Why is Vladimir Putin so late for meetings with world leaders? - <AUTHOR> http://www.independent.co.uk/news/world/politics/vladimir-putin-russia-president-late-meetings-world-leaders-queen-pope-angela-merkel-barack-obama-a7507916.html <comment><USER2> This article is silly.

When you see the graph of wait time by person (country), you clearly understand that this is perfectly deliberate, and expresses exactly the assessment of President Putin about the moral quality and actual importance of the person and her country.</comment>


Slysoft vs. Blu-Ray: Round 3 --- New BD+ Break - <AUTHOR> http://wesleytech.com/slysoft-breaks-newest-blu-ray-disc-bd-protection/956/

<comment><AUTHOR> A month early! Way to go Slysoft.

But note: they've moved from 5 years of free updates to a subscription model. It's getting more expensive for them to keep up with Blu-Ray.

Let's see when the next batch of uncrackable discs gets deployed, and how long it takes Slysoft to break them.</comment>


Please visit Dilbert.com to read this feature. - <AUTHOR> http://feed.dilbert.com/dilbert/daily_strip

<comment><USER2> It seems Dilbert.com is killing RSS-Support. Their feed item only show "Dilbert readers - Please visit Dilbert.com to read this feature. Due to changes with our feeds, we are now making this RSS feed a link to Dilbert.com."

Any alternatives for my daily Dilbert fix, short of visiting the website?

<comment><AUTHOR> I made a replacement: [https://github.com/fredley/dilbert- rss](https://github.com/fredley/dilbert-rss)</comment></comment>


Vessel's A/B Testing Platform For Mobile Launches Out Of Closed Beta - <AUTHOR> http://techcrunch.com/2013/10/02/vessels-ab-testing-platform-for-ios-and-android-launches-out-of-closed-beta/

<comment><AUTHOR> How it works [http://docs.vessel.io/how-it-works/](http://docs.vessel.io/how- it-works/)</comment>


Andy Grove's Paranoia: Universal Lessons (1996) - <AUTHOR> https://hbr.org/1996/11/inside-intel <comment><USER2> If you've never read Andy Grove's book "High Output Management" then you are missing out. It's one of the only management books I'll ever recommend. Truly great practical advice.

</comment><comment><USER3> Pairs very well with Grove's dictum of Objectives and Key Statements (OKRs). These and Grove's management philosophy are captured very well in John Doerr's book 'Measure what Matters'

<comment><USER4> Second the book - "Measure what matters"

</comment></comment><comment><USER5> I toured Intel around this time and attended a press Q&A with Andy Grove. It was amazing. He was lively and fun and thoughtful. We received a printed copy of a booklet entitled WIRLII - What's It Really Like Inside Intel. It covered corporate culture, which was very Andy-centric, including the habit of starting meetings exactly on time (and not allowing late people in). Powerpoint was widespread, but our tour guides used low-tech "foils" (aka clear sheets on an overhead projector) for the presentations. Fascinating guy.

</comment><comment><USER6> Swardley's landscape mapping is a strong replacement for the overall mapping idea (Porter through Grove) well worth looking up

</comment><comment><USER7> I haven't read Grove but I find a lot of these management books just okay. Any tough critiques from HN?

</comment><comment><USER8> So to sum up. Motto for successful management : Jobs - "Stay hungry" and Grove -"Stay paranoid".

Sounds like Andy Grove was a work horse.

</comment><comment><USER9> So much of this holds up, and then you get to RISC vs CISC. It's amazing Intel has managed to survive and even thrive after failing so hard to adapt to the changing environment.

<comment><USER10> Intel were in a sense lucky, their x86 was just about the most RISCy of the contemporary CISCs - opcodes are (almost) all one memory operand, no indirect memory modes, no autoincrement modes (except for stack) etc etc which means instruction retry on things like page faults are easy because of few side effects

<comment><USER11> And they were basically able to transition to chips that were architecturally pretty much RISC while maintaining CISC compatibility.

Furthermore, they did bet too much on frequency with x86 and compile-time optimization with Itanium, in part because a major partner was so focused on single thread performance. But, although AMD had some short-term success with Opteron, Intel was able to retrench and win out. It continues to have challenges in mobile and other areas but is still more successful than not.

</comment></comment></comment><comment><USER12> Here is a more readable version [https://hbr.org/1996/11/inside- intel](https://hbr.org/1996/11/inside-intel)

<comment><USER13> Thanks! Changed from [http://faculty.som.yale.edu/barrynalebuff/InsideIntel_HBR199...](http://faculty.som.yale.edu/barrynalebuff/InsideIntel_HBR1996.pdf).

<comment><USER14> Can you remove (pdf) from the title please?

<comment><USER13> Good point! Looks like a moderator got it.</comment></comment></comment></comment>


Show HN: Gratefulness.io – Learning to be grateful, one text reminder at a time - <AUTHOR> http://www.gratefulness.io/ <comment><USER2> I'm not sure if it's a mobile site issue, but on iPad, I just get a constant typing animation of what someone is thankful for.

I have no idea what this does. Maybe this animation culminates in something, but whatever it is, it takes too long to get to the point. I got bored and left.

Your Show HN title alone did much more to interest me than this landing page. I want to like this, but I don't know what this is.

<comment><USER3> hey! Creator of gratefulness here!

haha sorry about the glitch. not sure what's going on.

But as to what this whole gratitude thing is: I initially put this together for my little cousin who's been having a really rough go of it over the past few years. We'd been talking about how to stay mindful of the things we're grateful for. I offered up the idea of a gratitude journal but that didn't stick.

So I told him I'd put together a quick app that would text him every morning. He could respond to the text and I'd store it (privately!) for him. At the end of the week, I'd email him a recap of that weeks gratitude comments.

That worked much better for him! I sent it out to family and friends and over the past 5 weeks or so, we've been getting some positive responses.

In short, it's just a simple gratitude journal to help stay grateful!

</comment></comment><comment><USER4> The "thansgiving football" typo was the first thing I noticed, as much as I hate to be calling that out. Love the idea for this site!

<comment><USER3> man..nice catch! we've had this up for 5 weeks and no one has noticed that haha

</comment></comment><comment><USER5> Love the concept! Guys, is this secure? I didn't see https?

<comment><USER3> thanks!

we are getting that up within the next day or so! sorry!

</comment></comment><comment><USER6> What about Europeans? It doesn't seem like the sign-up form supports European phone numbers (least not Latvian).

Do You have any plans supporting email notifications instead of phone notifications?

</comment><comment><USER7> I like the novelty of this idea, but I don't think the founders are aware of the fact that an SMS/text is so prohibitively expensive for so many people around the world.

</comment><comment><USER8> Interesting, and good to read that the information is kept private. However, the recent leakings of databases in the news make me reluctant to use this.

</comment><comment><USER9> This is a really cool idea. I'd love to see it as a simple app (or maybe Messenger bot?) rather than SMS so that it can be used internationally.

<comment><USER3> thanks!

Yeah we were looking at a messenger bot to figure out how to reach international users. Keep you updated!

<comment><USER10> I will make that for you if you want

<comment><USER3> Hey! That'd be awesome! What is the best way to contact you?

</comment></comment></comment></comment><comment><USER11> This is soooooo bloody cool! Just the fact that you cared to do this. I am so grateful for this tool!

Every day I reflect on how much I have and how happy I am and how grateful I am for everything. I think about those who don't. Every day. It solves all my problems instantly. It's the most beautiful problem solver.

<comment><USER12> Do you practice stoic negative visualization? What's your process?

<comment><USER11> Oh I have no idea what that even means :(

Honestly, I start remembering all the times I spent around very very poor people and people from my country who don't have much. I frequently watch documentaries on what is going on in Syria and Iraq, and the refugee crisis. Often that's accompanied by thinking about where I was 6-8 years ago, and where I am today. I watch a lot of Vice too, and there is a clear space in my mind for the disadvantaged people in need. I only need to tap into it a slight bit to realize how much peace, security, and well being I am lucky to have. I start appreciating the smallest things: being able to wake up in freedom, to have clothes, to have food and be able to cook, to be able to speak, see, listen, walk, dream, etc. It's humbling, and it helps you practice empathy every day.

Tbh, I am a very poor person by American standards even today; but it really doesn't matter because I don't compare myself to people in Silicon Valley (even though that's where I live).

</comment></comment></comment><comment><USER13> please https by default

<comment><USER14> I second this. Here's a good starting point for free certificates. [https://community.letsencrypt.org/t/lets-encrypt-and- heroku-...](https://community.letsencrypt.org/t/lets-encrypt-and-heroku- solved/4272/24)

Also it seems that you simply let the application crash if the age input is a huge number. Maybe limit the age input to three characters? I'm not sure why 9999999999999999 would crash the app though. Intentional?

<comment><USER15> Surely not. Who wouldn't be grateful to live so long?

</comment></comment></comment><comment><USER16> wow i like the simplicity. I just wondered how you will monetize this site? Are you going to add adverts? For example, I am grateful for Walkers' Crisps and add link to Walkers page?

</comment><comment><USER17> This would be great as a Messenger bot for those that don't have unlimited texting plans.

</comment><comment><USER18> Nice font</comment>


Haskell I/O Is Pure - <AUTHOR> http://chris-taylor.github.com/blog/2013/02/09/io-is-not-a-side-effect/

<comment><USER2> see <https://news.ycombinator.com/item?id=5192990> for a different submission.

<comment><USER3> Yep, this one is the permalink to the information. The other was just the homepage, which happened to contain the article.</comment></comment>


Ask HN: How do you find a mentor? - <AUTHOR> I think, the role of a mentor in our life is understated and another issue is finding a suitable mentor.
One can learn things on their own (after job/school) but a mentor can help you narrow down the things you want to learn and supervise your journey.
Please note I am not talking about spoon feeding but someone who helps accelerate your learning. <comment><USER2> Whenever I hear about searching for a mentor, I imagine some guy that simply waits for illumination to happen, by osmosis, I suppose. I see searching specifically for a mentor as a kind of fashion or supersitition of these days. (Mind you, this is merely an association, a first impression that I have when I see such questions.)

Do you have a plan how to use this "mentoring" thing? A concrete idea what you want from a mentor and how your work would look like? Do you have anything to show him/her, so the mentor has any foothold for comments?

