PHP 5.3.9 released - <AUTHOR> http://www.php.net/ChangeLog-5.php#5.3.9

<comment><USER2> So. There is a know denial of service issue caused by the specific hashing algorithm that everybody seems to use.

Everybody fixes it by randomizing tables used by said algorithm at initialization time.

PHP "fixes" it by not touching the hash algorithm and adding a max_input_vars configuration setting, thereby reducing the functionality while not really fixing the underlying security issue. This also means that if max_input_vars is set reasonably high (or has to be set as such), an attacker can still do the exact same DOS attack - albeit using more concurrent connections.

I can't even believe that the desire to keep backwards compatibility at all costs is a valid reason for a decision like this: Older versions supported an arbitrary amount of input fields, the current version does not, so this is a clear BC break.

Especially when considering that PHP is getting better with their release process (i.e. not having 100s of failing tests so that the 101st that fails would be missed), I really think this half-assed solution is way too cautious - especially as other projects had the exact same issue and solved it more correctly - without causing (apparent) regressions so far.

PHP could just - again - copy their updated algorithm.

(related discussion on their mailing list: <http://news.php.net/php.internals/57291>)

<comment><USER3> Not endemic to PHP, of course, as it seems MSFT took the same approach with a recent ASP.NET security update. The workaround described in their KB (<http://support.microsoft.com/kb/2661403>) is to add a similar configuration override and they've set the limit arbitrarily at 1000 form keys. Which vendors did not dodge the hash algorithm problem and what's the updated algorithm you're referencing? Who's doing this right?

<comment><USER2> Perl has fixed this (<http://www.perlmonks.org/?node_id=945526> also contains a link to a PDF detailing the issue) in 2003 when it was discussed the first time.

Ruby 1.9 was already randomizing the hashes whereas this current rediscovery of the problem caused them to fix it by randomizing in 1.8 too. Same goes for Python.

The best link to the algorithm I found on a quick search is here [http://www.hardened- php.net/hphp/zend_hash_del_key_or_index_...](http://www.hardened- php.net/hphp/zend_hash_del_key_or_index_vulnerability.html#djbx33a_- _daniel_j._bernstein_times_33_with_addition) \- where the problem was discussed again in 2006.

By randomizing I mean randomizing that value for h for the lifetime you need your hashes to be consistent (until the script ends in PHP)

While you are still vulnerable to attackers who know what that random initial value is, finding that by just randomly trying to create the collisions is impractical and easily detectable.

</comment></comment></comment><comment><USER4> I heavily recommend PHP farm to test your code with a given version of PHP: <http://cweiske.de/tagebuch/Introducing%20phpfarm.htm>

This allows you to have several versions of PHP, each one with a given php.ini, given list of extensions and a given PEAR.

<comment><USER5> If you have open-source projects on github, you should really checkout travis (<http://travis-ci.org/>). Travis is also able to run tests in different php environments and can be hooked into github to tests whenever you commit! :)

</comment></comment><comment><USER6> Argh I just finally compiled 5.3.8 last week - oh well.

 _90 bug fixes, some of which are security related_

Hopefully APC has no issues with it, gave up on eaccelerator.

Interesting they took the time to do the 5.4 backports in there.

</comment><comment><USER7> People still use this shit?

<comment><USER8> Indeed! I have been quite pleasantly surprised lately with the more constructive discussions around PHP related items. The LOLPHP posts have been at a minimum (I don't mind genuine criticism).</comment></comment>


Ask HN: Automating server security/patches - <AUTHOR>

Hello guys,
We run a cluster of servers, mostly ubuntu. Are there automated tools for running security commands/checks/scans that you use on a regular basis to manage and keep your servers updated?
Are there any other specific sites/communities to refer to on these subjects?
Thanks <comment><USER2> Puppet or Cfengine to actually run the updates on the machines. Then you can run a vulnerability checker, such as nessus, to verify that the updates are installed.

</comment><comment><USER3> There is a guide for automatic security updates for Ubuntu: [https://help.ubuntu.com/10.04/serverguide/C/automatic- update...](https://help.ubuntu.com/10.04/serverguide/C/automatic-updates.html)</comment>


The Problem of Induction (1967) - <AUTHOR> http://www.csulb.edu/~cwallis/100/articles/salmon.html <comment><USER2> A bit of background: Hume was an empiricist, he thought that knowledge of the world comes from our experience of the world (i.e. experimentation) along with logical reasoning. But he was also concerned about the relationship between experience and knowledge, that is, why is it that we think some experiences produce knowledge and others do not.

