/webhp?hl=de#hl=de&q=%22microsoft+update+withdrawn%22)

how about confessions?

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER23> [http://arstechnica.com/security/2015/09/nerves-rattled-by- hi...](http://arstechnica.com/security/2015/09/nerves-rattled-by-highly- suspicious-windows-update-delivered-worldwide/)

</comment><comment><USER24> Just to state the obvious, .gov, .edu, and .mil are all restricted TLDs run by the US. What kind of attacker uses domain names in their attack that they can't register?

Unless, of course...

But that would be a wee bit obvious.

<comment><USER25> > Unless, of course...

Unless the servers are compromised and used as C&C?

</comment></comment><comment><USER26> This is probably just a test update that went out by mistake.

If MSFT is anything like where I work, that "payload" is a picture of a cat.

<comment><USER27> Microsoft _should_ not be anything like where you work. I'm not a Windows- user, but if I were I would hope and expect that the update mechanism for one of the worlds most used pieces of software was closely guarded by several layers of computer-based signing and human approval.

<comment><USER28> There are certainly test environments that these updates are pushed to much more freely than the production environment. Mistakes happen.

<comment><USER27> I certainly understand what you are saying, but I must repeat the essence of my previous post. For something so critical, there should simply be too many safeguards for any test to make it through all the way to end users.

If a test update really did make it through, it would warrant significant questioning of the procedures at Microsoft. If a test could get through without being discovered, then so might malicious code.

<comment><USER3> It was a test update and there will undoubtedly be a review of this. [http://www.zdnet.com/article/microsoft-accidentally- issued-a...](http://www.zdnet.com/article/microsoft-accidentally-issued-a- test-windows-update-patch/)

The fact that a test patch got to this stage doesn't mean the safeguards aren't in place or that malicious code could have slipped through, though. Assuming even basic competence, this test update could not have been signed, and if someone had managed to push malicious code, the same would be true, so it wouldn't have been installed onto target machines.

</comment></comment></comment></comment></comment><comment><USER29> Looks more like an internal flub: "//rr1winwusfs04/c/msdownload/update/software/defu/2015/09/testexe_896e3a62-8954-447b-5a562bd65cc6_d5e430cb05ee8a627ee6d811da8d7c4ccea57f4b.exe"

That being said, that something like this could happen should raise lots of questions about the amount of oversight on updates hitting windows, and the general security of such systems. I'll wait for an official response or a reverse engineer before I decide what's going on here.

</comment><comment><USER30> I'd be surprised if an attacker would waste a compromise with something obvious. Perhaps it's some testing thing that wasn't supposed to go out.

<comment><USER31> Or maybe it has been exploited for a long time without anyone noticing it, and now the attackers screwed up?

<comment><USER32> Or a recent update to the infrastructure introduced a breaking change in a previously working malware package.

</comment></comment></comment><comment><USER33> Where's Microsoft on this? This is on two news outlets as well as HN. Microsoft PR needs to issue a statement in the next hour or two, even one that just says they're investigating the issue, or it will be on the evening TV news.

<comment><USER34> [http://arstechnica.com/security/2015/09/nerves-rattled-by- hi...](http://arstechnica.com/security/2015/09/nerves-rattled-by-highly- suspicious-windows-update-delivered-worldwide/)

It's already done. About 5 hours after the post was first opened on the forum. There's also an article on ZDNet.

[http://www.zdnet.com/article/microsoft-accidentally- issued-a...](http://www.zdnet.com/article/microsoft-accidentally-issued-a- test-windows-update-patch/)

</comment></comment><comment><USER35> Could it be a man in the middle that tries to install updates that aren't signed by Microsoft? It reminds me of this: [http://www.leviathansecurity.com/blog/the-case-of-the- modifi...](http://www.leviathansecurity.com/blog/the-case-of-the-modified- binaries/) .

</comment><comment><USER36> Not seeing anything on my Win7Pro SP1 VM - last update was 4.3MB VC++ 2008 Security fix - MFC applications being vulnerable to DLL planting due to MFC not specifying the full path to system/localization DLLs.

<comment><USER37> > 4.3MB

Interesting that the update in question is also 4.3MB?

<comment><USER36> Right, that's why I brought it up - it also relates to localization which may or may not be related. But interesting none the less.

</comment></comment></comment><comment><USER38> I haven't seen any randomly-named updates on my system - but I had earlier ripped out all the telemetry and Windows 10-related crap (KB2952664, KB3021917, KB3035583, KB3068708, KB3075249, and KB3080149) and marked them hidden. I've also set my update policy to notify-only.

