Show HN: Supercharger – Make every email you send more compelling & concise - <AUTHOR> http://writebattle.com/supercharger/ <comment><USER2> This looks interesting!

Two reasons I wouldn't try it on the spot:

1\. It's only for Chrome. I prefer Safari (for battery life), or Firefox (for extensions).

2\. The free version doesn't allow "Intelligent scanning for weak sentence patterns" nor "Detect hundreds of jargon terms, redundant phrases, and other weak expressions".

That's a deal-breaker.

Why not let the free version do everything the "Full Boost" version can, but limit the number of emails it scans.

Say for the free version: "scan 1 email per day" or "1 per week" or whatever seems reasonable in a Freemium model.

<comment><AUTHOR> Hmm, thanks for your thoughts. Yeah I actually removed all mention of the paid version shortly after posting here because I think I might have jumped the gun on it. I'm going to expand this beyond Gmail to work on any website with a text box very soon.

Perhaps limiting number of evaluations is a better way of doing this. I'll see. Thanks for the idea.

As for browsers, Chrome is easiest to develop for. I'll expand to other browsers once I get a working, proven concept worth maintaining on both platforms. I know Firefox's add-on API is mostly compatible with Chrome's extension API, but Mozilla rejected my last extension because of some obscure security issue I have yet to figure out.</comment></comment>


Banks lobby against business-method patents (goaded by one patent) - <AUTHOR> http://www.nytimes.com/2011/06/15/business/15schumer.html

<comment><USER2> Hmm...

> the language of Mr. Schumer's provision seems aimed at banks or, > specifically, "a method or corresponding apparatus for performing data > processing operations used in the practice, administration or management of > a financial product or service."

It'd be nice if they'd attack business method patents in general, instead of just trying to carve out a little exception for themselves.

</comment><comment><USER3> It looks like the legislation they lobbied for pertains specifically to "...a method or corresponding apparatus for performing data processing operations used in the practice, administration or management of a financial product or service."</comment>


Study: Many pancreatic tumors are slow growing, taking 20 years to become lethal - <AUTHOR> http://www.hhmi.org/news/vogelstein20101027.html

<comment><USER2> I've only looked at the abstract (damn publishers), but superficially this seems to be a great study. I'd just like to underscore how amazing their samples are. The mean survival time of their patients, 2 years, is also surprising. (Survival bias?)

Getting at metastases is hard. In general it simply isn't medically necessary to biopsy them. Without medical necessity it's unjustifiable to put a patient through that risk and discomfort. Why are metastases important? Mostly because they're presumably cleaner than primary tumors.

In a primary tumor you start out some founder cell that has lost the ability to undergo programmed cell death. In general, DNA repair mechanisms are also awry. The cell divides producing daughter cells, the mutations add up and so on. The tumor becomes heterogeneous. The daughter cells diverge from one another. If you sample from the primary tumor you get plenty of mutations related to cancer, and plenty of mutations _unrelated_ to cancer, simply because the genome is a big place. It is no fun to work with this data.

OK. Metastases. Some immortalized cell has lost basal lamina adhesion and migrated to another site in the body. This is a selective bottleneck -- all of those randomly mutated cells that didn't lose adhesion are stuck in the primary. The secondary should therefore be enriched for mutations in oncogenes and tumor suppressors. This is why this data is so important and could give some great insights into oncogenesis.

Heck, here's an experiment I would love to run:

* Collect biopsies from primary tumors in non-metastatic cases.

* Collect biopsies from metastases in another patient population.

* Look for mutations and changes in genome architecture that are unique/overrepresented in the metastatic cases.

</comment><comment><USER3> Having lost my father to a pancreatic cancer, this is _excellent_ news. His case doesn't seem to be an exception and it was utterly terrible (< 4 months between the first symptoms and death). Pancreatic cancers are awful, and don't get anywhere near enough attention.

<comment><USER4> Haven't had a chance to read the article yet, but I was under the impression that the lethality of pancreatic cancer (and a few others) was mainly due to the fact that it's so damned hard to identify _until_ it's beyond the point of treatment. For example, during the period when the tumor is small, contained and treatable, it (again, AFAIK) doesn't tend to manifest any symptoms, or the symptoms which exist are identified as some other, more common issue.

<comment><USER3> > was mainly due to the fact that it's so damned hard to identify until it's > beyond the point of treatment.

Yes indeed, which is why I talked about the first symptoms (though I could have added the precision of the first _detected_ symptoms, in my father's case a strong pain in the lower back for no apparent reason). According to the article, pancreatic cancers are actually pretty slow and long-lived but they tend not to make themselves known until the very end when they've already started to metastasize and it's too late for treatment.

What I meant by "pancreatic cancers are awful" is mainly that the prognosis at the moment is one of the worst possible.

</comment></comment></comment><comment><USER5> Here's the paper in Nature for those who are interested.

[http://www.nature.com/nature/journal/v467/n7319/full/nature0...](http://www.nature.com/nature/journal/v467/n7319/full/nature09515.html)

</comment><comment><USER6> Great insight into tumor development. It reminded me of a scene in Dragon's Egg, a Sci-Fi story about life on a neutron star, where the aliens cure a female space travelers future breast cancer, by irradiating a tiny cluster of mutated cells.

<comment><USER7> Great book!

</comment></comment><comment><USER8> Thanks for submitting this.</comment>


Loving what I used to hate - <AUTHOR> http://sivers.org/hate

<comment><USER2> I'm glad Sivers focused on the positive, but our preferences don't only change to like more things. It would have been interesting to hear what Sivers used to love that he now hates.

In fact, I think we end up enjoying fewer things as we get older. After all, 90% of everything is crap[1], and decades of experience make us better at discerning quality. Also, the more memories we have, the less likely any new one will compare favorably to our best ones.

1\. [http://en.wikipedia.org/wiki/Sturgeon's_law](http://en.wikipedia.org/wiki/Sturgeon's_law)

<comment><USER3> > what Sivers used to love that he now hates

Talking with wantrepreneurs about their business ideas. :-)

<comment><USER4> Why do you hate it now?

<comment><USER3> Well really I was just making a little punchline here for HN.

But since you asked, after hearing hundreds of people's ideas, each wanting to know what I think of them, I feel like something short-circuited in my head, where the answer to all is just "I don't know, anymore."

It made me realize that it's not that I'm a fan of startups. I just like making things. I'm always way more interested in my own things than other people's things.

<comment><USER5> When someone asks you a question you are in no way obligated to answer.

</comment></comment></comment></comment></comment><comment><USER6> This is what scientific/rational beliefs are all about, open to new data and susceptible to change. Normally, when your long held beliefs somehow become part of your identity, it becomes harder to let go off them when contradicting data arrives. Being ambivalent is also seen as a negative trait since it signifies indecisive mind. There are shit loads of behaviors and expectations that evolution has invented which not only are not relevant today but also harm the society and individual in the long run.

<comment><USER7> Also, I'm not sure how you got to this being about scientific / rational beliefs. I'd posit a persons emotion response to music is as irrational and unscientific as they come. Changing ones mind about music down the track (pun!) has nothing to do with an analysis of the data because, with regard to music, "good" is entirely subjective, as distinct from "quality" with regard to acuity.

I think this is the part of the 'science' that some people take issue with. The 'scientific method' isn't always an appropriate way to view everything.

<comment><USER6> Yes, I agree with the music bit. I had other examples in mind that Sivers mentioned like his opinions about Indonesia and gym that changed overtime as he got more exposure to both.

Science might not be the best way to view everything but I was pointing out to the practice of constantly changing ones beliefs without putting extensive emotional investment in any of them.

If I love someone today and tomorrow they turn out to be a betrayer, I will be hurt but knowing humans are complex, I shouldn't be too surprised and change my views about that person instead of living in denial.

</comment></comment></comment><comment><USER8> I guess the opposite applies as well. Hating what you used to love :) at least for me this is very common.

</comment><comment><USER9> I'll back him up on the strength training -- you owe it to yourself to read Starting Strength. I read it at the beginning of this year and can definitively say it's changed my life.

<comment><USER10> I'd change that to say: you owe it to yourself to _do_ Starting Strength (or some other no-nonsense barbell program) for at least a month.

</comment></comment><comment><USER11> The reverse is why I'll never get a tattoo... or at least _today_ I won't.</comment>


Introducing Conduit – open-source service mesh for Kubernetes - <AUTHOR> https://buoyant.io/2017/12/05/introducing-conduit/ <comment><USER2> I'm happy for the guys at Bouyant, they've been great to work with in the past.

There's a very large complexity payment inherent in the new "cloud native" architectures that fundamentally isn't worth it for a large swath of use cases. Conduit, at first glance, appears like it might solve a large portion of it. If there's anything the last 10 years have shown us as an industry, it's that convention and programmer ease of use are the most important qualities of a new framework or way of working.

Rails / Go / K8S dominating Mesos / Containers over Jails / Maven over ANT / on and on. ActiveRecord is great, and Rails routing is great. Together they are magical for what they provide a user. Envoy is great. Istio is great. But there isn't a simplistic way to unify them even though for 95% of the industry it appears their functionality should go hand in hand.

We'll see if Conduit can fill that gap.

<comment><USER3> Istio actually uses Envoy as the traffic proxying layer so what do you mean by unify them?

</comment></comment><comment><USER4> > Conduit's Rust-based data plane proxies run in less than 10mb RSS and have > sub-millisecond p99 latencies.

I love seeing things move from Java/PHP/Ruby to Go (or better) Rust. Memory usage plummets.