This is a good piece of article about exactly that: [http://pindancing.blogspot.com/2010/12/answer-to-will-you- me...](http://pindancing.blogspot.com/2010/12/answer-to-will-you-mentor-me- is.html)

</comment><comment><USER3> Find someone who you think you'd like to be mentored by and ask. Obviously you need a bit of realism (Mark Zuckerberg isn't going to mentor you), and it helps to have an existing relationship on _some_ level, but seriously, you just have to make the first move.

</comment><comment><USER4> Yup, what onion2k said. Email people you admire and ask if you can help them out.</comment>


Google Plus Overview For Small Business Owners and Entrepreneurs - <AUTHOR> http://vidinterest.com/video/4815/small-business-owners-and-entrepreneurs-will-be-using-google Small business owners and entrepreneurs will be using google plus for social media marketing in a very different way than the geeky types are! <comment><USER2> This video will explain google plus communities [http://vidinterest.com/video/1561/google-communities-a- place...](http://vidinterest.com/video/1561/google-communities-a-place-for- whatever-you-re-into-google-s)</comment>


Mashable Redesign - <AUTHOR> http://mashable.com/ Wow, have you ever seen such a dramatic redesign of a site?  Reminds me when Digg did their redesign. <comment><USER2> The ENTIRE homepage at the bottom of every article page seems pretty extreme and creates a bit of a janky scrolling experience. Wonder why they didn't just make the whole thing a single-page application and prevent the user from loading _all_ of that content when viewing the article page.</comment>


Tesla Truck - <AUTHOR> http://jalopnik.com/elon-musk-says-a-tesla-semi-and-tesla-pickup-are-actual-1794302568 <comment><USER2> Can someone explain to me how this can be taken seriously? It seems to me like trucks are already weight-limited in a way that cars aren't, so the immense weight of these batteries would hurt a lot for moving stuff.

<comment><USER3> Nikola truck design uses a natural gas turbine to charge the batteries. Lower weight, longer distance, 6 wheel drive, better performance... I expect Tesla to beat this.

[https://nikolamotor.com/one](https://nikolamotor.com/one)

<comment><USER4> Have you looked at the Nikola website recently? They switched to hydrogen fuel cells plus a battery.

<comment><USER3> No, missed that. Interesting.

</comment></comment></comment></comment><comment><USER5> Pickup...okay I guess.

Semi truck...Huh? Those almost always drive very long distances, the sort of use that just isn't a Tesla's strength. I wonder what the reasoning is.

<comment><USER6> There are a lot of semis (with no sleeper) used for intra urban delivery such as from a major grocery warehouse to your local grocery store. Last 40 miles.

</comment></comment><comment><USER7> I would think the main benefit of an electric truck is that the motor achieves its peak torque at 0 RPM. Very useful for accelerating</comment>


Show HN: Vault a Password Manager for Hackers - <AUTHOR> https://github.com/Max00355/Vault <comment><USER2> You may want to consider re-naming it, as there's a (probably better-known) HashiCorp product for storing secrets called Vault ([https://vaultproject.io](https://vaultproject.io)).

</comment><comment><USER3> Why is this using the md5 hash of the password to generate the key for the aes function instead of something like PBKDF2? Yeah I know the hash isn't stored anywhere, but still, using md5 in a security setting feels wrong.</comment>


PewDiePie's Battle for the Soul of the Internet - <AUTHOR> https://quillette.com/2018/12/20/pewdiepies-battle-for-the-soul-of-the-internet/ <comment><USER2> The "soul" of the internet was freedom. Using algorithms to exploit socially derisive and derivative tropes for profit isn't freedom. Manufactured consent isn't freedom. If this is what we're defending now, then the battle was lost long ago. Welcome to the war against facts and reality itself while the defenders of it are the new enemy.

</comment><comment><USER3> Worth a read. Liked this quote:

> Venture capitalist Chamath Palihapitiya once recalled his work with Facebook > this way: "We trumpeted [our platform] like it was some hot-shit big deal. > And I remember when we raised money from Bill Gates…And Gates said something > along the lines of, 'That's a crock of shit. This isn't a 'platform.' A > platform is when the economic value of everybody that uses it exceeds the > value of the company that creates it. Then it's a platform.'" The brilliant > Microsoft founder knew that his own Windows operating system was a true > platform because, as Microsoft openly bragged, the company itself captured > only a minority of the value created through the Windows ecosystem. > Facebook, YouTube and Google are in a completely different category—because > the vast majority of the wealth they generate is controlled by the social- > media oligopolies themselves. They aren't platforms so much as rent-seeking > agents that oversee a set of critical economic protocols.</comment>


Last Rites for the Village Voice, a Bohemian Who Stayed on Too Long - <AUTHOR> https://www.nytimes.com/2018/09/05/opinion/end-village-voice.html <comment><USER2> Interesting that some many people see the VV as 'so radical'.

A lot of people didn't see it that way at all. E.g. this article on the East Village Other [https://hubpages.com/politics/The-East-Village-Other- Overvie...](https://hubpages.com/politics/The-East-Village-Other-Overview-of- an-60s-Underground-Newspaper) says "reaching a peak circulation of 65,000 in 1969. It became popular because it was a true alternative to the establishment Village Voice, Herald Tribune, and New York Times."

The author's assertion that "To read The Voice was to read ... of America's underground cultural and political landscape in the second half of the last century and into this one" is pretty funny. It even leaves John Wilcock out of the list of those who 'started' The Voice, and who left it in 1965 to edit the EVO. EVO and Krassner's _Realist_ were a helluva lot more 'underground'.

<comment><USER3> Reddit was radical. Delicious was radical. Metafilter was radical. Village Voice was radical only in the view of those who were shocked that the "Prettiest Woman In New York is a Porn Star" ( by the time VV wrote about her Stoya was moving to the mainstream acting and directing - VV was six years late)

Village Voice niche got decimated not by the internet but by a smartphone. Picking up VV ( or City Paper or Philadelphia Weekly or SF Weekly ) was a ritual to find out what to do around town that week or to have something to read while sitting in a diner or waiting for someone in a park.

None of the publications ever had enough good content ( which is why they were weeklies ) as a percentage of the total content but they had a captive audience. That captive audience disappeared with the arrival of iPhone and Android phones. The weekly needed to compete with Hacker News, Craigslist, Porntube, New York Times, Reddit, etc and none of them could.

</comment></comment><comment><USER4> > _The internet flattened "alternative culture" — first Napster, and now > Spotify, allowed obscure music to bypass the critics; Netflix and Amazon > made experimental film accessible without your needing to read about it in a > Hoberman review. The Voice was once a lodestar to freaks and geeks > everywhere. Now the lodestar is both nowhere and everywhere._

The internet eats everything.

</comment><comment><USER5> The Boston Phoenix and Time Out London along with a bunch of scruffy local 'zines were my windows into music, movies, and culture when I was in my late teens and early 20s. I picked up the Village Voice when I was in NYC or saw it for sale elsewhere - in addition to the arts and culture coverage and listings, they went deep on investigations and exposes that was really refreshing.

Later I was the editor for a daily newspaper's weekend supplement, which mimicked the alt-weekly style and voice. Like the author of TFA, I regarded it as one of the best jobs I ever had although the pay was basically poverty level wages.

While I lament the loss of the Phoenix, the Voice, and many others, others seem to be doing well (I was happy to see Time Out Tokyo when I visited over the summer). It's also encouraging to see that windows to music, arts, culture, are thriving online, many of them controlled not by third-party gatekeepers, but by the creative people themselves.

<comment><USER6> Which online "windows to music, arts, culture" would you recommend?

<comment><USER5> Creative Independent: [https://thecreativeindependent.com/](https://thecreativeindependent.com/)

Sterogum: [https://www.stereogum.com](https://www.stereogum.com)

Lots of little sites that come and go (not unlike the zines of yesteryear) such as GigGuide Taiwan: [http://dead.gigguide.tw/articles.php](http://dead.gigguide.tw/articles.php)

And I enjoy following some of the creative people who have good social media accounts that they run themselves. Gives fans an unmoderated window into what they are seeing/thinking/doing, something that was very difficult to experience 30 years ago.

</comment></comment></comment><comment><USER7> > before the commercialization of New York

That's funny. Before the commercialization of New York, it was a Lenape settlement.

<comment><USER8> probably referring to the large amounts of capital put into real-estate etcetera starting in the 80's

</comment></comment><comment><USER9> I am somewhat surprised that The Stranger (Seattle) and The Georgia Straight (Vancouver), the same type of papers, remain financially viable and not in receivership.

</comment><comment><AUTHOR> i will sincerely miss Dan Savage's column.. sniff.</comment>


49% of UK get less than average broadband speed.  - <AUTHOR> http://www.bbc.co.uk/news/technology-17130367

<comment><USER2> I love math jokes. :-)

<comment><USER3> haha - this is classic!

<comment><USER2> What's so funny about it is that it's not likely true. What would be true is that 49 percent get less than the mean.

<comment><USER4> Think you have that flipped. The median is the 50th percentile. The mean is the average.

</comment></comment></comment></comment><comment><USER5> DUH! :P</comment>


5 points on: How the best bosses interview for 'Culture Fit'. - <AUTHOR> http://businessofsoftware.org/2012/08/how-the-best-bosses-companies-interview-for-culture-fit-guest-blog-mikey-trafton/

<comment><USER2> tell me more ...</comment>


What California's New Privacy Law Means for You - <AUTHOR> https://www.vice.com/en_ca/article/z3bvyx/what-californias-ccpa-new-privacy-law-means-for-you <comment><USER2> I hope that what it means for me is that my state will adopt similar, or even stronger, laws. (What I really want is to outlaw the collection of data about me and my machines without my informed consent, which the CCPA does not do.)

<comment><AUTHOR> it will take a long time before data collection becomes opt-in... we need to get the democrat president candidates to present their stance on this issue.

</comment></comment><comment><AUTHOR> I wish that CCPA would require companies to have the same url for opting out of data collection (ie: ms.com/nodatacollection, ggl.com/nodatacollection, etc...)</comment>


GDP growth of humanity over the very long run - <AUTHOR> http://ourworldindata.org/data/growth-and-distribution-of-prosperity/gdp-growth-over-the-very-long-run/ <comment><USER2> And if you ask a person in the 18th century if we could grow GDP 30+ folds while increasing various folds also the world population he would say... you are going to finish all the Earth resources and die before you even get to a tenth of that!