This is where the problem of induction comes from: using the tools that produce knowledge (experience and reason), is it possible to prove-out the required connection between experience and knowledge and if it isn't what do we do?

</comment><comment><USER3> This is a philosophical question about knowledge, what it is, and how we arrive at it OR it's a linguistic question about the meaning of the word 'knowledge' and what it implies.

In summary: It is not possible to determine the cause of an effect when you only know the effect. For instance, the theory of evolution is not certain because we can't go back and check if we are correct in our assumptions. So how can it offer knowledge if we can't prove it's true?

<comment><USER4> One way is to eliminate all other possible options. I'm not quite sure that the evolution example is a good one. We have the opportunity to observe some parts of evolution.

<comment><USER3> That's the silly part of the question. Basically Hume and others are saying that because we don't know every single little piece of information and because there is the possibility, however remote, of an unknown we can't be sure our conclusion is true.

So although we have seen evidence for it time and time again. Even though we have excluded countless of other possibilities Hume would still sit in the back row muttering "there COULD be a different explanation".

Like I said, silly.

<comment><USER5> Yes, there could.

It's not "silly", it's the basis of what separates science from religion. There's no final answer. Everything can be questioned.

It's funny how purported skeptics are so quick to look for eternal truths.

<comment><USER3> Yes, everything can be questioned including this theory. I'm saying that focusing our efforts on all the different ways we could be wrong doesn't really help us move forward. So it would be "silly" to spend our time on that endeavor instead of trying to apply the theory to as many scenarios as possible to see if it works.

But, yeah, maybe using the word "silly" was a bit harsh. I could have written "not productive" instead.

Besides, the article is not a scientific one it's a philosophical one. In science you arrive at a conclusion using theories and observations while in philosophy you arrive at conclusions by theories and consensus.

</comment></comment></comment></comment></comment><comment><USER6> David Deutsch has a compelling (IMHO) defense of Popper in his book "The Fabric of Reality" chapter 7. Recommended reading.

</comment><comment><USER7> Solved here: [http://www.amazon.com/The-Evidence-Senses-Realist- Perception...](http://www.amazon.com/The-Evidence-Senses-Realist- Perception/dp/0807114766/ref=sr_1_1?ie=UTF8&qid=1402518006&sr=8-1&keywords=The+Evidence+of+the+Senses-+by+David+Kelley)

</comment><comment><USER8> An honest question--because I don't know: Has the philosophy of science in its long history produced anything that has proven useful in the practice of science?

I do understand that some people may consider the philosophy of science intrinsically valuable.

<comment><USER9> Yes, absolutely. The modern definition of "proof" and of "true". Logic was considered philosophy in the early 20th century. And the works of Russell, for example, helped define what we see today as a convincing proof. Basically, 120 years ago, math was not as rigorous as it is now (Cauchy is a prime example).

Also, philosophy of science is not necessarily about producing useful stuff for the practice of science, but usually helps better understand the relationship between humans and knowledge. It allows scientists to take a step back and see the big picture before diving back into their practice. As such, it shapes the way we think of and do science, and allows for better questions to be asked, and gives better ways to frame those questions.

<comment><USER10> Aren't those about the philosophy of mathematics, rather than that of science?

At this level, mathematics is a discipline that's entirely unlike science, in that (at least if you believe it's philosophers) science _doesn 't_ prove anything true, it just has a bunch of competing theories some of which get disproved by experiments.

<comment><USER9> It's definitely not just about mathematics. What the scientific community considers acceptable (as in publishable in a good journal) proof has been shaped by the last 100 years of logic practice. Yes, we had rational reasoning before 1900, but it did not look anything like today's "rationality". We used to do piggy-back mathematical models to experiments; now we build from the ground up models and we try to make sure that they match our experiments. This is basically the mindset change that happened in the math community when logicians said that "it's not math if it doesn't start with axioms" (no, I'm not actually quoting anyone).

Also, the second paragraph of my first comment is not about logic.

</comment></comment></comment></comment><comment><USER11> why_i_subscribe_to_pragmatism.pdf

</comment><comment><USER12> Much easier to read if you view the source of the link.</comment>


Ask HN: Any Canadians got a Chrome laptop yet?  Know if they are coming? - <AUTHOR>

Just wondering if any Canadians have received a Chrome laptop, or know if they are even going to make their way to the true north strong and free :)
Thanks,
Kent <comment><USER3> As far as I know, Google is only shipping it within the U.S. Sorry - <USER2> they'll expand, since it seems like a massive pilot (60,000 laptops).