<comment><AUTHOR> It's becoming something we're increasingly hearing from production users. To some of them, low, stable memory usage is almost more important than some of Rust's other features.

<comment><USER5> For components you run alongside your applications, it's really great. I once worked on an infrastructure where we deployed a lightweight but JVM-based proxy in front of every app, and that was basically a tariff of 256 MB on everything we deployed.

</comment></comment></comment><comment><USER6> At first glance, this looks like a direct competitor to Envoy[1].

I'm sure the documentation will improve as the product matures, but right now much is left to the imagination.

Could you perhaps go in to more detail on the differences between the two?

[1] [https://www.envoyproxy.io/](https://www.envoyproxy.io/)

<comment><USER7> Like Linkerd, Envoy is a proxy that can be used used to build a service mesh. Conduit is a service mesh that includes a proxy.

So, yes, Conduit uses something that competes with Envoy ;) But I would not say that Conduit and Envoy are equivalent things.

<comment><USER8> A service mesh needs a data plane (e.g. Envoy) and a control plane (e.g. Istio). Conduit has both in one product.

<comment><USER9> But how is Conduit better than the combined products? Doing two things poorly is worse than doing one thing well. (I'm not suggesting that Conduit does anything poorly, but it's not clear how it's superior in any way to any competing implementation.)

<comment><USER10> What they are presumably going for is ease of use, Istio uses a pluggable service mesh with Envoy being the most common one, and Linkerd being one of the alternatives.

I'm guessing they think Conduit can bring value by being an intergated solution out of the box, and I'm excited to see if they can deliver on that.

</comment></comment></comment></comment></comment><comment><USER11> I immediately thought of [https://github.com/snoyberg/conduit](https://github.com/snoyberg/conduit)

</comment><comment><USER12> I'm genuinely surprised they don't make a comparison to envoy or istio given the users they're attempting to target.

</comment><comment><USER13> How does it work with ingress? Does it ship with its own ingress like istio?

We tried istio a while back and it was too slow and hungry. Reverted back to no service mesh and it worked fine. I'm gonna be trying this next!

<comment><USER3> If you just want Ingress with Envoy, Heptio now has the Contour project:

[https://github.com/heptio/contour](https://github.com/heptio/contour)

</comment></comment><comment><USER14> > One thing we've learned is that there are deployment models where Linkerd's > resource footprint is simply too high.

It does seem like JVM based products standard answer "Buy More hardware" is becoming untenable.

<comment><USER15> This is something of a special case. Running Linkerd as a sidecar container — which is the pattern that's increasingly adopted in the Kubernetes world for service meshes and proxies — means you're going to run a large, memory-hungry JVM in every single container. Just guessing, but that's likely 300-500MB per container. It just doesn't mesh (heh) well with how Kubernetes is supposed to be run.

It's not surprising that Istio settled on Envoy, which is written in C++.

<comment><USER14> It is kind of sad that writing resource efficient software is considered a special case.

<comment><USER15> Not really what I meant. It's a "special case" because the sidecar container is a niche where the JVM doesn't work well. That doesn't mean you can't run JVM successfully elsewhere, which of course people do.

For example, you may be deploying a bunch of lean Go microservices that, at maximum, consume perhaps 20MB of memory each (peak). You can run 100 instances of said app and only consume 2,000MB, but add a big JVM that weighs, say, 200MB a piece, you now need 22,000MB of memory instead.

JVM startup time might be another factor, but I've not measured this.

</comment></comment></comment></comment><comment><USER16> At Pivotal there's a lot of interest in Istio. You might swing past the NYC (still in Brooklyn?) or SF offices and try to talk people into looking at Conduit.

</comment><comment><USER17> How does this compare to Istio or Envoy?

<comment><USER7> Conduit will probably have quite a bit of feature-overlap with Istio, especially, as it matures.

However, I think you'll find that the projects will be quite different in the way that they prioritize features and operate.

Our goals for Conduit are to provide a minimal, production-ready, commercially-supportable service mesh in the near-term. Time will tell how each projects goals and constraints lead to different user experiences.

</comment></comment><comment><USER18> They should have chosen name that doesn`t immediately make users want to uninstall it.

<comment><USER7> If you think Conduit is bad, you should see the list of names we _didn't_ use! ;)

<comment><USER19> Number 17 will shock you.

</comment></comment></comment><comment><USER20> The link to the tower library in the article is not working ([https://github.com/BuoyantIO/tower](https://github.com/BuoyantIO/tower))

<comment><USER21> Updated to [http://github.com/tower-rs/tower](http://github.com/tower- rs/tower) \-- thanks for the heads up.

</comment></comment><comment><USER22> Nice, checkout Ambassador from Datawire also.

</comment><comment><USER23> What is service mesh? Seems that I need some more info to understand what is this for...

</comment><comment><USER24> There's a company named Conduit. Possibly incurring into trademark violations.

</comment><comment><USER25> But what in the hell is it? If your product is so revolutionary it defines a new market segment, you might want to bring the people with the money people up to speed.

<comment><USER26> Typically a mesh is a set of proxies that are colocated with each service you deploy. The proxies facilitate service discovery and secure communication with other services. They abstract this functionality such that each service doesn't have to individually (and poorly) reinvent that wheel.

Your service would connect to database:5432, but instead of going straight to the database it goes to a proxy and the proxy has all the smarts to find and connect to the database, even if it's in another data center. The proxy can also do it securely such that you can go over the public network if necessary.

There's a good chance you don't need this complexity, but if you are hosting 100's of small services across multiple cloud providers, regions, or data centers, this starts to become an attractive option.

<comment><USER25> I just force every application to use a standard reliable transport library. Didn't realize I built a service mesh startup by accident...

</comment></comment></comment><comment><USER27> Great, another OSS project with a name that's a commonly used word. Let's hope they've checked there's no existing projects with that name. (Spoilers: they haven't.)

<comment><USER28> What I associate with the name is a malware browser ad/toolbar network a few years back.

</comment></comment><comment><USER29> Please don't release a toolbar ;)</comment>


Mou might hit 1.0 after all - <AUTHOR> http://blog.iwantmyname.com/2014/10/mou-might-hit-one-after-all.html

<comment><USER2> Everyone who uses Mou and isn't happy with MacDown should contribute $10 and +1 my feature request for custom key-bindings. As a vim / sublime text 3 user I often times forget I can't use the key strokes that I have ingrained into muscle memory. That makes me sad enough to donate.

I would be happy with multiple cursors and the selection shortcuts from sublime text but a plugin system would be even better.</comment>


The great global warming collapse - <AUTHOR> http://www.theglobeandmail.com/news/opinions/the-great-global-warming-collapse/article1458206/ <comment><USER2> The article opens up with a debunked denialist canard... but it still makes front page. Why is HN a haven for climate change denialists these days?

<comment><USER3> _Why is HN a haven for climate change denialists these days?_

I haven't seen many climate change denialists here; I have, on the other hand, seen lots of climate change _skeptics_. These two are not at all the same thing.

At my university, I know five faculty members -- a mathematician, a physicist, a chemist, a biologist, and an economist -- who have privately expressed the opinion that _given the lack of scientific rigour demonstrated by climate change researchers, it is impossible to judge whether anthropogenic global warming exists_.

These are not oil industry patsies; nor are they conspiracy theorists. They are serious scientists (yes, even including the economist) with concerns about the scientific process. I don't think any of them would say that anthropogenic global warming does _not_ exist; only that the research done so far is seriously lacking.

Not all _skeptics_ are _denialists_.

<comment><USER2> No, not all are. Just all but a vanishingly small number. For instance, the article takes the strategy of undermining climate science on a political basis then claiming it has no scientific credibility. This is a standard denialist tactic-- a true skeptic would be able to argue based on evidence, not what one would want to be true. Unfortunately, by publishing that article, the paper in question basically has declared that they have no interest in actually evaluating evidence and reporting on it.

</comment></comment></comment><comment><USER4> This seems more politics than HN worthy.

<comment><USER5> I agree, it's getting tiresome seeing all these op-ed pieces posted here. HN is under steady assault now from astroturfing.</comment></comment>


Disconnected: Career aspirations and jobs in the UK [pdf] - <AUTHOR> https://www.educationandemployers.org/wp-content/uploads/2020/01/Disconnected-Career-aspirations-and-jobs-in-the-UK.pdf <comment><USER2> On page 5 they show a nice graph that breaks it down in a less "click baity" headline. Can you guess the top 3 jobs NOBODY wants?

If your guess was retail, catering/food, administrative; you would be correct. The reason nobody aspires to be in these jobs is the pay is garbage. Weird ones like logistics sticks out, however that seems more like a role you work your way into or know someone more than something you can just get right out of college kind of like middle management.

Overall this doesn't seem like anything out of the ordinary for most kids who are fed the "follow your dreams" malarkey and don't have parents who know know someone who can get them into a legitimate career.</comment>


Disappointed with Gittip - <AUTHOR> http://whit537.org/2013/01/disappointed-with-gittip.html

<comment><USER2> "Gittip is designed for long-term, sustainable funding, and only supports recurring gifts at this time."

Did I miss some great reason why they don't do once off tips? Sometimes you just want to throw 10 bucks at a person and not worry about recurring transaction. I imagine allowing this would increase overall tips due to cheap folk like me.

<comment><USER3> Sustainability is a core design goal for Gittip. I want to be paying my mortgage from Gittip gifts, so it needs to be predictable and consistent. Does this limit growth? Yes. But it makes the growth we do get much more reliable. Gittip grows slowly and shrinks slowly, and that's by design. Once we have the recurring baseline well-established, I fully expect we'll mix in one-off gifts.