It's just to say: 1. productivity is always very misunderstood by people (hence Malthus); 2. poverty is better fought with growth, not re-distribution of wealth

<comment><USER3> Redistribution has very little effect on growth except at extreme levels.[0]

Over the last 20 years the U.S. economy has grown 25% but the income for the bottom quintile has stagnated.[1][2]

I would agree growth is probably the best medicine for the third world but the IMF shows it's not at odds with redistribution.

I would strongly disagree that we can solve poverty in the 1st world using growth. We have two options for replacing the $7,000 the bottom quintile missed out on in the last 20 years because of rising inequality. We could redistribute $7,000 to the bottom quintile or grow by 25%. Redistributing $7,000 is doable. I don't know of any policies, or even any set of policies that would increase the size of the economy by 25%. This is even more insurmountable given that in recent history the gains from growth have not been distributed equitably. We would need to see an order of magnitude more growth, an increase in the economy of 250%-500% before the poor would be substantially better off.

[0] - [https://www.imf.org/external/pubs/ft/sdn/2014/sdn1402.pdf](https://www.imf.org/external/pubs/ft/sdn/2014/sdn1402.pdf) [1] - [https://research.stlouisfed.org/fred2/series/A939RX0Q048SBEA](https://research.stlouisfed.org/fred2/series/A939RX0Q048SBEA) [2] - [https://www.census.gov/hhes/www/income/data/historical/famil...](https://www.census.gov/hhes/www/income/data/historical/families/)

<comment><USER2> If you want to look at things from a humanitarian perspective, then sure, let's talk re-distribution. But it should be in form of education and competitive markets (free milk quotas, anyone?). I struggle with the idea of making war to make peace (aka "democratization"). I also struggle with domestic re-distribution through "citizen income", because it makes life worst for all that pay taxes and those that are not "citizen" (foreigners, immigrants, etc.).

If we want to help the "poor", then we should make things more competitive, starting with relaxing immigration policies as much as possible...

<comment><USER4> The issue is far for being so white and black.

Not all the growth come from free markets. More efficient use of resources and the discovery of new technologies come from improving our knowledge. Sometimes this is done by business, sometimes no.

Also, there are economic theories (even mainstream economic theories) that express the view that some kind of redistribution is necessary for keeping the engines of growth working.

<comment><USER5> As a free market guy, I don't think free market ideas are anti-redistribution. They are against redistribution through the coercive power of government as moral principle and utilitarian argument.

I think private charity is far more effective in helping people in need. The government redistribution is merely a ploy to steal our wealth in the name of fighting poverty. I am totally surprised to see the amount of money US government wasted on Iraq war for which no one ever got punished.

<comment><USER4> Redistribution and charity are very different things. Redistribution comes from the idea that societies have goals, and that those goals are better served by thinking about where to spend resources instead of leaving it to blind markets.

I can see that you think of the government as 'them' instead of 'us', instead of something that we do as a society. We differ there.

Also, it worries me that you think (maybe I'm reading you wrong here) that is the spending of money, of all the things, what is the main problem with the war on Iraq.

<comment><USER5> We do disagree on the definition of redistribution. I do not accept that government=society. I also do not accept that society should have any goals and I would put individual liberty over everything else.

I do think spending money on Iraq war was bigger problem for Americans.I think you are referring to destabilization of middle east as another problem. We have essentially borrowed money from our children to simply waste it or rather on creating even huge problems for our children.

</comment></comment></comment></comment></comment></comment></comment><comment><USER6> Good summary.

For readability I recommend a logarithmic graph, it helps to bring out the structure of the graph more. Not as dramatic maybe for people who are not used to reading graphs, but I hate to see a graph that is just a thin line stuck to the bottom followed by a sudden upward rocket. Not very readable to my eyes.

<comment><USER7> [https://docs.google.com/spreadsheets/d/1jTlkr4KqnYBaqxzg5Rte...](https://docs.google.com/spreadsheets/d/1jTlkr4KqnYBaqxzg5Rteaqu0mgyv7ExmEUAIislIHTM/edit#gid=967131940)

</comment></comment><comment><USER8> Optimist: Look how good things are getting, we're only a few generations away from universal prosperity!

Pessimist: Look how good things have been, we're clearly only a few generations away from this prosperity bubble bursting.

</comment><comment><USER9> How much of this comes at a cost of people being unhappier?

Back in the time of hunter gatherers, humans "worked" for a few hours a day. The rest of the time was spent socializing and in leisure. It is fair to say they were happier compared to, let's say, an African American debt-laden minimum wage worker in the US today.

Do we really need economic growth?

<comment><USER10> Are parents for whom 1/3 of their children die as infants happier than those with children who live to adulthood?

(Modern USA infant mortality is less than 0.6%)

<comment><USER11> Loss and grief are part of life. Your parents will die. Your grandparents as well. You either die young or live long enough to see some of your own generation die before you. If you are really "lucky", you see all of your friends die.

Death is a part of life. Everyone hopes that they outlive all their children, but even if you do not, tragedies during your life do not mean that your entire life was unhappy.

<comment> D-Coder We're not measuring this as a binary value happy/unhappy. Not all losses are equal. Your children dying before you is worse than most other losses.

<comment><USER9> In our culture. That might not be the case in every culture. Some cultures even practiced infanticide, others practiced child sacrifice. Surely it cannot universally be the worst thing or such practices could never exist.

</comment></comment></comment></comment></comment><comment><USER12> GDP might actually be one of the worst ways to measure collective well-being.

<comment><USER13> Can you back this statement up, please?

<comment><USER14> GDP measures vodka purchased by alcoholics; it measures chemotherapy; it measures bombs killing civilians; it measures bubble malinvestments; it measures settlements in police brutality suits; it measures daycare but not caring for your own kids.

And most importantly, it measures the velocity at which these things occur.

<comment><USER13> So?

Isn't a society that can allow itself better alcohol, expensive medicine, better weapons, has more liquid cash, pays more in brutality suits (and pays them at all, to this matter), and spends more on daycare objectivelly better and more well-off than a society that doesn't have these things?

</comment></comment></comment></comment><comment><USER15> Its quite interesting to see how latin america gdp fall down during the 1500s (is the only region to do so, I think)

And how asia is pretty much being the richest region in the world(but the largest, so maybe its a matter of proportions)

<comment><USER16> I assume that the latin american dip is the Europeans beginning their invasions and looting of the meso-american civilizations

<comment><USER4> Probably is not so much the looting as the fall in the population. Millions of people died from contact with the diseases from Europe (20 millions by some estimates).</comment></comment></comment>


Always start with simple solution - <AUTHOR> http://buklijas.info/blog/2018/01/01/always-start-with-simple-solution/ <comment><USER2> JSON is not a human friendly config format; it has harsh rules for quoting, brackets and commas and most importantly has no intuitive facility for comments. YAML should be preferred to JSON for config. However, ConfigParser is even better and a list of IPs need only be space separated (eg hosts = config.get('hosts').split() , quite simple ) or you could even make the _value_ of the parameter be a JSON list if you really like to type brackets and quotes. The "simplest" approach is in fact to use the most _idiomatic_ approach that everyone recognizes, and if you're doing config files in python that means ConfigParser.

Edit: it seems they went with a newly invented language called json-config that looks like a hybrid of JSON and C-style comments. That's fine, but using an invented config format that nobody knows isnt the "simplest" approach at all. It's the most _complicated_ solution. When people use invented idioms in their projects for things like config and logging that have widely accepted idiomatic solutions included in Python std lib that's an immediate red flag.

<comment><USER3> I like YAML, but it needs shell-style $ substitution tokens to allow constructing values from previously-defined values (such as when defining a PATH variable, or subdirectory).

To that end, I'm going down the path of writing my own extension to YAML. Can you recommend one that already exists that accomplishes this goal? I don't see an alternative, because I can't find something standard that actually meets the requirements.

Shell scripting languages are platform-specific, and not hierarchically structured, so that's what I'm trying to replace to begin with.

Ansible requires a central server and full commitment to immutable deployments, so it's too heavy for a package manager that can support piecemeal adoption or that could be used by researchers doing ad-hoc development. It doesn't support windows anyway (linux for windows subsystem doesn't count).

Conda is nice, but even though it uses YAML for defining dependencies, it nonetheless falls back to shell scripts for environment variables, and doesn't offer features for environment modularization.

EDIT: Hierarchical structure is needed to be able to both express and manipulate configs for software that expects input as XML, so ConfigParser isn't good enough. Setting a value to a blob of JSON or XML denies the ability to operate on that blob to do things like merge subtrees. Instead, I'm using ruamel.yaml as my starting point, and adding post-processing after it's converted to nested dict/lists.

<comment><USER2> > Ansible requires a central server and full commitment to immutable > deployments

i dont know what that means. Ansible is like a much more structured form of shell scripting, you can run ansible playbooks from anywhere to do anything and make them do anything. i don't know what an "immutable deployment" is.

also ansible has nothing to do with "config", YAML is used as a declarative scripting language rather than a config file format.

<comment><USER3> Really, I just want to know how ansible provides for token substitution, so I could reuse a value defined elsewhere, so I could define all the subdirectories in a playbook relative to a single base directory.

YAML doesn't offer a syntax for writing "${BASEDIR}/subdir". There's gotta be something in ansbile that makes this possible, but I can't find it.

<comment><USER4> That "thing" that you're referring to is handled by Ansible, and not by YAML. It uses the Jinja2 templating engine. And I would assume Ansible uses some sort of scoping order/rules in order to provide values for the template generation.

E.g. look here in the Ansible docs:

[http://docs.ansible.com/ansible/latest/playbooks_loops.html#...](http://docs.ansible.com/ansible/latest/playbooks_loops.html#standard- loops)

It provides a construct that allows you to loop over a sub-list of YAML items, and then let's you use the looped-variable in a string-substitution via the templating language. That's the name: "{{ item }}" that you see there.

Edit. Typo

<comment><USER3> Thank you! this is what I've been looking for, but searches for token, substitution, and "defining subdirectories" have not led to this. Calling it a loop is confusing.

It seems the values have to be defined in some other file, so I couldn't chain them, though.

Suppose I want to write something like...

      paths:
         BASEDIR: /somedir
         SUBDIR1: {{ paths:BASEDIR }}/subdir1
         SUBDIR2: {{ paths:SUBDIR1 }}/subdir2

Doesn't seem like that would work. I would end up putting all my definitions into a separate file.