From the T&C: "I understand that Google will only ship the device to a US- based address and cannot send this device to a P.O. Box or address outside of the US." \- <https://services.google.com/fb/forms/cr48advanced/>

</comment><comment><USER4> I am salivating maniacally since the shipping leaks. Only one shipping for my town... and I am the only one that It could be, or so I think... I hope and pray that I am the one they chose. If only I could find out the exact address and not just the Town name!

<comment><USER5> how do you know they are sending one to your town??</comment></comment>


One Way to Keep the Sidewalk Clear: Remote-Controlled Scooter-Bots - <AUTHOR> https://www.citylab.com/transportation/2019/10/self-driving-scooter-tortoise-technology-mobility-sidewalks/600013/ <comment><USER2> When I read the title I was hoping it was a strategy to remove trash, needles, and human waste from the streets of San Francisco. But no, the only problem addressed here is keeping scooters off the sidewalk.

<comment><USER3> I made eye contact with a homeless person pooping again today. This has become a regular part of life in the United States.

Thank god we have a log(n) solution to the epidemic of scooters on streets. Thank you technology. I hope all the Series A investors were able to get that new electric Porsche and didn't have to settle for a Corvette like some filthy commoner.

<comment><USER4> >I made eye contact with a homeless person pooping again today. This has become a regular part of life in the United States.

It's certainly not a regular part of life in the United States. It may be (but probably isn't) a regular part of your own life in the United States.

I've made eye contact with a pooping homeless person in the United States zero times over four decades of life.

</comment></comment></comment><comment><USER5> I applaud this idea, but at the same time I feel like the use cases where this will actually work are pretty limited. I doubt the scooters will be able to cross a street or navigate any kind of actual obstacles, so you're going to be limited to corralling them somewhere on the block that isn't occluded by obstacles. Also, scooters are just an awful target for autonomous movement for the same reasons they're pretty crappy to ride: high center of gravity, small solid wheels, and no real built-in self-balancing features (bikes self-balance to a reasonable degree due to having large wheels acting as gyroscopes).

If you want to get rid of humans for pickup/dropoff and charging, you'd be better off building super drones that can literally pick up scooters wherever they are and drop them on a roving flatbed for charging. Or at least put an IR strobe beacon on them so they're easier to find either by chargers or locating drones.

<comment><USER6> Not that it detracts from your point, but it's a common myth that the gyroscopic effect from the wheels is the main reason bicycles are easy to balance. Take a look at [https://ezramagazine.cornell.edu/SUMMER11/ResearchSpotlight....](https://ezramagazine.cornell.edu/SUMMER11/ResearchSpotlight.html)

</comment></comment><comment><USER7> This is such a laughably dismissible idea, I don't even know where to start: navigating sidewalks and crosswalks autonomously is even more difficult than autonomously navigating the roadways (what with all the standardized signals, markings, rules, etc.) and yet here we are pitching it as if we already have the technology to accomplish this to any useful degree. Is it going to locate and push the correct crosswalk button to make sure it has a chance to cross the street safely and legally? Also, what are these things going to do when drunk (or otherwise unhelpful) passerby inevitably kick them over, rendering them completely immobile? This is 100% innovation theater.

</comment><comment><USER8> Can someone please come up with AI software that generates buzzword-mashing-up startup ideas, gathers investor capital, hires 23 year olds to work 70 hours a week, and turns around and sells it to another tech company for a few million dollars?

</comment><comment><USER9> Another way to keep the sidewalks clear is to not allow them to begin with.

</comment><comment><USER10> I'm sure emusk got some spare falcon 1 they could use to actually retrofit this concept onto standard scooters. /s Shall we remind ourselves the problem we started with here was to transport people? I thing i got lost at the point where sweatshop vc corps backed by surveillance hungry bigtechs flooded an unregulated market with gadgets that now litter the public space. If the form seems to look like a troll, the content is not. Here's some reference on why these are greenwashed gadgets:

[https://iopscience.iop.org/article/10.1088/1748-9326/ab2da8/...](https://iopscience.iop.org/article/10.1088/1748-9326/ab2da8/pdf)

</comment><comment><USER11> Or you know the people using the scooters could park them properly.</comment>


Show HN: JavaScript implementation of Spotify client (Chrome only)  - <AUTHOR> http://spotifyontheweb.com/

<comment><USER2> Why would anyone post their credentials to a site like this? It doesn't matter what the disclaimer says, I've got my credit card connected to my account. Also, the domain name (spotifyontheweb.com) is registered trough privacyprotect.org.

</comment><comment><USER3> this half worked for me on the first attempt, not on the second, I pray to god that spotify pay you lots of money and you go make this official because it would be an awesome addition to spotify

</comment><comment><USER4> What tech does this use that makes it Chrome only?