I added a +1 for you here:

<https://github.com/zetaweb/www.gittip.com/issues/5>

<comment><USER2> Well! Nice getting a direct reply from the man himself. Have you considered adding that reason to your FAQ for some comic relief?

I'd be right on this band wagon if once off's were allowed - I'd happily tip three repositories off the top of my head but don't want to commit to ongoing.

Would it be considered bad form to +1 it myself thereby technically causing a +2?

<comment><USER3> Help yourself to the +2. :)

You can always workaround it by tipping on Thursday and then changing your tip on Friday.</comment></comment></comment></comment>


Bitcoin's Mt. Gox: Inside the quick rise and even faster fall - <AUTHOR> http://business.financialpost.com/2014/02/28/bitcoins-mt-gox-inside-the-quick-rise-and-even-faster-fall/?__lsa=4986-eeac

<comment><USER2> Looks like there's nothing new here.</comment>


Passwords are obsolete - <AUTHOR> https://medium.com/cyber-security/9ed56d483eb <comment><USER2> This entire article assumes that "it is pretty inconvenient to have to put every single one of them into a password manager" and then goes on to make that case that it's preferable to check your email account or phone for a temporary password???

Just from a UX perspective - security aspects aside - this is worse by a magnitude. Password managers are nowadays a single click in your browser. Use them.

<comment><USER3> > Just from a UX perspective - security aspects aside - this is worse by a > magnitude.

This is not true, clicking a link in an email, or copying a number from an sms is much easier than first logging into my password manager, finding the entry and then copy it into the field.

Also, this also works for apps as well, not just the browser.

Besides, password manager usage might still be quite low. So what the writer advocates is not less secure than having a single password for almost all their websites, like most people have.

<comment><USER4> LastPass doesn't require copy-paste on many websites- it can fill on click, or automatically. It's slick and very fast. I leave it logged in so I don't need to type my master password more than once every few days on my home machine. The newest LastPass version on Android can auto-fill in apps, too.

On websites that I've enabled 2FA on, I let LastPass autofill (no clicks) and pulling up Google Authenticator on my phone is what takes time.

The problem with using SMS as your only authentication is, what do you use for your second factor? I suppose a PIN would work.

SMSes are also trivial to intercept: imagine the national telco silently routes some login SMSes that were going to a number on a list to the local internal security agency. The user just gets no SMS (or a code that doesn't work), assumes something went wrong on the network, and asks for another one. Meanwhile the "baddies" have logged in already and snaffled up the information they want.

What I want is to be able to use Google Authenticator as my only authentication, plus a PIN for slightly sensitive sites and a long password for very sensitive sites (and to disable my phone from a distance).

</comment></comment></comment><comment><USER5> Wait, what? So instead of entering a password a password is sent to me via text message or email with a temporary code, sort of like two-factor authentication without the two-factor?

So how do I login to my email account for example if I need to login first to my email and get the temporary password? It's a chicken and egg problem. I can't login to my email to get my temporary code, but I am trying to login to my email.

Somewhat flawed idea in theory, even more horrible in practice. I hope this doesn't become a real thing. I will refuse to use any site that implements this flawed passwordless solution.

<comment><USER6> Woah, hold on.

> sort of like two-factor authentication without the two-factor?

If you don't have 2-factor, which most sites don't, then it is 1-factor. This is replacing that 1-factor with another 1-factor.

> So how do I login to my email account for example if I need to login first > to my email and get the temporary password? It's a chicken and egg problem.

You are taking him too literally. While he did say it could replace passwords, he obviously didn't mean email auth. Email auth would probably still require a password. Since many have their email password saved, they may not usually have to enter that anyway, most of the time.

> Somewhat flawed idea in theory, even more horrible in practice. I hope this > doesn't become a real thing. I will refuse to use any site that implements > this flawed passwordless solution.

You've not presented any valid argument against it. Why is it flawed? If it is horrible in practice then why do many companies use SMS as secondary auth (for the "2" in 2-factor)?

<comment><USER7> >why do many companies use SMS as secondary auth (for the "2" in 2-factor)?

Because they don't know about TOTP or HOTP, and they instead decided to use a terribly insecure protocol as the basis for user authentication? The onus is on you to prove SMS is better than a shared secret + a nonce.

<comment><USER6> Ok, valid point- to clarify, when I said 2-factor SMS, I was assuming a 30-second TOTP like Google's.

If you don't use TOTP, someone can login to your account just by knowing the password which they can use from almost anywhere. If you were to only use TOTP, they'd need your phone. To me them stealing your phone is tougher than stealing or guessing your password.

</comment></comment></comment></comment><comment><USER8> Am I the only one who thinks that launching my e-mail client, getting mail, probably scratching around in the Spam folder etc sounds like a fairly hellish user experience?

<comment><USER9> Mozilla Persona authenticates you using your email without the need to check your email every time (and without the need to enter your email password if you are already logged in).

Persona is awesome for that, and for the "no central authority" thing. To bad it lost momentum and seems an awesome relict inside of Mozilla.

<comment><USER10> Unfortunately the non-native experience was never very good, and even the example implementers they pointed to were hit or miss for actually working cross browser.

I do kind of hope they use heartbleed to make a second push with it fast, while people are paying attention to the problems with current models.

</comment></comment></comment><comment><USER11> I don't like this proposal, simply because e-mail and SMS are _not_ secure. Something like SQRL sounds much better to me, in contrast.

 _> What is the benefit over traditional usernames & passwords?

\- There are no usernames or passwords to have compromised, lost or stolen.

\- No keyboard interaction, great for using public computers that could log your keystrokes.

\- You only need your Master Key, no lists of usernames and passwords to keep track of.

\- There is NO WAY to link one person across sites based only on the site- specific public key, websites may ask for more infomation that could be tracked._

[http://sqrl.pl/guide/](http://sqrl.pl/guide/)

[https://www.grc.com/sqrl/sqrl.htm](https://www.grc.com/sqrl/sqrl.htm)

</comment><comment><USER12> The problem with this is that it's not as convenient as passwords and people hate things that are even slightly inconvenient.

Typing a username and password is very fast assuming that you remember them both (even faster with a password manager). Now you have to log in to your email every time you want to log into any website. This is especially inconvenient if you are a webmail only user. Or you have to get a code sent to your phone which you have to retype if you want to use the website on a different device.

What happens if your email provider goes down, or your phone isn't working?

<comment><USER13> >The problem with this is that it's not as convenient as passwords and people hate things that are even slightly inconvenient.

This is generally true but I wouldn't go that far.

One example of something that is more than 'slightly inconvenient', while being introduced globally fairly recently, is captchas. Sure, nobody likes them but it isn't like people have boycotted sites that have them.

(another example would be requirements for longer passwords with digits and mixed letters in them - a requirement that was mostly non-existent 10 years ago)

Sure, email authentication is probably more inconvenient than my examples, but you can definitely make improvements to it (a browser extension similar to those used by password managers for example can greatly reduce the inconvenience) if it becomes the standard.

</comment></comment><comment><USER14> I just want to note that passwords are not the only sensitive information that go through a server you are communicating with. Even if there were no passwords, I would consider Heartbleed just as bad.

<comment><USER15> Agreed. Really wish this was more of the story.

</comment></comment><comment><USER7> Why is this article promoting a seriously flawed form of 2 factor auth? SMS based 2fa is easily broken compared to protocols based on a shared secret and invalidated using time or some kind of nonce counter :/

Edit: ah nevermind, it's promoting this as the _only_ factor which is even more idiotic.

</comment><comment><USER16> Submitter, please provide a better URL next time. Here we have:

[https://medium.com/cyber- security/9ed56d483eb?utm_source=Twi...](https://medium.com/cyber- security/9ed56d483eb?utm_source=TwitterAccount&utm_medium=Twitter&utm_campaign=TwitterAccount)

i.e. all the twitter campaign garbage. Instead use this:

[https://medium.com/cyber-security/9ed56d483eb](https://medium.com/cyber- security/9ed56d483eb)

<comment><USER17> On the upside, this might screw up the "campaign tracking" by counting the visits from HN as Twitter referrers.

</comment></comment><comment><USER18> This is quite a stupid idea. How exactly am I supposed to log into my passwordless email to check the email containing the code to get into my email ?

The assumption that "the ability to send an email or SMS to users reliably and quickly" doesn't mean the user will receive it in a timely manner or at all.

But even assuming this article is actually sound and works as described, would replacing password with email/sms authentication improve the overall security ? I'm not so sure that sending unencrypted email containing authentication data is improving security or that trusting a phone to be handled by its owner at all time is a sane assumption to make.

Then there is the issue of the whole authentication process being turned into the quite annoying and not always working password reset process which often is not handled in a secure manner.

The correct way to fix this stale password issue is simply to revoke passwords and ask users to choose a new one as is usually done when security has been breached.

</comment><comment><USER19> "The basic idea is that instead of using a password to authenticate each user, a temporary secret code is sent to them over a secure channel. "

Secure Channel, like OpenSSL you mean?

<comment><USER7> No, you use a shared secret which both you and the server can use to generate a one-time password. You send the OTP (over something like TLS still, yeah) and the server checks that it is valid and makes sure it can't get replayed.

<comment><USER19> Forgot to add /s to my comment.

<comment><USER7> Just to be clear, I wasn't disagreeing with you, I was disagreeing with the article. Their method over SSL/TLS is just as broken as you say.

</comment></comment></comment></comment><comment><USER20> Sensationalism at its best. It's "passwordless authentication" except for the fact that you still have to somehow login to your email account.