</comment></comment></comment></comment></comment></comment><comment><USER5> _For example, here I needed a configuration file that will have a list of IP addresses, which I will iterate in for loop.

This was the smallest requirement that I needed for my problem._

My instinctive solution would be even simpler --- a text file with one IP per line, similar to a HOSTS file.

<comment><AUTHOR> You are correct, that is the simplest way.

What did I not disclose in the article is that I also wanted somehow to name data.

I wanted this because I also know that in the configuration file, expect IP addressed I will also need to store sleep duration.

I just find it more articulated if I also have a name for data.

Now I use [https://github.com/pasztorpisti/json- cfg](https://github.com/pasztorpisti/json-cfg) for storing configuration as JSON. json-cfg has the ability to add comments to JSON file.

<comment><USER6> If you want to name your data, then you could have had a couple a different text files that were named differently

<comment><AUTHOR> I meant data inside the text file.

Anyway, this is more question of preference :-)

<comment><USER7> I find plain csv a bit underrated in these kind of applications. As long as you have flat data, you can read and edit the file with practically anything without too much trouble.

</comment></comment></comment></comment></comment><comment><USER8> Related, in today's Farnam Street email, he linked to an article examining the psychology behind why humans prefer complex things to the simple[0].

It's especially interesting because most other psychological biases appear to be the result of a mental short-cut. Perhaps we see something complex and mistakenly infer the preconditions were complex, and that somehow makes it more valuable.

An especially interesting quotation, relevant to this forum is in that article, by a sportswriter: "Most geniuses—especially those who lead others—prosper not by deconstructing intricate complexities but by exploiting unrecognized simplicities."

[0] [https://www.farnamstreetblog.com/2018/01/complexity- bias/](https://www.farnamstreetblog.com/2018/01/complexity-bias/)

<comment><USER9> Wonder if ego has anything to do with it as well? Perhaps for some people, they feel 'complexity' makes them look better, even if the simple solution would better in every rational way. Then again, it could just be boredom. The more complex solution also usually has a bunch of 'novel' issues to solve, and solving those can be a lot more enjoyable for certain individuals than doing things the reasonable way.

<comment><USER8> Yeah, this creates some sort of "moat of knowledge" that increases status if you make something easy look difficult. Also could make someone appear to be less replaceable ("we would have to think about something that looks hard to replace person XYZ!").

There's also the danger of overfitting when building the mental model or process.

</comment></comment></comment><comment><USER10> The first complexity in the ConfigParser example comes from trying to parse something like a python list.

Just accept ips seperated by spaces, users will be thankful.

The other complexity is using the raw loading and converting from bytes.

ConfigParser can give you back strings and read the file for you.

Here is a full example:

        import ConfigParser
        import io
        import shlex

        def main():
            config = ConfigParser.ConfigParser(allow_no_value=True)
            config.read('config_ini.ini')
            testing_1 = shlex.split(config.get('other', 'list_queue1'))
            print(testing_1)

        if __name__ == '__main__':
            main()

This is the same as a comment I made on the website, but for the benefit of any python devs here.

</comment><comment><USER11> > At that time, I was accessing only one device (only one IP address).

> But could see that in future (in few months to one year), I will need to do > the same set of command on more devices.

IMHO, this statement represents one of the biggest design smells in programming. It's usually a bad idea to write software you may need in the future. Circumstances change. Writing code is expensive and coding in anticipation of what you might need is often a waste of time.

 _Write code you need now, not code you may need later._

It makes sense to think ahead but if you're spending a lot of time writing code you might need, then you're probably doing something wrong.

<comment><AUTHOR> > IMHO, this statement represents one of the biggest design smells in > programming. It's usually a bad idea to write software you may need in the > future. Circumstances change. Writing code is expensive and coding in > anticipation of what you might need is often a waste of time.

Completely agree, as you said, "... is often a waste of time."

Unfortunately, I was not so lucky, literally 2 days after I have finished the first version of the program I needed to add 2 more IP addresses.

I do agree that often is a waste of time.

</comment></comment><comment><USER12> This is a pretty confused article. The author starts with a list of useful things which he then deems 'too complicated', and ends up with using a JSON based config file. Ok. But the things he listed are not too complex, and the solution is a simple line-based config file of IP addresses:

       import netaddr, sys
       ips_to_connect_to = [*netaddr.IPGlob(ip) for ip in open(sys.argv[1])]

Those two lines handle points 1, 2 and 3 of his 'nice to haves'. You could easily add 4 and 5 in under 10 lines. You could expand it to read from stdin rather than a fixed file easily enough as well.

<comment><AUTHOR> Thank for mentioning [http://netaddr.readthedocs.io/en/latest/](http://netaddr.readthedocs.io/en/latest/), I did not know about it.

<comment><USER12> The built in ipaddress module is enough for your current use case, netaddr just handles globs.

</comment></comment></comment><comment><USER13> Command line args would have been the simplest solution imho. Works simple for simple cases and power users will create a bash wrapper anyway.

Hard to be wise without knowing the context, but I avoid config files as much as possible, because:

\- Where does the config file live on different machines?

\- What if I want to have 2 configurations on one machine?

\- What if I need to change the list dynamically?

`for ip in sys.args` would give you most flexibility.

<comment><AUTHOR> I agree but I wanted to avoid this:

... writing 34 IP addresses as CLI parameter, that is around 373 letters, is not a nice solution.

<comment><USER11> A bash script where you call the CLI program once for each IP would be a very simple solution.

        ./script 127.0.0.1 5
        ./script 127.0.0.2 5
        . . .
        ./script 127.0.1.254 10

<comment><AUTHOR> I was on windows. But OK, there is batch script also.

I had to call program will all IP addresses, one by one would just not work.

Your idea is fine, but it was just acceptable in my use case.

</comment></comment></comment></comment><comment><USER14> It's sad that the perfect template for all non-binary data, configuration and otherwise, has been around for quite some time: S-expressions.

Nobody but lispers use them. Why?

<comment><USER15> How would the example from the post look with s-expressions?

<comment><USER14>
        (test_list (test_1 test_2 test_3))

For the JSON configuration file, I suppose?

</comment></comment></comment><comment><USER16> Is that really simpler than writing the list out in a file called config.py like

      ips=['192.x....',

      '192.y',

      '192.z']

Then in your main

      from config import ips

Or does distributing as an .exe preclude this?

Edit: formatting

<comment><AUTHOR> You are correct, that is the simplest way.

What did I not disclose in the article is that I also wanted somehow to name data.

I wanted this because I also know that in the configuration file, expect IP addressed I will also need to store sleep duration.

I just find it more articulated if I also have a name for data.

Now I use [https://github.com/pasztorpisti/json- cfg](https://github.com/pasztorpisti/json-cfg) for storing configuration as JSON. json-cfg has the ability to add comments to JSON file.

<comment><USER16> Could you not do exactly the same but with a python dictionary rather than a list?

<comment><AUTHOR> I was distributing my Python code as EXE, so use of Python code as configuration was not possible.

Altho, I think that Python code as the configuration is a good solution if you are executing source code, and only developer (not average user who does not know what Notepad is) will edit it.

<comment><USER17> I'm confused...

You're building a custom configuration file format for people who don't know how to edit configuration files?

And, as they say, "xml is like violence..."

<comment><AUTHOR> I had to distribute my Python program as EXE because Windows PC where the program needs to be executed did not have Python installed.

That is why using Python as configuration file was not possible.

Hope that I have explained it well.

</comment></comment></comment></comment></comment></comment><comment><USER18> YAML - I am not a big fan these days. Perhaps I am have OCD on format, but with YAML ordering is "up to the user". At least INI has a somewhat "header/section" so it looks more organized. The "yes Yes True TRUE true 1 => True (python)" is flexible but can be seen as negative if again you are like me OCD. You can enforce style guideline in your dev team, but for end-user, probably worth reconsidering your strategy.

The reasons I'd consider JSON for configuration are (1) when the configuration is really simple and short, and (2) I don't want an extra dependency. You don't want to handcraft for a larger data structure, and context switch between your terminal and JSON validator.

I like INI-style configuration file. But ConfigParser's API is horrible, and everyone seems to like tweak and invent their own "INI" format.

Instead, for those really need a good configuration file, I recommend TOML [1].

For data file, either YAML or JSON are fine. But each comes with gotcha. Trailing comma in JSON is invalid (which is probably #1 "wtf what's wrong with my json"). For YAML you need to be very careful with "do I want an int or do I want a string."

[1]: [https://github.com/toml-lang/toml](https://github.com/toml-lang/toml)

<comment><USER19> How does TOML solve the "do I want an int or do I want a string." part? I only know YAML and this caught me a few times, would love to know how toml does it.

<comment><USER18> None of them do, sorry if I was being too casual. The reason I named YAML because in YAML you can just write

        name: bob

where bob is assumed to be a string by the YAML parser. This is bad if you use Ansible because "bob" could be the name of a variable.

        bob: "I am bob"
        name: bob
        # at runtime Ansible sees 'name: "I am bob"'

But both JSON and TOML need the users to be more explicit. So while users still need to be mindful of "1" vs 1, JSON and TOML don't assume as much as YAML does.

Let me show you in Python.

        import toml
        import yaml

        s1 = "name: bob"

        yaml.load(s1)
        --> {'name': 'bob'}

        s2 = "name = bob"
        toml.loads(s2)

        Traceback (most recent call last):
         ....
        File ".../python2.7/site-packages/toml.py", line 664, in _load_value
        v = int(v)
        ValueError: invalid literal for int() with base 10: 'bob'

        s3 = "name = bob eve"
        toml.loads(s3)
        Traceback (most recent call last):
        raise TomlDecodeError("This float doesn't have a leading digit")

See how a space and without space yield a different exception different? Not sure if it's an implementation problem, or the spec says so though. But the point is TOML doesn't assume "bob" without a quote is a string, which is a good thing.

</comment></comment></comment><comment><USER20> Actually this is pretty simple if you use ConfigParser properly:

      # test.ini
      [host1]
      ip = 126.96.36.199
      [host2]
      ip = 188.8.131.52
      [host3]
      ip = 188.8.131.52

      # config.py
      import configparser

      c = configparser.ConfigParser()
      c.read("test.ini")
      ips = [ c[host]['ip'] for host in c.sections() ]

</comment><comment><USER21> I prefer to state it this way: "Avoid speculative complexity".