<comment><USER5> Lack of ogg support would rule out Safari. Not sure what Opera and Firefox are missing.

</comment></comment><comment><USER6> I have Spotify Premium and this works for me. Well done! Also just wrote feedback to Spotify to hire the maker and expand the web-client.

</comment><comment><USER7> Pauses on 'Connecting...'. Chrome 11, OS X 10.6. Spotify premium account. Console log is:

main: stack state changed => keygen

all.js:122session: generating keys

all.js:123session: generated keys

all.js:157main: stack state changed => connecting

all.js:111protocol: connecting to 22.214.171.124

<comment><AUTHOR> Hmm, that's weird. Second attempt also fails? For me it's still working.

</comment></comment><comment><USER8> Can somebody post screenshots etc, for the poor souls that don't have the capacity to try this out?

edit: via @emiel (author's twitter) <http://t.co/qE0s5hm>

</comment><comment><USER9> Very cool, though if I was you, I'd put the "please don't use it for listening" somewhere more prominent and save yourself a lot of money ;)

Streaming is very fast. What are you planning to do next?

</comment><comment><USER10> I'm getting "Internal error message: Socket io error: Error #2031", which I'm guessing is a result of high traffic?

Edit: nevermind, stopped now. Might have been because I had the real client open?

<comment><USER10> Though I do keep getting

"The Spotify Updater is trying to install the update, but didn't succeed

The error message is: The system cannot find the file specified. (2)"

From the actual application? In what way does the app interact to cause this?

<comment><AUTHOR> Sorry, I had some issues with the traffic.. but that's now fixed. Spotify is updating right now, so that might explain the error.

</comment></comment></comment><comment><USER11> > US visitor, no Chrome or no Premium? Screenshot

Thanks, because Canada, Asia, Africa, South America, Antarctica and Australia do not have internet access ;)

</comment><comment><USER12> Since I live in the US, how about some screenshots?

<comment><AUTHOR> Thanks for your interest. Trying to sustain the traffic now, but I'll upload some screenshots ASAP. Concerning look&feel it's close to the original client.

<comment><USER13> which he has probably never seen because he lives in the US :)

Great work though, it would be awesome to have a browser based spotify client!

<comment><USER14> Unless he used a proxy...(picky, sorry, couldn't help it)

</comment></comment></comment></comment><comment><USER15> I just signed up to Spotify premium to try this, excellent work! It would be nice to see Spotify launch an official web based client.

<comment><AUTHOR> Thanks for the kind words!

</comment></comment><comment><USER16> It's a shame this doesn't work for unlimited accounts. You'd have thought they wouldn't mind that, since unlimited has no ads either.

<comment><USER17> It kind of makes sense since the main difference between premium and unlimited accounts is that unlimited cannot play on mobile.

If their API was open for unlimited accounts, anyone could make own mobile clients, bypassing the restriction.

<comment><USER16> Ah, good point! I didn't think about that.

</comment></comment></comment><comment><USER18> "Internal error message: Socket io error: Error #2031"

I have a premium account

<comment><AUTHOR> Sorry, there were some traffic issues. Fixed now!

</comment></comment><comment><USER19> Works wonderfully for me =] will the source be forthcoming?

</comment><comment><USER20> Works very fine for me here from Norway :) Congrats.. :)

</comment><comment><USER21> too bad it doesn't work behind a firewall... real nice work though :)

any idea if there's a way to use ports 80 or 443? I guess we need to ask spotify for that right?

</comment><comment><USER22> If you're looking for work you should let people in without having to provide credentials that they may not have.

(ie. I'm hiring and would like to see this but don't have Spotify credentials)

<comment><USER10> That's pretty hard to do though: providing valid demo Spotify Premium details would be just the sort of breach of TOS that would cause spotify to come down on the site like a tonne of bricks; and non-real Spotify Premium details would be almost entirely pointless (the underlying library requires valid credentials to do anything).

</comment></comment><comment><USER23> how bout having the interface with grooveshark's APIs?

</comment><comment><USER24> For anyone in the UK, I recommend trying we7 (<http://www.we7.com/>) which is a similar service to Spotify and which which already has a web client.

<comment><USER25> It's not really similar at all. This is just another web radio service, whereas on Spotify you can listen whatever you want. Also, the UI is horrendous.