</comment><comment><USER21> This is DANGEROUS advice. Email is typically one of the easiest channels to access. There are dozens of ways that someone can get access to your email, it shouldn't even remotely be considered secure.

For low security content it can be acceptable, I've used this method for email subscription centres before, however the only actions a user could do is manage their email subscription and thus it was considered to be acceptable. The idea that this method would be used for a SaaS product that is being paid for is mind-boggling.

Thats not to say it couldn't be used in multi-factor authentication, but tying the only authentication to email is creating a giant single point of failure from an insecure system with a shoddy security history.

</comment><comment><USER22> WTF? Email and SMS are not even remotely secure channels for transmission of data. Granted SMS is harder to get too but your telco typically stores all your messages (for a period of time) for law enforcement reasons and everything is passed in the clear for emails.

You are better off using a trick like this one: [http://blog.rabidgremlin.com/2009/12/28/tip-creating-easy- to...](http://blog.rabidgremlin.com/2009/12/28/tip-creating-easy-to-remember- passwords/) to create a unqiue but easy to remember password for all the sites you use. Of course you want to use at least 4 different patterns one for banking, one for email, one social and one for the rest of the web...

<comment><USER7> And anyone with $1500 and some free time can intercept your GSM communications and read the plaintext anyway. See: [http://youtu.be/rXVHPNhsOzo](http://youtu.be/rXVHPNhsOzo)

</comment></comment><comment><USER23> I would go out on a limb and say it would probably be easier to sniff these codes from email and sms traffic than it would be to extract passwords from transient memory via Heartbleed.

</comment><comment> vezzy-fnord Not all passwords are equally valuable. Even if you are subscribed to 268 different services, it's quite likely most of them are not of particular importance to you.

One-time passwords are old as dirt. But they're also susceptible to MITM, and when TLS is vulnerable or you send through a plaintext/poorly encrypted channel (SMS), it especially makes no difference. Then, OTPs turn your mobile device or email address into a single point of failure, thus raising interest for their compromise.

</comment><comment><USER24> This is poor advice.

This article is written as if it were suggesting two-factor authentication. In actuality it's suggesting a new one-factor authentication. A single factor that my phone company and device manufacturer can access, no less.

On Android, you can give apps permission to read your text messages. The effect, were this author's advice followed, would be that apps get access to all of your other services.

</comment><comment><USER25> I've tried the email > login flow, and my experience was that users hate having to check their email to log in. Power users didn't mind, because they often have their email very readily accessible at all times. It was much harder to convince average users that it wasn't an extra layer of effort (a perception problem).

</comment><comment><USER26> Is sms channel really secure? Isn't it a plain text channel, as opposed to an unencrypted channel?

<comment><USER2> SMS is encrypted on GSM control channels using the broken A5/1 stream cipher which has well-known weaknesses.

<comment><USER7> and the base station can _disable_ encryption completely without any warning given to the cellphone user.

</comment></comment></comment><comment><USER27> YubiKeys are quite a good solution to this issue. OTP always, and a unique User ID as well. It can even go so far as plug in the key, press go and you're all ready, no usernames or passwords needed.

<comment><USER28> YubiKeys still can cost you up to $50, where as TOTP using something like google authenticator(doesn't have to be google auth) costs you? Nothing?

</comment></comment><comment><USER29> Multi-factor authentication is still required to protect the email.

The only problem I have with two-factor auth on my Gmail is that I sometimes just don't have my phone with me. I don't remember if I could send a confirmation to my backup email address or not. A while ago my Android phone's screen experienced glitch and wouldn't respond. I was in the middle of some important business which required me to access my email. But the screen was dead so I couldn't access either the Google auth nor SMS code on the phone.

<comment><USER10> This is what the backup, one time use codes are for. You should keep a set in your wallet, bag, or whatever non-electronic thing you keep with you all the time. I have so far had to use that once in the time since google introduced 2-factor, but man was it ever useful.

<comment><USER29> Ah. Right. Unfortunately, that's one thing I and probably many people don't ever write down because "writing down 'password' is bad". I probably should do that for my 2-auth since the probability of someone I am familiar with stealing my wallet and attempting to log in my email is probably negligible.

</comment></comment></comment><comment><USER30> I've been looking into JWT tokens (claim that this device is authorized to do something). If there is a breach on server side, you simply replace public and private keys. Each user can also have a different public key.

Registration on User side:

1\. Enter email

2\. Welcome email with token

3\. Save token (password manger, mobile phone, print it...)

4\. Use app

If someone steals your token, you simply request new token and old gets immediately invalidated.

It's like Mozilla Persona, but there is no middle man.

</comment><comment><USER31> The real problem are password managers. Where you used to have ten keys separately, you now have one key which can access ten keys. But that's not what the user thinks. Convenience over security. If you are using a password manager your attack vector scales horizontally with the amount of registrations you have.

It's not a solution.

<comment><USER32> It is absolutely the best existing solution to today's problem which is company databases being hacked. If you yourself as an individual are being targeted then all bets are off, and you'll probably need something a bit more heavy-duty than is available in off-the-shelf software today.

</comment></comment><comment><USER33> This sounds less convenient, harder to implement, and no more secure than OpenID, and even that failed to gain traction.

<comment><USER28> > This sounds less convenient, harder to implement, and no more secure than > OpenID

In what way is it less convenient? A standard user has their phone with them...24/7? At least in the sms realm it's more convenient than trying to come up with a password that has: A capitol letter, a number, a special character, a lower case letter. Also way more secure, a user gets sent a message of a one time code looking like 037.820.374.839 the time it would take to guess that, the one time code would have been timed out and the hacker would have been no closer to getting in compaired to a static password.

<comment><USER34> Not everyone has smart phones.

Not everyone that has smart phones keep it on them all the time.

Not everyone that has smart phones that keep it on them all the time have a working (charged) phone all of that time.

<comment><USER28> > Not everyone has smart phones.

> Not everyone that has smart phones keep it on them all the time.

> Not everyone that has smart phones that keep it on them all the time have a > working (charged) phone all of that time.

What do smart phones have to do with sms?

<comment><USER34> Disregard that adjective:-p I'm an idiot:(

<comment><USER28> Not an idiot :) You make a good point that people don't have their phones on them & alive all the time which is where totp can come in with dongle totp's (like [http://www.securemetric.com/secureotp- time.php](http://www.securemetric.com/secureotp-time.php)) agreed it costs you a fair amount but if you want secure when you don't have your phone... it's worth it. And then maybe like google have a few longer random passwords that are to use when you don't have your phone or a TOTP/OTP generator.

</comment></comment></comment></comment></comment></comment><comment><USER34> I wish protocols like TLS-SRP (or SRP as an HTTP auth method?) would become more prevalent. At that point you can authenticate over a clear-text stream and it'd be secure. I don't see any reason we should still be sending secret information to a server like this.

</comment><comment><USER35> The irony of this?

Medium asks me to 'sign in' to view the content...

 _I know this isn 't the author's fault_

</comment><comment><USER36> Totally agree, except for the fact that email is a secure medium. Phone would be much better.

<comment><USER18> Phone is no better than email. Security through a physical object that can run out of battery, be stolen, have no signal, cost money to have service, offers no cryptography while being under mass surveillance across the world, etc.

</comment></comment><comment><USER37> And here I thought this was going to be clever.

</comment><comment><USER38> Scenario Heartbleed 2

\- People heed the advice of this author, and soon all passwords are abolished, replaced with email auth.

\- Of course, emails still have a password, as you can't email auth an email.

\- Heartbleed 2 happens, hackers focus on Heartbleeding email services.

\- For every email password you get, now you have complete control over this person's life, as all services are linked to it for auth.

\- Security experts start proposing that you have a separate email for every email auth service, and every email has a separate password, so you can isolate damage.

\- Result: previously you had N passwords for N services and 1 email. Now you have N passwords for N services and N emails.

Yay for "improvement"!</comment>


The Pragmatic Programmer a Book Review - <AUTHOR> http://kiramclean.com/blog/the-pragmatic-programmer/ <comment><USER2> I tried to read this book a while ago after spending maybe 5 to 6 years in the industry. I don't think I really got anything out of it to be honest. A lot of the content makes sense, but in a "well, duh, captain obvious" kind of way. This is not a criticism, I'm ready to admit that somebody with more than a few years of experience is not the main target of this book.

However, it is a great read for anyone starting their career.

<comment><USER3> I think it depends where in the industry. In the startup world, where much of what it says has been internalized in the industry for so long that if you work around the industry, you'll get a lot of it by osmosis, you're probably right. Other places in technology (e.g., in enterprise) I think that's a lot less true, and yet a lot of it is can be just as valid and useful for people working in those environments, even if the its not part of the cultural knowledge they are steeped in.

</comment></comment><comment><AUTHOR> That book is a highly relevant read to anyone who feels something is unpleasant about their work as developers.</comment>


Ask HN: I feel incapable of learning - <AUTHOR> I'm currently in my second year of University and I feel like I'm not actually absorbing any of the information that is being taught. I'm only just passing. I have difficulty recalling information and putting it into context. I'll hear numbers and terms and phrases and it kind of feels like they all just "bounce off" of my brain. I've tried using flash cards, creating a zettelkasten (a kind of personal wiki note taking system), I've completed the course "Learning How to Learn", I take extensive notes, I've tried improving my diet, exercising, and making sure I get enough sleep. All to no real benefit. Am I just dumb? It's really demotivating! Is there anything else that I could try? Have you experienced something similar? <comment><USER2> It is hard to say what is really going on, but I can tell you the best way I've found to remember things. It isn't really easy and I too fall out of the habit, but it should be a goal.