<comment><USER22> Or "do the simplest thing which could possibly work":

[https://ronjeffries.com/xprog/articles/practices/pracsimples...](https://ronjeffries.com/xprog/articles/practices/pracsimplest/)

</comment></comment><comment><USER23> I'm really a fan of JSON config files for simple configuration. In a strongly typed language you can parse it into a "Settings" object with one line of code and work with the object.

Creating the settings object at least for C# is just a matter of pasting it into a website (after removing all of the sensitive bits of course)

</comment><comment><USER24> Not directly related to the article, but can someone explain why people from Eastern Europe and Russia tend to drop most of the articles (like "a", "an", "the") when speaking/writing English?

<comment><USER25> Likely because Russian doesn't have articles.

> _"There are no definite or indefinite articles (such as the, a, an in > English) in the Russian language. The sense of a noun is determined from the > context in which it appears."_

[https://en.wikipedia.org/wiki/Russian_grammar](https://en.wikipedia.org/wiki/Russian_grammar)

<comment><AUTHOR> Correct, I (author) am from Croatia, and in the Croatian language, there are no definite or indefinite articles.

I have noticed that I do not even see that I drop most of the articles. Only when I use some grammatical spell checker than 90% of errors are missing articles and that I notice it.</comment></comment></comment>


Adult site leaks data of cam models - <AUTHOR> https://www.vpnmentor.com/blog/report-pussycash-leak/ <comment><USER3> Leaked data includes:

        Full name
        Birth date
        Birthplace
        Citizenship status
        Nationality
        Passport/ID number
        Passport issue & expiration dates
        Nationally registered gender
        ID photo
        Personal signature
        Parent's full names
        Fingerprints
        Additional country-specific details (e.g. emergency contact information for UK citizens)

This is bad. IDs shouldn't be stored on your server once you've confirmed the age/identity/whatever of the user.

<comment><USER4> generally I agree, but I can understand why they did it. If they're accused of allowing underage models they'll be in a spot they definitely don't want to be in.

There was a case years ago of a man who was on trial for child porn. It took the actress physically coming into the courtroom and showing her ID before the case was dropped.

It's just a really scary place to be in terms of society and the law, so I can understand making the decision to do the 'wrong' thing in this instance.

<comment><USER5> If you're sufficiently paranoid to want to hold onto this data, it should at least be kept in cold storage. And it's not expensive; I can walk over to Best Buy right now and pick up a hard drive big enough to store this data with cash I happen to have in my wallet.

<comment><USER6> > right now and pick up a hard drive big enough to store this data with cash I > happen to have in my wallet.

You do know that the legal recordkeeping requirements mandate specific indexing and cross-referencing requirements, and that the age records must legally include copies of portions of _every covered piece of media_ sufficient to identify the performer against the photos in the age recors, and also must include cross-reference to every individual full work.

If your media is live streamed, it doesn't seem to me likely that you could meet the requirements with an offline system.

<comment><USER7> > If your media is live streamed, it doesn't seem to me likely that you could > meet the requirements with an offline system.

You store all the PII offline and assign each performer a unique identifier. Then tag each stream with the unique identifier.

Why would that not work?

<comment><USER6> > Why would that not work?

It would work if the law is applied on such a way that the list of media retrieved by querying using the performer ID on the media server is acceptable as the listing of depictions that is required to be part of the age verification records. It's pretty clear in the combination of statute and regulation that either hardcopy or digital records can be used, but it's not at all obvious that a hybrid of that particular form satisfied the requirements. From an information management perspective, I can see it making sense; from what I've seen of administration of legal rules I can see where it might not be. Especially in an industry that politicians (and lead US federal prosecutors are all a brand of politicians) like to score points against, I would expect people to be extremely conservative about uncertain legal exposure; you don't want a setup where you have a decent but uncertain argument of it goes to court, you want one that would never give anyone a reason to think it was a viable pretext for legal action against you in the first place.

</comment></comment></comment></comment></comment></comment><comment><AUTHOR> These include scans of documents that prove the model's age, things like ID cards, birth certificates, and passport scans. Also included were performer release forms and profile information. This is particularly bad given the sensitive nature of the work and the need to maintain the personal privacy and safety of the X-rated web stars. There is also the risk that, as the records from virtually every occupied part of the world, that LGBTQ+ performers in some areas could be at risk of persecution.

<comment><USER8> Another reason to never send IDs "required" by many companies today .. using email or their app

<comment><USER9> So you don't use AirBnB?

<comment><USER10> I stayed in one AirBnB where there was a book on a shelf in the living room. I opened it, and it was the name, passport number, date, and some other information I can't recall for every past guest.

</comment></comment></comment></comment><comment><USER11> What makes it even worse, is that this is an industry where un-sane individuals frequently get obsessed / fall in love / stalk the models in question very frequently due to the context in which they work. This leak is going to be life-ruining (and potentially dangerous) for many of them.

<comment><USER12> Obsessed simps who donate thousands upon thousands of dollars are very dangerous. Even on Twitch these people are a sight to behold.

<comment><USER13> And yet, camsite models wouldn't be able to sustain themselves without these simps. It's really a two-edged blade.

</comment></comment></comment><comment><USER14> "We were able to access Pussycash's S3 bucket because it was completely unsecured and unencrypted. Using a web browser, the team could access all files hosted on the database."

This is absurd

</comment><comment><USER15> This is terrible. The sensitive nature of this information could have significantly impact on the victims. This is the type of data, that coupled with the sensitive nature of the sites content, could pose significant safety risks — and I don't say that lightly.

Moreover, the jurisdiction of this place (Andorra), leaves a lot of open questions about what (if any) recourse there could be either from a punitive or criminal standpoint.

This is terrible.

</comment><comment><USER16> It's amazing how often you find companies/individuals asking for personal information/documents over email and SMS. I've been on the hunt for a flat for the last few weeks. Being in NZ, I used the TradeMe platform where many of the landlords/listing owners asked for Passport scans, employment letters, bank statements etc via email before evening looking at the property. No mention of how that information will be secured and how it will be discarded.

They've likely received hundreds of messages with personal information, all stored in Gmail inboxes. What happens to them after they're sighted - <USER2> wouldn't know.

I don't know what the 'adult' industry is like but I suspect there's some sites that verify their models by similar email/SMS mediums.

</comment><comment><USER17> A friend of mine who did a few movies in the 2000s told me she felt much more violated by the paperwork for the required record keeping than she did having sex on camera.

<comment><USER18> It's there for very good reason- to ensure that the models are adults.

</comment></comment><comment><USER19> Predictions, bets and opinions on what punishment will PussyCash/ImLive be facing? A fine proportional to their earnings?

<comment><USER20> My prediction, a public statement apologising. With 2-1 odds that it will contain : "We value our clients privacy" mentioned at least twice.

<comment><USER21> Guarantee they will also say the phrase "we take security very seriously."

</comment></comment></comment><comment><USER22> See also [https://www.stripperweb.com/forum/showthread.php?226796-Puss...](https://www.stripperweb.com/forum/showthread.php?226796-PussyCash- security-breach) for the reaction of camgirls.

</comment><comment><USER23> Given the requirements to keep this data, I'd be curious what data-model would make sense to prevent leaking it. I honestly can't think of anything practical that's better than "encrypt at rest, better hygiene with database credentials". After all, the webserver needs the ability to submit this data, and logically people are going to want to be able to review their own data on the web in order to update it.

What do?

<comment><USER24> Each person's records could be given an ID (say, a UUID) and stored encrypted in a database. Strong access controls over the decryption keys, etc. Then each video gets metadata with the UUIDs of the people in it.

Also it never needs to be updated. Once you've proved you're old enough to legally appear you never need to do so again, at least as long as no time- travel shenanigans are possible.

<comment><USER6> > Also it never needs to be updated.

In US law the records have recency requirements, content-sample requirements for each work the model appears in, and indexing and cross-referencing requirements, and must at the time of each depiction include all names, nicknames, and aliases, the model has _ever_ used in any context (which can expand over time), so, no, it will require updates after being stored.

<comment><USER25> Who are you obligated to provide the records to? When you get a records request from such a party, how long do you have to respond?

As long as there aren't too many parties who can ask for the records, and you don't have to provide them on very short order, I think the approach I'd take is to encrypt each document separately using a public key system, and not keep the plaintext. Each encrypted document would be assigned an ID. Indexes and cross references would refer to those IDs.

Since each document is separately encrypted, new and updated documents can be added to the collection without having to decrypt earlier documents.

The private key would be kept on a system that is not online. When a request for records is received, the indexes and cross references could be consulted to determine the IDs of the relevant documents, which could then be taking to the system that has the private key via flash drive, where they could be decrypted and turned over to the requesting party (presumably law enforcement).

For the system with the private key, I'd consider using cheap Linux tablets. Maybe three of them. One for the CEO, one for the CTO, and one kept by the company's lawyer. The tablets are meant to get locked into a safe and stay there except when the company is responding to a records request.

<comment><USER6> > Who are you obligated to provide the records to? When you get a records > request from such a party, how long do you have to respond?

You are required to maintain the records at your place of business or with an identified custodian, with specified content, indexing and cross-reference structure, to provide identification of where they are stored along with any depictions sold/distributes, and make them immediately available for inspection by inspectors authorized by the US Attorney-General (which will generally, as I understand, be any US law enforcement agency which asks for such authority) on demand during normal business hours which are either 9-5 local time or, for inspections at the producer's place of business, the producer's actual working hours, which must be provided to inspectors and, if not at least 20 regular working hours per week, must provide notice of at least 20 hours per week during which the records are available for on-demand inspection even if they aren't otherwise working hours for the producer.

> As long as there aren't too many parties who can ask for the records, and > you don't have to provide them on very short order,

I don't think either of those qualifications actually holds, especially the second.

</comment></comment></comment></comment></comment><comment><USER26> I feel sorry for the girls. _All should stay away from the leaked data_

Is the website stepping up to take responsibility?

<comment><USER27> And guys. And others.

</comment></comment><comment><USER28> This is horrible, and very very dangerous for the people involved.

</comment><comment><USER29> Alongside the risk of exposing people's private peccadilloes and the danger that presents, there's a huge risk of identity fraud, bank fraud, sim-swapping etc. with all this data.