<comment><USER24> That's not correct. We7 isn't just another web radio service. It absolutely is a service where you can listen to whatever you want, with a fairly decent selection of (major label) tracks. The major advantage over Spotify up until now has been the fact that it has a web interface, although I do take your point that the UI is pretty horrendous.</comment></comment></comment>


MongoDB Stale Reads - <AUTHOR> https://www.aphyr.com/posts/322-call-me-maybe-mongodb-stale-reads

<comment><USER2> Previous discussion: [https://news.ycombinator.com/item?id=9417773](https://news.ycombinator.com/item?id=9417773)

</comment><comment><USER3> Yikes! and to think there was a time when MongoDB was even worse than it is now (which is still worse, but better). I just struggle to fathom why anyone uses MongoDB or similar NoSQL databases with similar problems for production purposes. If you want a real database, use one that has been around for a long time. MySQL, Microsoft SQL Server or PostgreSQL are far better choices.

Having said that, I do use MongoDB, but I do not use it in production. MongoDB is great when you're prototyping an application and you do not know how your data will be structured, when you want a database you can store stuff in and test. There are very few situations that require a solution like MongoDB to be used and for those times, there are far better solutions out there.

I hope Stripe are not using MongoDB for anything mission critical (or for anything at all) for that matter.</comment>


USB mouse man in the middle attack to emulate sticky mechanical mouse - <AUTHOR> https://www.youtube.com/watch?v=XACMdu2bcdE

<comment><AUTHOR> Here's a fun prank I made for Sparkfun's April Fools contest. An Arduino Yun acts as a great man in the middle attack on a USB mouse. You can control evil modifications to the mouse (like flipping the axes, buttons, or emulating a sticky mechanical ball mouse) through a webpage the Yun serves on its wifi connection.</comment>


The security hole I found on Amazon.com - <AUTHOR> http://www.onlineaspect.com/2014/06/06/clickjacking-amazon-com/ <comment><USER2> I find it ironic that the wikipedia page on clickjacking [0] lists _exactly this exploit_ as the example, and yet noone has reported it or fixed it in all this time.

[0]: [https://en.wikipedia.org/wiki/Clickjacking#Examples](https://en.wikipedia.org/wiki/Clickjacking#Examples)

Edit: This example was added to the wiki page in December 2009. Relevant link: [https://en.wikipedia.org/w/index.php?title=Clickjacking&oldi...](https://en.wikipedia.org/w/index.php?title=Clickjacking&oldid=334778176#Example)

<comment><AUTHOR> Wow, I hadn't even noticed that.

</comment></comment><comment><USER3> Unfortunately x-frame-options does not always fix these kinds of problems. If you can get the user to click more than once on your page, you can open a tab in the background on the first click (google for popunder.js), and if you can predict click #2 a split second before it happens (e.g. zalewski's game PoC), you can bring the popunder to the front and reposition it right under their cursor.

(note: amazon could fix this by detecting when opener is xdomain and requiring some minimum number of mouseover events in the page before the button is clickable).

<comment><USER4> >zalewski's game PoC

I googled this but found nothing relevant. Do you have a link?

<comment><USER3> [http://lcamtuf.coredump.cx/clickit/](http://lcamtuf.coredump.cx/clickit/)

<comment><USER4> Thanks :)

</comment></comment></comment></comment><comment><USER5> Clickjacking is especially scary because most web apps are probably vulnerable. The default httpd.conf that ships with most package managers doesn't include the X-Frame-Options header. (Perhaps it should.)

Based on my testing, it appears Rails does not add that header either. Do any other frameworks?

<comment><USER6> Rails 4 includes that as a default header[1] and has done since August 2012[2]

[1]: [https://github.com/rails/rails/blob/master/guides/source/sec...](https://github.com/rails/rails/blob/master/guides/source/security.md#default- headers) [2]: [https://github.com/rails/rails/commit/2a290f7f7cdf775491eda0...](https://github.com/rails/rails/commit/2a290f7f7cdf775491eda05b3690be6d96cd9bf6)

<comment><USER5> It appears we're each partially right: If you generated a new Rails app after August 2012, you get the header by default. If you generated the app before August 2012, you do _not_ get the header by default.

So PSA: Updating Rails in an existing app does not cause this header to be added. You must add it yourself in application.rb if it's not already there. See garethadams' footnote #2 above.

</comment></comment></comment><comment><USER7> Hope you got a bounty!

<comment><AUTHOR> Nope. Not even a t-shirt.

<comment><USER8> That sucks. It makes responsible disclosure seem marginally less attractive without any type of reward. I am sure most people would either do it or not, but there's probably some on the fence. And some people might actually start looking knowing there was a legitimate reward.