1) Read the chapter before your professor lectures on it.

2) During lecture stay engaged. Ask questions. Expand on things that you were confused about. You're there to learn. The professor is there to teach. You aren't taking up any one else's time. And HAND WRITE NOTES. Don't just copy either, explain, reword. Make it YOURS. This is much easier to do if you aren't seeing the material for the first time.

3) Before you go to bed, reread that chapter/section.

4) A week later reread it again.

5) A month later, again.

By this time it should be in your long term memory (if not before). It is extremely important to be engaged. If you aren't engaged then nothing will stick. You're telling your brain it isn't important. And if you don't have repetition then you're reinforcing this behavior. Studying is a skill, and not an easy one. I've seen a lot of dumb people get high quality degrees and be very successful. The difference is that they have to work a little harder. And don't forget that people frequently under play (and over play) how much studying they do. No one is really honest about it.

<comment><USER3> It's not enough to merely read the material, what makes it really stick is using it.

<comment><USER2> This is very true. It is part why I say "engaged" so much. But I think it depends on the material you are studying. In HOW you are engaged. In math, engaged can be doing problems and finding out what the equations mean in a meaningful way. If you're trying to memorize words, engaged can mean concentrating on the image or trying to make mnemonics.

</comment></comment></comment><comment><USER4> This is completely anecdotal, however, I find I don't feel like I absorb any information unless I can apply it to something. With more mathematical topics, I need to work through problem sets. With literature/history I need to draw parallels to other events. Figuring out how to put information in context is what helps me retain information. It is a struggle because this requires a lot more time and attention than wrote memorization but as with anything there is trade offs.

<comment><USER5> I couldn't find the quote, but there is one where Richard Feynman takes what he reads/hears and visualizes it in his head, then compares any new information to that visualization. This maybe helpful if you can't find a practical application. The mental visualization can be the application... build the thing in your head, watch the data, molecules, money, etc flow around in your visualization.

Edit: Original poster mentioned notes, flash cards, wiki... which seem like more of the same - memorization. Without more context, I really think lack of visualization could be an issue here.

<comment><USER6> Do you remember roughly where you read that Feynman quote? (Or was it a video?)

I'd be really interested to read it.

<comment><USER5> I couldn't find it because from memory I was googling 'feynman furry'. The keywords are 'feynman "grow hairs"'. From his book called "Surely You're Joking, Mr Feynman":

"I can't understand anything in general unless I'm carrying along in my mind a specific example and watching it go. Some people think in the beginning that I'm kind of slow and I don't understand the problem, because I ask a lot of these "dumb" questions: "Is a cathode plus or minus? Is an an-ion this way, or that way?" But later, when the guy's in the middle of a bunch of equations, he'll say something and I'll say, "Wait a minute! There's an error! That can't be right!" The guy looks at his equations, and sure enough, after a while, he finds the mistake and wonders, "How the hell did this guy, who hardly understood at the beginning, find that mistake in the mess of all these equations?" He thinks I'm following the steps mathematically, but that's not what I'm doing. I have the specific, physical example of what he's trying to analyze, and I know from instinct and experience the properties of the thing. So when the equation says it should behave so-and-so, and I know that's the wrong way around, I jump up and say, "Wait! There's a mistake!"

Also from the same book:

"I had a scheme, which I still use today when somebody is explaining something that I'm trying to understand: I keep making up examples. For instance, the mathematicians would come in with a terrific theorem, and they're all excited. As they're telling me the conditions of the theorem, I construct something which fits all the conditions. You know, you have a set (one ball) – disjoint (two balls). Then the balls turn colors, grow hairs, or whatever, in my head as they put more conditions on. Finally they state the theorem, which is some dumb thing about the ball which isn't true for my hairy green ball thing, so I say, 'False!'"

<comment><USER6> Thanks for digging it up! :)

</comment></comment></comment></comment></comment><comment><USER7> No you're not Dumb.

One of the big harmful failures of mainstream education lies in its framing learning as being successful at said education. Learning as memorizing information which can be tested and measured to meet the needs of the institution. The fact that students need to be forced and threatened in order to go through the process, and that this process kills interest and intrinsic motivation don't seem to alarm the institutions about their approach, and are accepted as a fact of life.

Similarly, academia seems to try to prepare people for ... academia.

The best advice I've heard about college is to focus on creating connections and lasting relationships so you end up having a lot of connections in the industry of your choice. This can be tremendously helpful in highly collaborative professions like filmmaking or software.

As for learning, I invite you to see it as a process of becoming and adapting, not as a process of memorization. Adapting to school and academia (grades, tests, reciting back information) is helpful to the institution but not necessarily for you.

Often the real learning happens on the job, in an apprenticeship context, where you adapt to the job itself. Some career paths, like medicine and law, require unusual amounts of memorization but people who are not this type of learners get weeded out early in the process.

Lastly, I recommend Sir Ken Robibson's Ted talk on schools and creativity. An eye opener.

<comment><USER8> I want to add my voice to the chorus. NO, you are not dumb! I was very impressed with the strategies you've tried. You simply haven't identified the right solution, yet. I also applaud your bravery in asking for help and advice and am grateful you've gotten some really helpful suggestions.

</comment></comment><comment><USER9> So distractions, learning disorders, depression, note taking techniques have all been covered already but not interest.

Does the subject matter just bore you? Do you not know why it matters? Do you have only a vague handle on how it fits into the big picture? Does it seem like the subject 'doesn't affect anything?' Perhaps you just need to get excited about learning the subject or have a concrete application of it before you can learn it effectively. I know that subjects in physics which I love (e.g. astronomy and optics) I would just plow through and test well in, but subjects which seemed less interesting to me were a struggle. In some subjects I just needed to know why they mattered, like economics seemed totally boring and irrelevant until right around the 2008 housing crunch and then suddenly I couldn't stop reading and learning about it!

Even if one of the other problems discussed is your primary obstacle it may still help to talk with your Professors and Tutors and see why they are passionate about the subject. Ask them, why does the subject matter? How does it fit into the big picture? What are interesting applications you can inspect, measure, mess around with etc?

</comment><comment><USER10> Some good points by others on this post. I want to focus on something more latent. Are you sure there are no other distractions in your life?

Try to find out if there is something deeper than surface level that is bothering you. Such distractions can be of any type: lack of interest in what you do (or rather, the constant desire of doing something else), homesickness, heartbreak, financial hardship, issues with family or friends, etc. If there are any such reasons, you should try addressing them first. Either solve them, or get some help in coping with factors you cannot solve.

<comment><USER5> I didn't know it in my 20s, but I was completely distracted by chasing girls to find one that I thought is perfect. Once I found my wife in my 30s, my ability to focus and learn went through the roof. Wish I had this focus when I was in school.

My suggestion is to only have 1 or 2 goals and viciously cut everything else out. I've learnt to say no to other distractions. In fact, I only have a 2nd goal around because there is waiting involved in 1st goal.

</comment></comment><comment><USER11> I'm extremely out of my depth and have only survived thus far using the 'Quiz and Recall' method of learning, where I take Cornell style notes of everything assigned to us and then go through my notes trying to explain (out loud, to nobody) each concept they're trying to teach us that week, such as 'give two equivalent definitions for expander graphs' and if I can't explain it without repeating myself or stumbling words I then read material and work examples until I can. I also search Google Scholar for survey papers on the subject and often just a well explained introduction will click some understanding.

At first this was a miserably slow process where after each lecture I noticed I couldn't explain anything properly and thought I was doomed but after a few weeks it gets easier. You also have access to TAs and office hours you should use them as you're paying for them.

Something else I try is active reading, as I'll just turn to autopilot through a long chapter not retaining anything and need to stop and ask questions to myself about it or try and model whatever it is in emacs using any language.

</comment><comment><USER12> Based on the problem solving skills demonstrated in your attempt to help yourself learn better, you're definitely not dumb.

I second the note about getting tested for ADHD. Another reason could simply be performance anxiety or imposter syndrome.

Have you tried joining a study group ? If you can find a _positive_ group of people to study with, you might feel less anxious about it.

Perhaps also consider talking to your professors. It sounds like you're trying and they always want to help.

</comment><comment><USER13> > I'll hear numbers and terms and phrases and it kind of feels like they all > just "bounce off" of my brain.

I'm not a doctor, but this sounds like ADHD. I have the condition and will barely retain anything if I don't have the treatments for it. You should seek out someone who can test you for this.

</comment><comment><USER14> I was going to suggest the new Learning How to Learn book, but I am not sure how different it is from the online course.

One other book I would suggest is The Evelyn Wood Seven-Day Speed Reading and Learning Program.

</comment><comment><USER15> It might be good to get a neurological checkup if your uni has a clinic that could do that or refer you out for one just to rule out anything obvious. On the practical side of things, Cal Newport (calnewport.com) has written extensively on study strategies. Unfortunately he was just a toddler by the time I was in college so I can't directly attest to whether they work but his writing on deep work did resonate well with me.

</comment><comment><USER16> Are you taking notes digitally or on paper? Handwriting notes has been shown to improve recall.

Also, are you getting enough sleep? That can have a major impact on memory.