Particularly when it comes to all the copies of Government Photo IDs (Passports, Drivers licence, etc.)

</comment><comment><USER30> _> They boast 66 million registered members on their webcam chat arena, ImLive, alone._

Let's say each registered user pays $1 a month for access to this one site they run. That's $66 million/month in revenue. Enough to secure data and comply with privacy laws.

<comment><USER31> Why are you arbitrarily estimating revenue? Also registered users != active/paying users

</comment></comment><comment><USER32> The models are all legally adults so why would the producers need their parent's full names?

<comment><USER33> They probably aren't needed, but they are present on some forms of identification, like a UK birth certificate.

</comment></comment><comment><USER34> Let's hope nobody gets murdered, injured or raped. This is about as bad as it gets.

</comment><comment><USER35> This is terrifying for the models. One of the worst leaks to date, surely?

</comment><comment><USER36> I wish people would stop referring to pornography as "adult".

<comment><USER37> Why?

<comment><USER36> To be clear, I mean using solely the term "adult". Using the term "adult pornography" is fine.

But to answer your question: Because it is destructive and wrong, no matter the age of the viewer. Calling it "adult" not only suggests that it is fine for adults, but entices minors to it under the false impression that they will be more adult by viewing or participating in it.

<comment><USER38> It is fine for adults. If it weren't for "online adult work" I'd have to degrade myself to being a waitress or working at McDonald's.

</comment></comment></comment></comment><comment><USER39> This is another example of why the US urgently needs legislation along the lines of GDPR. I know California's law took effect on Jan 1.

Does anyone know offhand what the penalty would be if this had been a Californian or EU company?

<comment><USER40> The problem is that the site didn't collect the data because they wanted to, they did it because the law requires it. GDPR (and presumably equivalent privacy regulations) explicitly has an exemption for data you are legally required to keep.

Regarding fines, they wouldn't undo the damage of the leak either. I don't think this kind of leak can be mitigated with any amount of money, short of giving all the people involved a new identity and forcing them to start a new life somewhere else (and even then, they can still be recognised by their physical appearance).

<comment><USER41> I don't follow the distinction you're making about GDPR. I don't think anyone is saying they shouldn't have this information, just that they should make at least some minor modicum of effort to secure it.

GDPR doesn't say you don't need to properly secure data even if you're legally required to collect it.

GDPR solves this problem as much as any legislation can.

</comment></comment></comment><comment><USER42> Will this leaked data be used by the IRS in the thot audit?

</comment><comment><USER40> And this is why I recommend using fake details & IDs when signing up to sensitive services like this. Not an ideal situation and I'm not blaming the victims here, just stating what I would do if I had no choice but to sign up for such a site. Given the life-changing consequences of a leak and the risk of harm (stalkers showing up at home, or being an LGBT performer in a location where the government doesn't approve of that) the consequences of being caught with a fake ID are tame in comparison.

Ideally there should be a way for the websites to fulfil their legal obligations regarding age verification without actually handling any ID data themselves. Maybe a government-provided oAuth style service where you are redirected there, authenticate with the government (no extra risk there, they already have the data) and then they return a signed blob to the website asserting that you are of legal age without actually disclosing any details.

<comment><USER43> The models can't fake this data - it's required as proof that the filming is consensual, and that they are of a legal age to produce the films.

<comment><USER40> Would an ID with everything redacted but the picture and birthdate pass? It should be sufficient to fulfil the site's legal requirements while mitigating risk of the data leaking - you can't leak what you can't have.

<comment><USER44> Would a site be willing to take the risk on accepting a blatantly doctored ID? The consequences for allowing an underage performer on the site are extremely severe. Decades in jail labeled as a pedophile and spending the rest of your life on the sex offender registry.

It's no surprise at all that the sites demand an extraordinary amount of PII about the performers before they are allowed to post a single image.

Shame the punishments for leaking PII are nowhere near as severe.

<comment><USER40> I've seen a lot of cases where the potential penalties of not checking IDs or blatant financial crime are severe, and yet the jobs are outsourced to people not paid enough to care, not given the right tools to investigate inconsistencies, or encouraged by management to "look the other way" so I wouldn't be surprised if the same happens here.

Asking for a lot of PII is one thing, actually _checking_ that PII to be accurate is another thing. The latter can be exploited to regain a slight bit of privacy.</comment></comment></comment></comment></comment>


US says it can prove Huawei has backdoor access to mobile-phone networks - <AUTHOR> https://arstechnica.com/tech-policy/2020/02/us-gave-allies-evidence-that-huawei-can-snoop-on-phone-networks-wsj-says/ <comment><USER2> > Telecom-equipment makers who sell products to carriers "are required by law > to build into their hardware ways for authorities to access the networks for > lawful purposes," but they "are also required to build equipment in such a > way that the manufacturer can't get access without the consent of the > network operator," the Journal wrote.

I love this quote. The US is essentially complaining that Huawei has access to the backdoor channels that _only_ the US government was supposed to have.

<comment><USER3> >The US is essentially complaining that Huawei has access to the backdoor channels that only the US government was supposed to have.

How is surprising? The defining characteristic of a nation state is that it has a monopoly on violence within its borders. Having a monopoly on intercepting telecom traffic is a logical consequence of that. For other countries though, yeah I'd prefer if neither China nor US have backdoor access.

<comment><USER4> "I'd prefer if neither China nor US have backdoor access."

So would I, but having lived in both countries, one of the two governments is decidedly more evil than the other.

<comment><USER5> What is more dangerous for an American (or even European) citizen? The US or China spying at them? Even if China is more evil in its domestic affairs a western civilian has much more to fear from the US.

<comment><USER6> >Even if China is more evil in its domestic affairs a western civilian has much more to fear from the US.

Can you support this assertion?

<comment><USER7> Kim Dotcom, Julian Assange, Iraq, Iran etc.?

<comment><USER8> FIFA executives. Even though I found it awesome.

[https://www.justice.gov/usao-edny/pr/nine-fifa-officials- and...](https://www.justice.gov/usao-edny/pr/nine-fifa-officials-and-five- corporate-executives-indicted-racketeering-conspiracy-and)

</comment></comment></comment></comment></comment></comment></comment><comment><USER9> Note: The following might be considered off-topic. On the otherhand, there might be something nefarious in the SMS network.

I found something strange that affects SMS in Canada. You can send the lower case text "secure communication", but it will never be recieved by the recipient. I am not sure if this behavior is reproducible outside of Canada. It might be a software defect, or perhaps there is something capturing the text and trying to interpret it as a command. The issue is more difficult to reproduce if both the sender and recipient devices are iphone's due to the default behavior of sending via iText.

I originally posted about this late last year [1]. I intend to investigate this issue more deeply, but my time has been consumed by another more pressing matter. The original HN post links to my blog post [2]. Originally I jumped to the conclusion that it was a case of censorship, but I backtracked on that because the issue is case sensitive. I would love confirmation if this is reproducible in other countries.

[1] [https://news.ycombinator.com/item?id=21593276](https://news.ycombinator.com/item?id=21593276)

[2] [https://bloggerbust.ca/post/text-messages-are-being- censored...](https://bloggerbust.ca/post/text-messages-are-being-censored-in- canada/)

<comment><USER10> On a related note, if you start an SMS with "!", then the leading exclamation point will be stripped, and a delivery confirmation SMS will automatically be sent (not sure if it's from the mobile network or the receiving phone). This makes it possible to send zero-character SMSes.

<comment><USER11> Huh, just tried it and the ! got through. Could be network- or encoding- specific?

</comment></comment></comment><comment><USER12> > required by law to build into their hardware ways for authorities to access > the networks for lawful purposes

A bit of a tangent but ...

How I hate this term "lawful purposes". It's a non-sequitor / dark pattern deployed to confuse consumers into not understanding that they mean "spy on you". "Lawful" just means compliant with the law. In other words, they are are NOT saying "necessary to enforce the law" which is what they want you to think. They are only saying, hey, we won't break the law when we use this feature, aren't we great? Like breaking the law would ever be OK and as if this disclaimer somehow adds any sort of reassurance. The implied logic is "normally we would just break the law to access your data but in this special case we'll follow it.

/tangent

<comment><USER13> Are you sure you'd want to live in a society that was incapable of spying on you when they decided it was necessary?

(This argument hinges on that pesky word "necessary". But it's worth thinking about which conditions you'd be ok with the state surveilling others, and who exactly "others" refers to.)

<comment><USER14> Sadly, that is exactly how ideas like that promulgate. It won't affect me. It will only affect the others, the undesirables, the trouble makers, and misc. whippersnappers.

I know it will not affect me and people like me, because implemented rules will ensure that.

My parents lived in a society you seem to yearn for. Hard pass.

</comment></comment></comment><comment><USER15> NSA: Yeah, their spyware install totally broke our spyware install!!1!

Joking, but I honestly wonder- If the software is compiled in California... and the hardware is made in China. You could have two implants in the same gear. Now that's Thinking Green! Twice the government implants in one product.

<comment><USER16> "US says it can prove Huawei has lawful intercept access to mobile-phone networks" would be a better headline.

<comment><USER17> Because Huawei is a global law-enforcement agency and hence can claim lawful interception on all equipment it sells? Doesn't make any sense.

<comment><USER5> Is NSA a global law-enforcement agency? [https://arstechnica.com/tech- policy/2014/05/photos-of-an-nsa...](https://arstechnica.com/tech- policy/2014/05/photos-of-an-nsa-upgrade-factory-show-cisco-router-getting- implant/)

<comment><USER18> Completely depends on the abilities of the military which enforce the rule.

Violence tends to be the way nations define rules outside their own borders.

<comment><USER19> Inside their own borders as well. States are creatures of violence. They are created by violence and require continuous violence to remain in existence.

</comment></comment></comment></comment></comment></comment><comment><USER20> Shouldn't moments like this be death blows?

I had totally thought after Apple and Microsoft were caught working on PRISM Americans and corporations would be doing drastic steps to avoid their communication being intercepted.

But for some reason that never happened.

</comment><comment><USER21> But can they prove it without revealing their own backdoors?

<comment><USER22> Or explaining why they allow those backdoors exist in the first place?

<comment><USER23> This is one of those "if X has access, so does everyone else" and rule makers still don't seem to grasp it.