<comment><USER9> There's a bit of back and forth between intrinsic and extrinsic motivation, where an external reward can reduce intrinsic motivation more than it increases extrinsic motivation. That is, if the reward is known but small, someone could go form, "I'll submit this since I want to help them out," to, "I'm not going to work for below minimum wage!"

[http://en.wikipedia.org/wiki/Motivation#Intrinsic_and_extrin...](http://en.wikipedia.org/wiki/Motivation#Intrinsic_and_extrinsic_motivation)

<comment><USER8> So make it more than minimum wage. Problem solved.

</comment></comment></comment></comment></comment><comment><USER10> Why did it take months for Amazon to fix it?

<comment><AUTHOR> I have no idea. Adding a single HTTP header seems simple to me, but I have no idea what their architecture looks like. It took them an entire month to send me a "thanks, we're working on it" email and that was only after I followed up with them.

<comment> mike-cardwell They probably spent most of the time investigating to make sure that adding the header wasn't going to break anything.

<comment><AUTHOR> Yep, they may have had widgets or legitimate framing that they needed to handle.

</comment></comment></comment></comment><comment><USER11> Blog appears to have some issues:

"Your PHP installation appears to be missing the MySQL extension which is required by WordPress."

<comment><USER12> Gutsy move, posting to HN about a security vulnerability at Amazon. And using WordPress to do it. I'll bet this guy loves playing on cliffs, too.

<comment><USER13> Why? You have a lot of ways to hack a WordPress site?

<comment><USER14> > <azonenberg> wordpress is an unauthenticated remote shell that, as a useful > side feature, also contains a blog

That's an old joke and obviously an exaggeration, but it's not horribly far off. Wordpress instances fall to attack constantly, due to a combination of bugs in the base application itself (not terribly common) and extensions (not just common -- CONSTANT). In terms of breakability, I would rank Wordpress in the top 1% of applications without a second thought.

<comment><USER15> If you believe you're aware of any security issues with WordPress core itself, Automattic is running a Bug Bounty program over on HackerOne here: [https://hackerone.com/automattic/](https://hackerone.com/automattic/) \-- responsible disclosure, bug bounties, and making the web a safer place is awesome.

<comment><USER16> You really think some piddling Automattic bounty is more valuable than a WordPress 0day?!?!?!?!? (Conscious punctuation.)

I'm at a loss for words, scaredy-cat.

<comment><USER17> So you are implying that there are no honest people out there, and on top of that everyone that finds a vulnerability has the guts and resources to make money off a 0day bug?

<comment><USER18> What's so hard in making money off 0days? Especially in this day and age of SilkRoute clones and Cryptocurrencies.

I was under the impression that a big reason why 0day exploits are not popping up all over is because the folks who discover them can now sell them (for way more than any bounty program), whereas earlier the only way to monetize was to use them as advertisement for selling your skills. Instant payment vs Contractual jobs. I'd say now the 0day vulns end up in the hands of professionals (criminal networks/state actors) rather than script kiddies.

<comment><USER19> More than one person can rediscover an exploit. Paying all of them gets expensive

</comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER20> Anyone have a link to a more detailed writeup on exactly how this was implemented?

<comment><AUTHOR> I can post the code. It just doesn't work anymore since they fixed the hole.

Edit: [https://gist.github.com/joshfraser/819308dbae43ff70d892](https://gist.github.com/joshfraser/819308dbae43ff70d892)

<comment><USER21> Please do, it would be interesting to see how it works.

</comment></comment></comment><comment><USER22> Simple solution: all browsers should have 3rd party cookies disabled, including iframes.

<comment><USER23> If the fix was that easy, it would have been implemented by now. Doing so would prevent some useful behavior. For instance, an embeddable Facebook like button needs to run in an iframe and uses facebook.com cookies to be able to associate the like with the user.

<comment><USER24> Funnily enough, I would see that as a good thing rather than a bad thing!

</comment></comment></comment><comment><USER25> "Security hole" is a loud title. Is it worth a blog post at all? meh

<comment><AUTHOR> I'm a big fan of your research. I debated whether to go with a more specific title like "Clickjacking with one click purchases on Amazon" but decided to keep it simple for people unfamiliar with the concept.

<comment><USER25> In fact it _is_ a security issue but IMO you also should have emphasized: 1) amazon sucks at fixing bugs 2) clickjacking can be a serious issue

</comment></comment></comment><comment><USER26> > I resisted the temptation to use the exploit to send myself a million > dollars worth of free Amazon gift cards

Sorry, but that's not how Amazon's "Buy It Now" option works. It sends the item to the default address on file. So it would not be possible for the clickjacker to get it mailed to their own address.