<comment><USER8> +1 on this. This is accurate for a couple of reasons: 1.) You simply cannot write as fast as you hear information, so you have to process it immediately, summarizing the information in your head, before you write it. 2.) Your learning modalities (aural, visual, tactile, kinesthetic) might be more visually or movement-oriented, so handwriting engages you in a different way than just hearing the information. Typing notes does not have the same benefit, since the operation is automatic. Here's a link to a related study: [http://journals.sagepub.com/doi/abs/10.1177/0956797614524581](http://journals.sagepub.com/doi/abs/10.1177/0956797614524581)

</comment></comment><comment><USER8> One other comment: Is it possible that you have a learning disability? This is completely unrelated to intelligence--you can be VERY smart, but still have a learning disability. Some people just don't learn in the standard way. Perhaps you could consult the education professors(specifically those specializing in area of learning disabilities) to see if they'd be willing to evaluate you?

</comment><comment><USER17> Are you interested in this information (I don't mean whether you "want" to learn; rather, is the information itself enticing)? Do you have difficulty maintaining your attention, or do you simply feel unable to commit the facts from short-term to long-term memory?

</comment><comment><USER18> Have you ever had any trauma to your head?

<comment><AUTHOR> I have had a minor concussion once about a decade ago, but it wasn't really that bad.

</comment></comment><comment><USER19> Recall whether you hurt anyone recently. Apologize asap.

<comment><USER20> Please elaborate on how this could be the cause of a mental blockage</comment></comment>


Show HN: CodeGophers, Send an email to get any coding task done in 48 hours - <AUTHOR> http://codegophers.com <comment><USER2> "Credentials: We're ex-Googlers and trained computer scientists. We invert binary trees [links to [https://twitter.com/mxcl/status/608682016205344768](https://twitter.com/mxcl/status/608682016205344768) ] for fun."

Wow, way to ensure I am never, ever going to recommend this service to anyone. I am not impressed they can invert a binary tree. What is impressive is how they can manage to come across as pretentious, try-hard bullies in their own effing marketing material.

<comment><AUTHOR> Thanks for the feedback. It was meant to be tongue in cheek, but clearly it came off the wrong way. We're going to revise this shortly.

</comment></comment><comment><USER3> I am very happy to see startups like this.

Convenience factor from Uber - when ordering taxi i am not sure if it will be in my place in 20 minutes. In Uber i am very sure. Same apply here - task will be made in 48h or not.

I imagine future startups all like these - when user will be starting a chat with AI that will route him for humans or another AI to finish the task.

Back to the history when people were calling services from yellow pages.

[http://www.cluetrain.com/](http://www.cluetrain.com/) \- "De-cloaking, getting personal: We are those markets. We want to talk to you."

</comment><comment><USER4> This could be something that could work pretty well, but it makes me think of this xkcd: [http://xkcd.com/1425/](http://xkcd.com/1425/)

<comment><USER5> Why? Surely experienced programmers, who are being asked to do the work before giving a cost estimate, know the difference between a project that will take 48 hours and one that will take five years. Plus they charge, if I read correctly, a maximum of $500 so one would think they wouldn't take anything that's even remotely out of that $scope.

</comment></comment><comment><USER5> Cool! But these are indeed small tasks. From the site:

18,469 lines of code written, approved, and delivered

137 projects lovingly completed

So that would be 134 lines of code per project?

</comment><comment><USER6> This entire concept sinks or swims on its ability to accurately estimate and control scope.

<comment><USER3> Scope is already estimated and contolled by upper bound.

</comment></comment><comment> bulte-rs Emails to you are bouncing.

<comment><AUTHOR> It looks like the firstname.lastname@example.com email is not set up correctly. We'll fix that shortly, but you can email email@example.com until then.</comment></comment>


YouTube was down - <AUTHOR> http://www.youtube.com/?gl=GB&hl=en-GB

<comment><USER2> Someone posted this picture: <http://i.imgur.com/E6Fmo.png> [1]

Maybe YouTube is setting up a new design and that's why most of us keep getting a 500 error.

[1] Source: [http://www.reddit.com/r/youtube/comments/11p32s/not_sure_whe...](http://www.reddit.com/r/youtube/comments/11p32s/not_sure_where_to_go_but_why_does_my_youtube_look/)

<comment><AUTHOR> I would expect their deployment strategy might be more planned out. It could be the issue though.

</comment></comment><comment><USER3> Their api still works, and hence so does vid.io

Evidence that they're not using their own api for their dashboard!

</comment><comment><USER4> back up :S

<comment><AUTHOR> Now to wait for GitHub.</comment></comment>


TechCrunch didn't report Zaarly's $14.1M raise (Crunchfund invested) - <AUTHOR> http://techcrunch.com/tag/zaarly/

<comment><USER2> Hey folks, I'm a writer at TC. This wasn't about CrunchFund, it was an embargo issue.

<comment><USER3> Since when does TechCrunch honour embargoes?

<comment><USER4> My assumption is that after Arrington was ousted, they went back to their old ways.

Kind of sad, really.

</comment></comment></comment><comment><USER5> Quick chime in, I'm the CEO of Zaarly, exactly what jkincaid said... this had nothing to do with CrunchFund and was just about an embargo.

<comment><USER6> congrats on the raise

</comment></comment><comment><USER7> It is however, posted on CrunchBase: <http://www.crunchbase.com/financial- organization/crunchfund>

"CrunchFund invested in Zaarly. (10/24/11) Posted 10/24/11 at 10:43pm via businessinsider.com"

</comment><comment><USER8> when did it happen?

edit: 7 hours ago

p.s. publications aren't required to cover everything... is this insinuating some conspiracy theory</comment>


Ask HN: Where to get free bootstrap themes for a landing page for an iOS app? - <AUTHOR>

Hey all, I'm looking for a free bootstrap landing page for a mobile app I'm developing. Normally I would make it myself, but I have to focus my efforts on the functionality of my app. I've found quite a few that cost money, but money is really tight right now and every dollar counts (student without a job)<p>I'm looking for something along the lines of http://landy.paolotripodi.com/ or http://www.blacktie.co/demo/flatty/ Anyone know of anything? Thanks <comment><USER2> I would go to Dribbble.com and search for "app PSD".

Dribbble is an invite-only network for high quality designers who regularly put out high quality PSD's for the community!

</comment><comment><USER3> Hi - Not sure if they have exactly what you are looking for - but you can find free Bootstrap templates at bootstrapzero.com \- Renee @Backand</comment>


Ask HN: Who Do You Bank With? - <AUTHOR> With all the discussion around banks with bad security practices lately, I was wondering what bank the (US) HN crowd prefers?<p>2FA is a must, but things like an actually usable API and some more tech-oriented features would be great. <comment><USER2> I don't bank online. At all.

Maybe I'm old; maybe I'm paranoid. Maybe I worked in internet security for five years (including security of banks).

<comment><USER3> I recently opened an account with Ally, an online-only bank, mainly for it's 2.0%+ interest rate on savings, compared to the 0.01% from Wells Fargo.

Did I mess up?

<comment><USER2> No clue. You opened yourself up to some attacks that weren't possible before. Is that worth the 2% interest? I can't say.</comment></comment></comment>


Specification style and the future of the Web - <AUTHOR> http://dbaron.org/log/20120827-specification-style

<comment><USER2> I would like to understand the thrust of this article, but honestly, I'm not sure what kind of floats we're talking about here.</comment>


Ask PG: Vim shortcuts for navigating HN? - <AUTHOR>

Any chance we could get keyboard shortcuts integrated into HN?<p>Nothing fancy, just something simple akin to: http://www.google.com/experimental/ <comment><USER2> Just install vimperator or conkeror.

It's called a user agent because the user controls it. Don't rely on site authors to care about your special needs!

<comment><USER3> Vimperator is the only thing keeping me using firefox and not another browser. The chrome version is just not as good.

<comment><USER4> Same here...That said, Firefox is still a real dog in OS X compared with Chrome and Safari.

</comment></comment></comment><comment><USER5> cool idea, but no reason to wait for PG to do it. it shouldn't be hard to hack up a greasemonkey script or a chrome plugin to add that functionality for yourself. then once you've proven its usefulness, i'm sure PG would be happy to consider adding the script to the site for everyone.

</comment><comment><USER6> If you are using Conkeror, you can use create a page mode, specific to a site - <http://conkeror.org/WritingPageModes>

Conkeror seems to have a reddit mode already in place, may be you can cook up a mode for HN - <http://conkeror.org/PageModes>

</comment><comment><USER7> See <[http://news.ycombinator.com/item?id=277099>](http://news.ycombinator.com/item?id=277099>); -- the linked post doesn't seem to work for me, but the first link in the first comment does.

</comment><comment><USER8> We use and maintain this: [http://www.acunote.com/open-source/javascript- keyboard-short...](http://www.acunote.com/open-source/javascript-keyboard- shortcuts#greasemonkey)

It's modeled on Google Experimental, and other Google/vi-style shortcuts. Would love to see something like this implemented in HN codebase.

</comment><comment><USER9> Vimium for chrome gets you closer anyway.

</comment><comment><USER10> i'm a vim lover, but this request is just plain nuts

<comment><USER11> Why is it nuts? Gmail does this.

<comment><USER12> The jQuery API docs have something similar with the up/down arrows. <http://api.jquery.com/></comment></comment></comment>


A Crypto Challenge for the Telegram Developers (2013) - <AUTHOR> https://moxie.org/blog/telegram-crypto-challenge/ <comment><USER2> Just for the fun of it, what tools could be used to bypass the crypto used in this post?

<comment><USER3> > 1\. Alice generates a random 32 byte value, super_secret, using the NSA > backdoored random number generator, Dual_EC_DRBG.