<comment><USER17> "Because I can log into my sshd, so can everyone else"...? We are not talking about weak crypto here (though AFAIK 5G crypto is designed to be decidedly not E2E), but rather access to the data processed by these systems. There is no particular reason why granting e.g. the NSA access to a stream of CDRs would immediately give others access.

<comment><USER11> I don't think anyone is saying immediately, but these are long-lived fairly static systems.

I'm going to assume that you probably update your server's SSHd at least semi- regularly and that if SSH turns out to be broken 20 years down the line, you will probably be switching to something better either manually or when you eventually replace your hardware and reinstall the OS.

This kind of infrastructure is meant to last for decades. Imagine if the original GSM contained a backdoor with the state-of-the-art crypto of the time. Would it still hold up today? Hell, you don't have to imagine - a mid- range smartphone these days can crack a lot of GSM traffic.

Besides that, there's also the problem that not only are these things usually not done with state-of-the-art tech, but leaks happen all the time and it only takes one mistake* for the privkeys to become known.

</comment></comment></comment></comment></comment><comment><USER24> China's intelligence law requires people or companies to spy when asked.

>"request relevant organs, organisations, and citizens provide necessary support, assistance, and cooperation". According to Article 16, intelligence officials "may enter relevant restricted areas and venues; may learn from and question relevant institutions, organisations, and individuals; and may read or collect relevant files, materials or items"

[https://www.canada.ca/en/security-intelligence- service/corpo...](https://www.canada.ca/en/security-intelligence- service/corporate/publications/china-and-the-age-of-strategic-rivalry/chinas- intelligence-law-and-the-countrys-future-intelligence-competitions.html)

<comment><USER5> Isn't this also pretty much the case with American companies? The only difference is that they need a warrant (which should be pretty easy to get).

Anyway, there is a new bill trying to kill e2ee in America [https://news.ycombinator.com/item?id=22202110](https://news.ycombinator.com/item?id=22202110)

<comment><USER25> Yes and no.

There are some specific carve-outs for telecom companies that their networks must have the ability to tap into specific traffic when a government agency comes knocking with a warrant.

But, as you point out, backdoor-free e2e encryption is not _yet_ illegal, and the US gov't can't force e.g. Apple to put a backdoor in iMessage or in iOS's device encryption.

I expect that this is not the case in China; if the CCP tells a company to do something, anything, to allow them to spy on their users, they do it, or they get destroyed.

Bills like the EARN IT Act scare the hell out of me, but at least there's a process by which it becomes law, and we can affect that process and (hopefully) kill it. That's just not possible in China.

<comment><USER5> > and we can affect that process

In theory, in the same sense that one could influence what CCP does by becoming a member of it and rising through the ranks.

</comment></comment></comment></comment><comment><USER26> Is it Telnet? [https://www.theregister.co.uk/2019/04/30/huawei_enterprise_r...](https://www.theregister.co.uk/2019/04/30/huawei_enterprise_router_backdoor_is_telnet/)

</comment><comment><USER27> I love the delusions here that spy craft is worth more than commerce.

China risks one of their largest companies, knowing they will eventually get caught, over one department in the US just puts out a statement they are 'spying' and everyone believes it without proof.

We don't actually live in a Hollywood movie.

"US officials said they have been aware of Huawei's backdoor access "since observing it in 2009 in early 4G equipment," the Journal wrote."

So the USA admits it's allowed all these counties, many allies, be spied on? Really? We are excepted to believe that?

I'm sure there's a technical 'thing' here. But whether they have fked up on the USA side or the Chine side we can only know from the US actually saying what this is. But then the US might lose it's 'Huawei is spying' attack on Chinese commerce.

</comment><comment><USER28> While we're on the subject, is Signal still the best way for me to communicate privately? I've got all the people I communicate with daily using it now, and I feel relatively confident that the communications are private. Are they?

<comment><USER29> Given their demand to your phone number, along with social graph (phone list and communication targets) I do not trust it to be secure and private.

It's probably secure against phone company snooping. But I wouldn't trust it much past that.

<comment><USER30> Wire.com E2E encryption does not require phone number or social graph. They are also working to standardize the wire protocol via IETF MLS, with cryptographers from multiple companies.

[https://datatracker.ietf.org/wg/mls/about/](https://datatracker.ietf.org/wg/mls/about/)

<comment><USER29> Indeed.

I haven't gotten around to using Wire. But when I've needed secure, private, and semianonymous messaging, I've used Tox.

</comment></comment></comment></comment><comment><USER31> Is that proof "conflicted with NSA backdoor"

</comment><comment><USER32> My guess is the proof the Germans were shown was a plan to tax their cars at 40%.

</comment><comment> awinter-py I don't hate that someone is investing in tools & research in this.

I'd certainly pay a 20% premium on my hardware for verifiable protection from phone-home. I'd probably pay that premium for the manufacturer to _claim_ that the device doesn't phone home.

Obv different situation for infrastructure hardware where the end-user (me) isn't the same as the buyer (german telecoms, apparently). But I suspect some of the verification / testing tools will be similar.

I'm happy these topics are getting press, whoever the players are.

</comment><comment><USER33> Original source.

Will somebody with access to WSJ please corroborate this quote in OP which is attributed to WSJ?

> Telecom-equipment makers who sell products to carriers "are required by law > to build into their hardware ways for authorities to access the networks for > lawful purposes," but they "are also required to build equipment in such a > way that the manufacturer can't get access without the consent of the > network operator," the Journal wrote.

</comment><comment><USER34> A question to Europeans reading this-

If you had to assume that U.S. 5G equipment manufacturers would provide backdoors to U.S. officials, and Chinese 5G equipment manufacturers would provide backdoors to Chinese officials, and Europeans had to use one or the other, which would you choose?

<comment> kube-system The answer is you choose the one which is the closer ally. Which, given the lack of US 5G manufacturers, is exactly the choice the US has already made.

<comment><USER35> The closer ally is likely to have SIGINT sharing agreements with your government.

FVEY exists so that the UK or Canada can legally spy on my communications and turn that data over to my government - which couldn't otherwise get it without warrants and other pesky civil rights protections.

I think I'd rather take my chances with an adversarial government. I know they'd be spying but their ability to act on it is far more limited.

<comment><USER36> Are you American? If so, that is a false statement. DODI 5240.1-R says "[DoD components] Will not participate in or request any person or entity to undertake any activities that are forbidden by E.O. 12333 or this issuance." [1] The NSA, which has the SIGINT authority from EO 12333 [2], is a component of the DoD. A non-DoD entity, such as FBI, Treasury, etc, would (a) not have a foreign intelligence mission and would therefore go through normal court procedures to obtain warrants to collect your communications or (b) would need to coordinate through the executive agency (NSA in the case of SIGINT) to request support for foreign communications, which brings us back to the referenced DOD instruction requiring FISA approval.

1: [https://dodsioo.defense.gov/Portals/46/DoDM%20%205240.01.pdf...](https://dodsioo.defense.gov/Portals/46/DoDM%20%205240.01.pdf?ver=2016-08-11-184834-887)

2: [https://www.archives.gov/federal- register/codification/execu...](https://www.archives.gov/federal- register/codification/executive-order/12333.html)

<comment><USER37> Snowden showed they were sharing nudes of ex-girlfriend in TAO.

How well do you think the FISA warrant process is going in reality?

<comment> kube-system The scenario you mention is an illegal anecdotal failure of the system to work as intended.

If we're still comparing the US and China, I'd say it's working a great deal better than whatever system is currently (not) protecting Uighurs from systematic unjust search and seizure.

<comment><USER38> That it's illegal doesn't mean that we should pretend that it's not happening.

Moreover, there's much more than anecdotal evidence. The recently-released report on the Trump investigation proves this. Even if you hate Trump, there's no getting around the fact that the FBI completely abused the FISA court system, getting warrants by lying and misleading the court. This is a systemic problem.

<comment> kube-system I never said we should pretend it's not happening. I'm saying that even bringing that up as a point of comparison with China is silly.

<comment><USER38> I don't understand how it's relevant to point out that US government actions are illegal. The fact is that it's really happening, so in point of fact, the US is not categorically different from China. The difference, if any, is solely one of degree.

<comment> kube-system It being illegal is relevant because it is _at least_ considered wrong to do. The degree of difference in what is considered acceptable (and also what is happening) between the two is so staggeringly different it isn't even comparable.

<comment><USER38> I will continue to disagree, until you can show me that someone is being punished for the illegal actions, and that further steps are being taken to prevent such transgressions in the future.

Today in America it is _de facto_ legal for law enforcement to do this stuff. The fact that a piece of paper somewhere might say otherwise has no bearing on what's actually happening.

<comment> kube-system > 325 times between 2013 and 2015, cops and employees who misused databases > "were fired, suspended or resigned."

[https://www.computerworld.com/article/3124641/cops-run- unaut...](https://www.computerworld.com/article/3124641/cops-run-unauthorized- searches-on-confidential-databases-for-revenge-stalking.html)

> The act imposes some new limits on the bulk collection of telecommunication > metadata on U.S. citizens by American intelligence agencies

[https://en.wikipedia.org/wiki/USA_Freedom_Act](https://en.wikipedia.org/wiki/USA_Freedom_Act)

And shortly thereafter:

> The National Security Agency (NSA) has formally recommended that the White > House drop the phone surveillance program that collects information about > millions of US phone calls and text messages. The Wall Street Journal > reports that people familiar with the matter say the logistical and legal > burdens of maintaining the program outweigh any intelligence benefits it > brings.

[https://www.engadget.com/2019/04/25/nsa-drop-massive- phone-s...](https://www.engadget.com/2019/04/25/nsa-drop-massive-phone- surveillance-spying)

Sure, the US isn't perfect.

But I'm still very certain that I trust China's approach to data privacy a little less, since they currently do all of the following to happen, without suspicion of a crime:

* mass collection of blood and hair DNA samples for citizens living in minority regions

* literal government occupation of people's homes to take photos and collect information

* installing government cameras inside of peoples homes

* using that information to track, detain, and send ~1 million minorities to re-education camps without being charged or accused of a crime... where they are subjected to forced sterilization and torture.