<comment><USER27> Would it be possible to use this to sell items with you as a referral and get paid commission?

<comment><AUTHOR> Yes, but even better, you could list your own products on Amazon and get paid whatever amount you want. Of course, there's no way to stop the email receipts from Amazon, but you might be able to get away with it for short period of time.</comment></comment></comment>


People Are Clamoring to Buy Old Insulin Pumps - <AUTHOR> https://www.theatlantic.com/science/archive/2019/04/looping-created-insulin-pump-underground-market/588091/ <comment><USER2> I've been using this system for ~2 years and it has completely changed my life (not an overstatement).

About 6 months ago I realized that as more and more people found out about this (and Atlantic publishes articles about it...) these pumps were going to be harder to find. I immediately scoured craigslists across the county and spent an inordinate amount of money to buy three of these pumps, because once they break, it's game over.

I can't imagine having to go back to the old way, it actually scares me.

<comment><USER3> Since this is such a mission critical piece of hardware that would severely impair the user if a bug or malfunction developed, how can you completely trust the device will continue to work 99.9% of the time? I really want to recommend this to loved ones but hesitate with the liability of over/underdosing insulin and them not being as tech saavy as the HN crowd...

<comment><USER4> A valid concern, but also humans are guaranteed to make mistakes and I'm sure a high percentage of them, so anything that lowers that error rate is an improvement even if it's not perfect. My thoughts anyway

<comment><USER3> Similar to self driving cars improving car accident death rates over human drivers. Great point.

</comment></comment></comment></comment><comment><USER5> FTR: This is about the purchasing of a hackable insulin pump in order to create an artificial pancreas. Although one exists on the market, its lack of flexibility means users still prefer the hacking technique called "looping", which allows diabetics to select preferred sugar levels and monitoring engines of choice. An organization called TidePool is hoping to have official approved mechanisms working for more flexible artifical pancreases.

</comment><comment><USER6> Side note: Did anyone else find this article difficult to read? Like it was written by an ESL writer? Christ, this is The Atlantic and it reads like it is written by a 7th grader.

Example:

> "To start looping with OpenAPS, Boss did also need to buy a mini computer > called an Edison."

"..Boss did also need..." Why not just say "...Boss also needed...

>"By 2014, the hardware components of a DIY artificial pancreas—a small insulin pump that attaches via thin disposable tubing to the body and a continuous sensor for glucose, or sugar, that slips just under the skin—were available,"

This whole paragraph is confusing. Why put the parens before the "...were available,"?

>but it was impossible to connect the two.

Which two? The the sensor and the tubing? Something else?

>That's where the security flaw came in.

Which fucking security flaw? With the DIY pancreas or the Medtronic?

edit: removed codeblocks

<comment><USER7> If you use code blocks for quotes you can make it more readable by introducing a few extra newlines:

      "By 2014, the hardware components of a DIY artificial
      pancreas—a small insulin pump that attaches via thin
      disposable tubing to the body and a continuous sensor
      for glucose, or sugar, that slips just under the skin—
      were available,"

That should be readable on most devices without needing to scroll left/right.

<comment><USER8> People really need to just stop using code blocks for quotes.

<comment><USER6> So what's the best way to do this? Honest question. I was looking and I didn't find good formatting help doc in less than 5min so I went with code blocks. Sorry haha :)

<comment><USER9> Use > and separate each quote with an empty line

</comment></comment></comment></comment></comment><comment><USER10> As a type 1 diabetic, its kind of refreshing to see all these posts make it to the top of HN. Over the last few months I have seen several related to t1d tech, and others related to the ridiculous pricing of insulin.

Nothing really to say other than that, but that I appreciate all the interest the community shows towards those with chronic illnesses.

</comment><comment><USER11> I used to work for a company well known in the diabetes space that essentially automated the screenshot process Dana Lewis describes but via desktop and a webapp - we had internal protocols from most of the device manufacturers but our sticking point was training clinicians, getting physicians to buy in and dealing with Cerner and Epic (and the FDA which insisted the webapp was a medical device). The tech stack was a bit older than I would have liked. I did try to help some people bitbang their own meters on the sly but I wish I'd heard about this loop stuff before I left for grad school (mid-2014)

</comment><comment><USER12> I looked at the OpenAPS documentation. I had no idea the preferred SoC for this system is the now discontinued Intel Edison. We have boxes of them from an IoT startup I was part of that folded a few years ago.

I see there are references to a SF looping group, but is there one for NYC? I'm happy to donate a lot gen 1/2 Edisons if there are people who need it.