Now the spy updates are not hidden, and marked as "Important." They're bound and determined to force this crap down our throats. Bastards.

"Because f*ck you, that's why." The rallying cry of the corporate world.

<comment><USER39> Could you please elaborate on how you did that?

<comment><USER38> Note this is Windows 7.

I uninstalled each of those KBs manually from the "Installed Updates" screen, then changed the update policy. I used to use "download and install manually" but now I'd prefer only being notified, and THEN deciding whether or not I want to download whatever is offered. I then re-ran the check for updates, and hid the offending KBs.

That was earlier this month. After reading this article, I decided to have a look and see if there was anything fishy in my update history (beyond the listed KBs that I don't want). Nothing there, at least, but my hidden updates were un-hidden (along with Silverlight and Skype, two more "do not want" things that I always hide).

</comment></comment></comment><comment><USER40> Can anyone shed some light on this?

</comment><comment><USER41> Too many "tests" this month, I'd say. Test cert, test update... Let's hope something worse like "test nuclear strike" won't follow.

</comment><comment><USER42> And the same company doesn't allow the users of the Windows 10 Home to review the updates, instead, the Windows 10 Home updates always download and install.

</comment><comment><USER43> Could it be that older versions of windows (2k3 for example) might allow this update to be installed? Has anyone tested this in a sandbox?

</comment><comment><USER44> Microsoft sending spyware again?

</comment><comment><USER45> I'm worried about friends, family, and small businesses that run Windows with install updates set to automated mode...

Shouldn't Microsoft be signing updates so that redirection attacks don't work?

Edit:

Elaborating on my question; I mean much more like Linux distributions which sign both packages (updates) and the index of those files. Some distributions use multiple hashs/digests to make collision attacks far less likely to succeed.

Such an attack could be either the traffic at layer 3 redirected via router compromise, via some name resolution weakness (possibly even to localhost as a way of malware upgrading from being able to edit the hosts file to having system level services).

The signing of both the update files and the list of updates could offer protection from an attack that would thus need to be valid for all of the signature checks, not just a single check.

<comment><USER46> I'm pretty sure Microsoft does sign updates. Which means either this is a glitch of some kind, or is being refused/failing installation because it's not signed ... Or, worse case, it means the update signing key has been compromised.

<comment><USER47> What does 'sign' mean in this context? I hear it a lot and don't understand the mechanism.

<comment><USER48> It refers to the idea that most asymmetric cryptosystems (which, generally speaking means that each user has a public key and a private key) allow for a user to create a 'signature' using their private key, which can be verified using their public key. See here:

[http://stackoverflow.com/questions/454048/what-is-the- differ...](http://stackoverflow.com/questions/454048/what-is-the-difference- between-encrypting-and-signing-in-asymmetric-encryption)</comment></comment></comment></comment>


Google Turns Over Identities of Bloggers on Benfica - <AUTHOR> https://www.nytimes.com/2018/10/23/sports/benfica-bloggers-google.html <comment><USER2> This is worrisome - US laws protect whistleblowers. I'm not a lawyer, and maybe lawyers here can confirm this, but it seems to me that the accused could've explored 'whistleblower protections' as a line of defense.

On a secondary note - what information for Google have regarding the blogger? Was Google the domain registrar or host, or something else.

We need a completely decentralized and anonymous by design TLD, and anonymous hosting providers - a tor for the host

<comment><USER3> This wasn't a case of whistleblowing though. It is mounting up to be a case of industrial espionage using a media company posing as "bloggers" to disseminate stolen private correspondence using innuendo and fabrications* with a view to gain illicit advantage over a competitor.

So far every accusation stemming from the stolen documents has failed to prove any criminal wrongdoing and, this is the important bit, every single legal case raised so far in multiple courts has been either dismissed or ruled in favour of Benfica.

* Example: this is a ruling from the Portuguese Media regulator making clear that the bloggers produced fake documents and altered dates and details to make allegations not supported by the stolen documents, so making the case that this is not whistleblowing but an attempt to discredit a business with lies.

[http://www.erc.pt/download/YToyOntzOjg6ImZpY2hlaXJvIjtzOjM5O...](http://www.erc.pt/download/YToyOntzOjg6ImZpY2hlaXJvIjtzOjM5OiJtZWRpYS9kZWNpc29lcy9vYmplY3RvX29mZmxpbmUvNzI1MC5wZGYiO3M6NjoidGl0dWxvIjtzOjMzOiJkZWxpYmVyYWNhby1lcmMyMDE4MTEyLWNvbnRqb3ItdHYiO30=/deliberacao- erc2018112-contjor-tv)</comment></comment>