[https://www.hrw.org/news/2018/05/13/china-visiting- officials...](https://www.hrw.org/news/2018/05/13/china-visiting-officials- occupy-homes-muslim-region)

[https://www.nytimes.com/2018/09/08/world/asia/china- uighur-m...](https://www.nytimes.com/2018/09/08/world/asia/china-uighur- muslim-detention-camp.html)

[https://www.rfa.org/english/news/uyghur/abuse-10302019142433...](https://www.rfa.org/english/news/uyghur/abuse-10302019142433.html)

The institutional attitudes to privacy are simply not comparable to the US. US authorities are not nonchalant enough about privacy that they think anything close to that that is remotely acceptable in the US.

<comment><USER38> You do make some good points there, but ultimately I don't buy it. The key thing is your citation of punishments for cops who "misused databases".

This isn't actually what's at issue here. The existence of law enforcement databases is a very different thing than the facility for spying on communications. And I still see no evidence that anyone has been punished for that, or that any active measures have been taken to protect abuses of _those_ programs.

</comment></comment></comment></comment></comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER39> The US probably does want to reveal the backdoor because its likely they are exploiting it themselves.

If they reveal the backdoor and Huawei closes or replaces it, they'll be locked out

</comment><comment><USER40> 1 thought for all MNOs and their vulnerability management programs:

Most of your infrastructure has multiple interfaces. Bearer. OAM, Backup, etc.

If your vulnerability scanning program only scans Bearer interfaces, you are fucking up. You can spin up vulnerable services on only one interface. If you don't scan ALL interfaces, you don't know all your entry points.

If you work for an MNO and are reading this, you should take action after reading this content.

</comment><comment><USER41> This isn't necessarily about access to the calls themselves. It could be about being about to retrieve network configuration information, call history, maintenance logs, and being able to alter the configuration of the network. The article isn't specific enough.

In other words, do they just want to intercept calls, or steal customer information, or crash the network?

</comment><comment><USER42> Proof or GTFO

</comment><comment><USER43> Let's see that proof. Then we can talk.

</comment><comment><USER44> if the US (a tax payer funded operation) has proof it should simply share it, not posture about it.

</comment><comment><USER45> People will still continue to use Huawei gear unless tangible evidence is presented. The US government has been caught far too many times with its pants down to be trusted.

</comment><comment><USER46> It Would Be Nice(tm) if SS7 was removed from the PSTN... Who needs backdoors into networks when SS7 peers are trusted implicitly.

</comment><comment><USER47> End to end encryption would be a good fix. Oh wait...

</comment><comment><USER48> From yesterday:

How the CIA used Crypto AG encryption devices to spy on countries for decades

[https://news.ycombinator.com/item?id=22297963](https://news.ycombinator.com/item?id=22297963)

</comment><comment><USER49> Wasn't that Apple "goto fail;" technically a zero-day back door as well?

You had to initiate some specific knock sequence to trigger it.

Did they find something like this in their source code?

</comment><comment><USER50> I like to post this whenever huawei backdoor gets mentioned.

RDG is the author of masscan

[https://blog.erratasec.com/2014/03/we-may-have-witnessed- nsa...](https://blog.erratasec.com/2014/03/we-may-have-witnessed-nsa- shotgiant-tao.html)

tl;dr they watched someone login with a huawei tech support account from mainland china.

</comment><comment><USER51> Reminder: US intelligence lies. They are not unique in this but it's worth repeating.

They might be right about Huawei or they might not, either way saying "we totally have proof!" without providing proof is effectively meaningless.

<comment><USER52> If they had proof they would have showed it already. Nothing would help their rhetoric more than cold hard facts.

If they haven't done it, it means: a) there isn't any backdoor, or b) exposing their backdoors would expose their own backdoors.

I'm betting on b.

<comment><USER53> c. They have sources saying as such but have not discovered the backdoor itself.

d. Admitting how they found the backdoor would reveal other issues (a source in the pipeline, or their own backdoor in something Huawei made use of).

And probably e-z too.

<comment><USER54> Yeah exactly - providing proof publicly could in fact burn the sources/methods used to get that proof.

</comment></comment></comment></comment><comment><USER55> Says the new account with a bunch of digits in the name.

<comment><USER56> Assume good faith

</comment></comment><comment><USER57> I'm usually impressed with HN comments, but this thread is currently dominated by insubstantiated conspiratorial mongering against American institutions.

<comment><USER58> The problem is of those institutions own making. Many Americans lost their lives hunting for Saddam's WMDs - something that was fabricated by said institutions.

"Trust us" is no longer something we can blindly accept.

<comment><USER57> To be clear, I was not commenting on skepticism, but on making accusations of lying without evidence.</comment></comment></comment>


We the People do not want to turn our devices off during takeoff/landing - <AUTHOR> https://wwws.whitehouse.gov/petitions#!/petition/allow-airline-passengers-use-electronic-devices-airplane-mode-during-takeoff-and-landing/w0Ffh5fb

<comment><USER2> I would expect the rule is there to cover a lot more than the signals disabled by "airplane mode". For one thing, a tilting plane exerts major force and it moves in ways that passengers may not anticipate; if someone is holding a phone and lets go, the phone becomes a heavy object that can hurt somebody else.</comment>


LivingSocial Is Talking To Bankers About Going Public At A $15 Billion Valuation - <AUTHOR> http://www.businessinsider.com/livingsocial-is-talking-to-bankers-about-going-public-at-a-15-billion-valuation-2011-6?op=1 <comment><USER2> Aren't they like 6 months old? That's a pretty incredible path to public.</comment>


Guardian.co.uk Switching from Java to Scala - <AUTHOR> http://www.infoq.com/articles/guardian_scala

<comment><USER2> Not to knock the wind out of Scala but most of his concerns have been answered in Java EE 6. But then of course Java EE 6 is a little bit new, so he might not know a bunch of stuffs earlier.

Some of the example: regarding their Content API returning JSON/XML, this can be handled by JAX-RS easily. JAX-RS also provides more than JSON and XML (it provides ATOM-XML as well which probably more suitable for better RESTful services).

Spring MVC (the latest version, 3.0) also moving toward Rails-like ActionController.

Both Spring MVC Controller and JAX-RS POJO methods can be annotated to handle routing. As a results: way less XMLs.

JAX-WS 2.0 (pure WebService) is also way easier to create, implement, deploy, and unit-test.

JPA 2.0 probably requires way less XML than Hibernate. You can also use JPA 2.0 with GlassFish and wrap your service (a.k.a EJB 3.1 lite) with Transactional automagically with no extra XML file.

Newer Java APIs/libraries are also exploiting fluent-API practices to make it more DSL-ish (as Martin Fowler decided to move to DSL after his OOP honeymoon, so do his followers).

Don't get me wrong: Java is still verbose. But it's getting a lot way lighter and simpler for web-app development (enterprise or not).

The biggest elephant in the room is the manager types and the old-school Java developers that have had tons of experience with Struts or older frameworks and wouldn't want to change their mindset.

</comment><comment><USER3> The guardian are also moving towards using mongo instead of oracle, there was an interesting talk by Graham Tackley from the guardian about their stack at the recent mongoUK conference in London: [http://skillsmatter.com/podcast/nosql/mongodb-at-the- guardia...](http://skillsmatter.com/podcast/nosql/mongodb-at-the-guardian)

</comment><comment><USER4> If you look SE Radio (Software Engineering Radio) on iTunes podcast, or their own website, there's an episode where they interview the Guardian website developers (it is an award-winning website after all, gets a monstrous number of hits).

<comment><USER5> 284,636,373 pageviews

33,371,947 uniques

per month according to <http://www.guardian.co.uk/advertising/jobs-audience- network>

</comment></comment><comment><USER6> The company I work for uses a Tomcat/Struts/Oracle stack, and I'd love to find something less painful to use, but which is still java based (moving to a different language here would probably meet too much institutional resistance.)

The article mentioned the Play framework. Anyone have any experience with it?

<comment><USER2> It depends on how old-school your company is.

Play Framework, while it is still using Java, breaks the old-tradition of getter/setter. Your peers might resist instantly when they saw that part.

If Play Framework is too extreme for your workplace, I'd suggest to give Spring MVC 3.0 or use the latest Java Servlet 3.0 in JEE6.

Java Servlet 3.0 supports annotations (<http://blogs.sun.com/swchan/entry/servlet_3_0_annotations>) that provides routing capability (might not be as powerful as Rails routing, but still something new and nice to try).

For ORM, either JPA 2.0 (recommended) or Hibernate (Hibernate specific APIs, not Hibernate as JPA 2.0 provider). But as with any ORM: you need to know it well (ActiveRecord is not an exception either).

Additionally, JPA 2.0 provides Level 2 Cache API interface: you can either write your own but conform with the API (the API is very simple) or use the one provided by the JPA provider.

Hibernate (if you use it as the JPA 2.0 provider) supports a variety of L2 caching solutions (SwarmCache, EhCache, OSCache, JBoss Cache, Infinispan, etc). Plug n play baby!

</comment></comment><comment><USER7> Here is a video of a SkillsMatter presentation by GT on the same subject:

[http://skillsmatter.com/podcast/nosql/how-we-mostly-moved- fr...](http://skillsmatter.com/podcast/nosql/how-we-mostly-moved-from-java-to- scala)</comment>


PayPal Select - <AUTHOR> https://www.paypal-special.com/select

<comment><USER2> I was certain this was a phishing site. Only the EV SSL cert made me do a doubletake.

I'm still not sure, and would only open this site incognito with noscript.

Pro-tip: if you run a financial services site with a recognized brand, don't create a new hyphenated domain. Use a subdomain instead.

</comment><comment><USER3> I guess this is an area no one in online payments is really competing in yet on this scale. Given two checkout options Stripe and Paypal if one gave me some mediocre rewards program it might just be enough to tip the scales and make me pick them.

Mediocre might be pre-emptive but it just looks like you'll be fed special offers for stuff you probably wouldn't of bought otherwise. Paypal's history has taught me to expect to be underwhelmed by just about every aspect of their offerings.

</comment><comment><USER4> PayPal confirmed this as a real coupon thing. It's weird that the information in About is so vague and the URL is... well hyphenated.

[https://www.paypal-community.com/t5/About-Protections/Did- an...](https://www.paypal-community.com/t5/About-Protections/Did-anyone-else- get-an-email-about-quot-PayPal-Select-quot-Is-it/td-p/841277)

</comment><comment><USER5> Looks like phishing, but i think is real

</comment><comment><USER6> Phishing attempt?</comment>