The Dual_EC_DRBG backdoor was described by some sources as having a "NOBUS" vulnerability (only NSA knows the secret parameters necessary to exploit it). Interestingly, it might not be directly possible to exploit this in this setting because in the published attacks, the attacker needs to see some RNG output in order to deduce other RNG output. If this step is the _only_ use of Dual_EC_DRBG in Moxie's protocol, perhaps the attacker doesn't have the necessary information.

> 2\. Alice sends a message to Bob asking for his public key. Bob responds > with bob_public, an 896bit RSA public key. Nothing is signed. Nothing is > verified. We're just kinda hoping there was no MITM attack.

First, an attacker could substitute a different bob_public value in the unauthenticated traffic and then do an active MITM attack (continuing the two sides of the protocol separately with both parties).

Second, an attacker can factor the 896-bit modulus. A research group previously demonstrated an ability to factor a 768-bit modulus. While 896 bits is harder, hardware has also gotten cheaper in the meantime.

[https://en.wikipedia.org/wiki/RSA_numbers#RSA-768](https://en.wikipedia.org/wiki/RSA_numbers#RSA-768)

> 3\. Alice encrypts super_secret with bob_public using "textbook RSA" and > sends it to Bob. No random padding of any kind, just zeroes. e = 65537.

Some of the problems with not using message padding are described in [https://crypto.stanford.edu/~dabo/pubs/papers/RSA- survey.pdf](https://crypto.stanford.edu/~dabo/pubs/papers/RSA-survey.pdf), although I think there are others. This is also described in

[https://en.wikipedia.org/wiki/RSA_(cryptosystem)#Attacks_aga...](https://en.wikipedia.org/wiki/RSA_\(cryptosystem\)#Attacks_against_plain_RSA)

I actually suspect that the best-known attacks don't apply here because the plaintext is strongly random, sent only once, and Alice and Bob don't perform many other RSA operations that an attacker can control or observe, but it would be worth thinking about more.

> 4\. Both Alice and Bob now compute message_key = MD2(super_secret) (we know > you like dated crypto, so we thought you'd like the MD2 hash function).

Not clear that MD2 is a risk here either: it has flaws as a hash (for example, it is vulnerable to preimage and collision attacks), but these don't obviously make the secret key that it outputs more predictable in itself.

> 5\. Alice sends her message to Bob by computing ciphertext = message xor > message_key. Aged to perfection, our XOR encryption is even older than your > 70s era crypto, so what's up now?

If this is repeating-key XOR (that is, if the ciphertext is longer than 128 bits and so the key must be reused), this is a big problem because the attacker can shift the ciphertext by 128 bits and XOR it against itself, which yields plaintext ⊕ shifted_plaintext, because the two copies of the key will cancel out. If the plaintext is actual text, there are many possible regularities that could be observed; for example, when two letters occur in identical positions, the result will be 0, while when a letter and a space occur in the same position, the result will be the same letter but with swapped case.

Correctly guessing a plaintext byte at any position allows determining the secret key byte at the corresponding position.

This is discussed in more detail at

[https://crypto.stackexchange.com/questions/2249/how-does- one...](https://crypto.stackexchange.com/questions/2249/how-does-one-attack-a- two-time-pad-i-e-one-time-pad-with-key-reuse)

[https://crypto.stackexchange.com/questions/6020/many-time- pa...](https://crypto.stackexchange.com/questions/6020/many-time-pad-attack)

To summarize, I think the big problems are

* no authentication, permitting undetected active MITM

* short RSA key, permitting factorization of modulus (hence passive decryption, even retrospectively)

* apparent reuse of symmetric key for each 128-bit block of the message, allowing standard attacks against the "many-time pad"

I don't believe the Dual_EC_DRBG, lack of RSA padding, or MD2 create obvious vulnerabilities in this context, or, if they do, they aren't any worse than the ability to do the active MITM due to lack of authentication for bob_public. :-)

<comment><USER2> Wow, thanks for the in-depth reply (on a post that doesn't look like it's going to get a lot of views).

I'll admit my ignorance of information security (it's something I'm working on), but as a naïve reader I got the impression (considering the supplied ciphertext block) that the article was using paper-tiger/theater encryption that was practically broken in the sense that (given some CPU/GPU time) the tools existed to decrypt it. (Hence my "just for the fun of it".)

Thanks a lot for the links, I'll definitely be checking them out!

</comment></comment></comment><comment><USER4> Original HN discussion from three years ago:

[https://news.ycombinator.com/item?id=6936539](https://news.ycombinator.com/item?id=6936539)

</comment><comment><USER5> So, did something change over the last 3 years? Is it still unknown if Telegram protocol is ok?

<comment><USER6> I think the encryption has been known to be bunk for quite some time now [1]

[1] [https://eprint.iacr.org/2015/1177.pdf](https://eprint.iacr.org/2015/1177.pdf) [2] [http://www.alexrad.me/discourse/a-264-attack-on-telegram- and...](http://www.alexrad.me/discourse/a-264-attack-on-telegram-and-why-a- super-villain-doesnt-need-it-to-read-your-telegram-chats.html) [3] [https://unhandledexpression.com/2013/12/17/telegram-stand- ba...](https://unhandledexpression.com/2013/12/17/telegram-stand-back-we-know- maths/)

</comment></comment><comment><USER7> (2013)</comment>


Ask HN: Fail stories? Made a significant project but no one came? - <AUTHOR>

Anyone wants to share stories about how they spent a lot of time crafting interesting projects but eventually it failed? Aka postmortems.<p>Thanks! <comment><USER2> I'll bite:

It was 2008, I was a junior in college, I had been coding on-and-off for a few years (for hire) but was anxious to do my own thing.

I decided my "killer idea" was to sell safe-sex supplies online (condoms, lube, toys, etc). I built a site called "OrgasmSafely.com" and then opened 5 credit cards and bought about $15,000 worth of inventory.

I was renting a tiny room near campus, and my inventory filled it up. Boxes and boxes of condoms, gallons and gallons of lube. I had to put my bed against the wall. I slept in a ball in the corner.

I ordered dozens of T-shirts that said "OrgasmSafely" and handed them out on campus. I printed up thousands of flyers and handed them out at nightclubs. I setup an affiliate program. I ran google adwords campaigns. I setup an ebay store. I wrote to the school newspaper for feature stories, etc etc etc.

Nobody came.

Within a few weeks the minimum payments of the credit cards overwhelmed me. They were all maxed out. I was toast. I couldn't even afford to pay for hosting. I shut it down and walked away, with destroyed credit.

Sigh...

Post-mortem lessons: Don't buy inventory up front. And don't start a business you can't afford to keep running for awhile.

...Also don't sell condoms on the internet...

<comment><USER3> Wow. Even just this little summary had me hooked, you should write the whole tale up in full, you'd get readers in droves.

</comment></comment><comment><USER4> Hey zura,

I posted this article on my blog a while back about how I gave up too soon on my SaaS:

[https://mattkremer.com/how-i-got-2200-pre-signups-for-my- saa...](https://mattkremer.com/how-i-got-2200-pre-signups-for-my-saas- in-2-weeks-then-failed-hard/)

Since failure, I've successfully relaunched the product and am getting a lot more actual traction than the first time around :)

</comment><comment><USER3> I posted this on my site a few weeks ago, detailing my most recent failed project. "Failure" might be a harsh description in my case, but "success" hardly seems appropriate either.

How Not to Build Phone Apps: The Story of Twelve Gauge Software: [http://drewrobey.com/articles/bydatepublished/2014-09-09](http://drewrobey.com/articles/bydatepublished/2014-09-09)

</comment><comment><AUTHOR> Hm, it seems not that many HN people fail or at least they are shy about this :)

Anyway, thank you guys who replied, very interesting read!

As for me, I've been thinking to start "somethings" for a long time but I'm afraid that it will fail... i.e. I do not risk to invest a time.

<comment><USER3> If we define a "failed project" as one that someone has worked on and then shelved when it didn't gain traction, then I think that perhaps a more common scenario is that of the Zombie Project; after spending so much work on something you can't bear to shut it down, so you leave it ticking over, not updating anything and not attracting any new users. Until you pronounce the project officially "dead" it's not a failure...until then it'll just keep limping along. I think recognising when a project has gone "zombie" and having the balls to kill it off is massively important, both for time, sanity and closure's sake.</comment></comment>


Ask HN: Macbook Pro with external Magic keyboard and Magic pad experience - <AUTHOR> I've a Macbook pro 2015 edition. I've been thinking of using a magic keyboard and a magic pad to get past some RSI issues I've been having in my shoulder. I've tried both the magic keyboard and the pad in apple stores but I am looking for some reviews about its long term usage. Anyone here at HN has a similar setup and would like to share your experience? <comment><USER3> Is there a particular reason you want to stick with Apple gear for your keyboard and mouse? Mac OS is super configurable and will happily let you remap the keys such that Alt becomes Command/Apple and the Windows key becomes Option.

I personally use a Goldtouch for my keyboard and a trusty old Microsoft intellimouse (the white and red ones). Others swear by the Kinesis line of keyboards, particularly as they go one step further in reducing common programming challenges of the Control and Escape keys being hit by your left pinky finger.

<comment><USER4> Keyboards are a very personal choice. Personally I actually prefer to use the Apple Magic keyboard with my desktop Linux system. You can remap keys easily with system tools. Although my next best preference are mechanical keyboards, i.e. using Cherry key switches.

<comment><USER3> I should have been clearer. Since the OP is complaining about RSI, I would strongly suggest looking at keyboards designed for that purpose. I definitely agree that people have a lot of personal choice in the area, but it sounds like the OP needs an ergonomic solution.

<comment><USER5> I was wondering that too. A keyboard like the Kinesis Freestyle or a competitor is specifically designed to address OP's post. If it doesn't work, send it back.

Apple's keyboard may be great but definitely doesn't put one's wrists in the least-strained position.

</comment></comment></comment></comment><comment><USER6> At work, I used that configuration with an older MacBook Pro for over a year and a half, including an external monitor and a stand for the MacBook.

I continued using this configuration with my newer MacBook Pro, with the same external monitor.

At least, I did up to the point where I had to get a second MacBook Pro and external monitor for other work that I can't do from my primary machine, and given the limited desk space I had to get rid of the external keyboards, touch pads, and laptop stands. And I think my RSI problems are returning.

I would use the same external keyboard plus magic pad plus keyboard stand and external monitor on my home MacBook Pro, if I had a good dedicated desk where I could keep all that stuff connected all the time.

A good dock/hub has been a lifesaver for me, where I can keep everything else plugged in, while having just the one cord I have to disconnect from my laptop, when it's time to pack up for the day and take everything home.

</comment><comment><USER7> I've used both long term. Your best, most comfortable option when working at a desk is always to use external devices (display, keyboard, mouse/trackpad). Otherwise you're forced to hunch over or remain in overextended positions.

Mac hardware is very high quality, and my experiences with their external keyboard, mouse, trackpad have always been positive. I've also enjoyed using Logitech's solar keyboard ([https://www.logitech.com/en-us/product/wireless- solar-keyboa...](https://www.logitech.com/en-us/product/wireless-solar- keyboard-k750-mac)). I like never having to charge it. They used to also have a smaller version (no keypad) but it looks like they don't sell it anymore.

Using a laptop by itself is only nice when you're on a couch or bed or something similar that allows you a lot of freedom to change position.

</comment><comment><USER4> I have used by 13" MBP in a TwelveSouth BookArc with 24" LCD, a Magic keyboard and Touchpad. It works very well as a pseudo desktop. The only provisio is that you must have the power connected and switched on. The combo turns on when you hit the side button the keyboard or touchpad. Every once in a while that doesn't work and you need to open up the MBP to get things running. I think it is a BlueTooth glitch; I have a similar problem with another Apple Magic keyboard running with a Linux system. Then again, BT seems flakier on Linux.

</comment><comment><USER8> I was getting some right hand RSI a while ago, so thought I'd try a magic pad. My left hand has very little fine control - I'm very much right handed. I was surprised to find I could use the Magic Pad with my left hand with almost as much control as the right. This was a breakthrough for me, I could just spend a week using my left hand only, and the right hand recovered as new.

Btw I also have used a Logitech Trackball for many years with good results. The right hand issue was from using a mouse for a prolonged period - <USER2> again.

</comment><comment><USER9> I spend most of the day in front of an LG ultra wide and a vertical Kogan 2k connected to an Early 2015 Retina Mac Book Pro and driven using a Magic Keyboard and Magic Trackpad. As far as keyboard and trackpad I love it. Another not so obvious benefit is that I can use my left hand to operate the track pad and it doesn't feel weird (I'm right-handed).</comment>


Show HN: Run apps in EC2, synced to your own text editor - <AUTHOR> https://booste.io <comment><AUTHOR> The link in this post was broken, so I've reposted. Please direct attention to [https://news.ycombinator.com/item?id=22963649](https://news.ycombinator.com/item?id=22963649)

</comment><comment><AUTHOR> Hey HN, my name is Erik, the creator of Booste! This is my second Show HN for the project – looking forward to your thoughts.

Booste is a command-line interface (CLI) that takes code written on your local editor/IDE and executes it in EC2. It runs remotely, in a pre-configured environment, but works with your local tools thanks to a background filesync process.

I want to fix the "it works on my machine" issue by bypassing personal machines entirely. As if Docker and Heroku had a lovechild.

How I came to building Booste:

Being a mechanical engineer turned software dev, there were countless times where my laptop (glorified tablet) couldn't handle the workload needed.

So I made Booste v1: a tool to host full desktop apps on AWS and stream it over RDP (remote desktop protocol) to clients. Some may recall the Show HN of Booste v1 six months ago.

Booste v1 sucked. Unusable latency, crap unit economics, and an infrequent pain point.

Through it all, the most common customer request was for a hosted VS Code. Prospective users wanted the perks of a cloud IDE (namely no-setup environments) but wanted to use their own tools. Diving deeper, it seems that most large companies build out their own (usually buggy) version of remote "devboxes". The need seemed consistent and clear.

After the first Show HN and a failed W20 interview, I pivoted. I gutted the graphical desktop component, zoomed in on developers, and rebuilt as a CLI: Booste v2.

Running any shell command proceeded by the world 'booste' will trigger the CLI. The CLI tunnels that command through SSH to EC2, executes it there, and streams the stdout back down to your command line. Filesync makes sure EC2 is ready with your code.

Where "npm start" would run an app on localhost, "booste npm start" runs the same app in the cloud, visible to your team by URL. You can edit the code locally (VS Code, Sublime, Vim) and the save is synced and hot-swapped on the live URL within a second.

How the environment sharing works:

\- The creator of a "Codebox" (EC2 instance) gets a barebones Ubuntu VM, on which they can set environment variables, install interpreters and packages, or set up databases. (pre-built env templates coming soon).

\- Team members join the codebox by ID and password with a single "booste join" command.

\- Codebox members get repos placed next to each other on the directory tree, so code doesn't clash.

\- There is "booste clone" feature in the works, where you can clone someone's config without actually entering and messing with their codebox.

Under the hood:

-The CLI is built in Python using the Click library

-Codebox infrastructure is automated with the AWS SDK.

\---Currently, they are EC2 instances, for the sake of getting the beta live. I plan to migrate to a more flexible containerized setup in the near future. Containers make much more sense.

-I built a Dropbox-like filesync, inspired by the sync.

\---It monitors a chosen directory on your local machine and syncs it with the codebox.

\---When files in that directory are added, modified, or removed, the codebox reflects this within a second. Only differentials are sent.

\---All communication is encrypted with frequently cycled keys, unlike sync.

\---Bulky files (ML data, dependency packages), which would otherwise slow rsync to a crawl are ignored by a customizable .boosteignore file.

-Since files sync asynchronously (on edit), the only latency is from ssh. There's a 0.5 - 1 second delay on booste commands.

I've moving from closed to open beta. Fueled by covid and the now mandatory remote development teams, I made a free tier for you.

Give it a try! Let me know what you like. Let me know what you hate.

(edited for clearer formatting)</comment>


Toolbase.io - Search engine for SaaS tools sorted by industry, size, painpoints. - Ozzie-D https://toolbase.io/ <comment> Ozzie-D Hey There, co-founder of toolbase.io here.

Today is our launch day... and we don't have to cancel due to weather!

6 people have been working on this for over 6 months to curate the best online tools and design a system whereby you can get personalised lists and recommendations.

We were watching the space quite keenly and noticed other players here which can be thought of as competitors (Siftery, startupstash, stackshare etc.) that were answering a a definite need in tool discovery. However we think there is such a vast number of tools AND different personas out there, the best solution had to use some kind of filtering mechanism that is at least one level more advanced then what is out there today.

That's why we decided to curate our own list of tools that now display personalized results based on your company size, top 5 pain points you have and industries(soon). Start here: [https://toolbase.io/#start](https://toolbase.io/#start)

-

Up until 2 months ago, our core value proposition was roughly "Best tools to build your startup / tech business". With the COVID-19 and huge shift to remote working, we pivoted our positioning statement to "Discover the best tools to be a remote company". We have also deeply curated 8 lists for 8 major domains of digital transformation that is available here: [https://toolbase.io/explore](https://toolbase.io/explore)

We do hope you find this product useful and keep it bookmarked to come back to when you need a new tool.

Sincerely,

Ozan "Ozzie" Dagdeviren

</comment><comment><AUTHOR> Aestheticly, the main font (logo / h1) looks squished, like an image that has been shortened without resampling or cropping

I also do not think this qualifies as a search engine, it's a simple 3 question form</comment>


15 Worrying Things About the CRISPR Babies Scandal - <AUTHOR> https://www.theatlantic.com/science/archive/2018/12/15-worrying-things-about-crispr-babies-scandal/577234/ <comment><USER2> We have to consider a few things. CRISPR is a bacterial immune sysyem against bacterial viruses (phages) and it has evolved to toss a monkey wrench into the phage duplication machinery. It must act fast - too slow and machinery wins the race. This means it must act on rumor - as it were. This may lead to erros when attached to another molecule CAS, which may well want precision. A phage has it's genome well spread out and accessible, but human cells are tightly involved with chromatic - which means finding the needle in the haystack is very slow and hard work - and error prone. So am embryo starts as one cells, divides, 2, 4, 8, 16 in the initial stages - and that is when the genome is accessible to be sieved, during mitosis. So this researcher must wait until the embryoe is in mitosis before adding the gene correcting vector. He also needs to add an excess to make sure it finds the correct place to cut out a gene and spilce in a gene (or gene fraction). He then has to test this cell for correct placement (proof reading), he also has to make sure it has only a single edit, that there are no others scattered here and there. So he must allow this cell to divide a few times. and also keep one or more aside to use for a child if that line meets the quality required. I do not know what his error rate was? Di he make hundreds to find a few? The fact we have twins leads me to feel that there was a process of testing and making up of many multiples, and even possibly hundreds of discarded batches - full of errors etc. I ex[ect this news to filter out. He may not tell us, he may not live to tell - there are rumors...</comment>