<comment><USER13> Hey, Scott from OpenAPS.org here. That's my email address: if you'd like to get in touch I'd be happy to arrange getting unused Edison's to folks who need them. Or if you'd prefer, my Twitter DMs are open as well.

<comment><USER14> FWIW your address is not in the comment, if you did not remove it I'm guessing HN stripped it out. In that case, you may want to configure your email address in your HN profile instead.

</comment></comment></comment><comment><USER15> > The system also goes straight to an Android phone, eliminating the need for > an extra device such as a RileyLink or an Edison.

I'd almost _want_ an external device to do the calculations.

Imagine being killed by some Android bloatware.

Maybe devs need to start thinking of their apps as being on bio-critical devices.

</comment><comment><USER16> The big innovation here is actually the CGM sensor. Having a sensor on your body that passively gives you information about how your body reacts to food, exercise and medication is amazing. I wrote a post last year on how it TOTALLY changed my life: [https://medium.com/south-park-commons/the-wearable-that- chan...](https://medium.com/south-park-commons/the-wearable-that-changed-my- life-1a5b9bdbab22)

<comment><USER17> Thank you for sharing this post. I enjoyed how similar the feedback loop for your experiments was to optimizing code for performance, and it makes me (someone who doesn't have diabetes) want to try CGM. However, I don't think I can get it through insurance. It costs about $42.99 for a 10-day sample, so maybe I'll try a 10-day sample to play around with it.

</comment></comment><comment><USER18> I presume this is the backstory for [https://news.ycombinator.com/item?id=19763518](https://news.ycombinator.com/item?id=19763518) (which btw was a very engrossing read in hardware reverse engineering)?

<comment><USER19> Yes, the number of pump models that were hackable was extremely small, which made them extremely valuable to anyone looking to do this. The new work on the Omnipod should open this up to many more people who couldn't obtain an older (far out of warranty) pump.

</comment></comment><comment><USER20> Scott Hanselman recently posted about his experiences with the open source artificial pancreas [1]. Interesting that this article would come up so shortly after.

[1] [https://www.hanselman.com/blog/OpenSourceArtificialPancrease...](https://www.hanselman.com/blog/OpenSourceArtificialPancreasesWillBecomeTheNewStandardOfCareForDiabetesIn2019.aspx)

</comment><comment><USER21> The fact that hobbyists can build this but it's not an approved medical device is a flagrant example of how the medical industry is so risk averse as to be allergic to innovation.

<comment><USER22> > the medical industry is so risk averse as to be allergic to innovation.

Is it really risk aversion? Or is it a culture whose first value is profit-by- regulatory-capture?

</comment></comment><comment><USER23> Ben West is cited in an article linked to from the OP article. He was hacking on that pump for the longest time since 2006 when I was living with him, and what do you know, he caused a movement.

Also check out Anthony Di Franco's open insulin project.

</comment><comment><USER24> Why isn't there a country in the world which would allow a wild west of medical innovation?

Then people could fly there for a brief holiday, buy the device, and bring it back to the US legally.

</comment><comment><USER25> Is there an open source insulin pump out there? That seems like it would help the sustainability of this project.

I just texted my older brother to see if he had any of his old insulin pump models. I'd love to build him one since he only has a few years of life left since he's terrible at managing his own sugar levels.

</comment><comment><USER26> This is a classic example of where you have to let people experiment with their own bodies. The risk tolerance lots of people have is way higher than what society is allowed to mandate as the best.

Of course paternalistic people will use the instruments of the state to restrict what we can do for ourselves. We can't just build and share "an unapproved device for managing your insulin" because the FDA will get in the way. But life would be so much better if we had the freedom to do that.

Unfortunately, the real problem is that there are a bunch of idiots who don't know how to take risks. They expect things to always work and they team up with the people who want to protect the idiots and oppress those of us who are willing to take a little risk for some reward.

</comment><comment><USER27> I would love to see more of an open source movement in medical technology. That would be such a great way to reduce costs and make healthcare more accessible.

Who knows what could be accomplished if we just had root access to more of our technology.

<comment><USER28> Liability is a huge issue. Lots of sociopolitical changes need to take place first.

</comment></comment><comment><USER29> I'm fortunate to have a new pump that is a closed loop (the Medtronic Minimed 670g) and it has been a game changer for me.

</comment><comment><USER30> Wow OpenAPS is on github [https://github.com/openaps/openaps](https://github.com/openaps/openaps) and written in Python!

</comment><comment><USER31> I've seen a fair number of diabetes related articles over the years that posit, for example, connections between diabetes and inflammation plus connections between insulin resistance and low protein.

I wish we would focus more on developing a better mental model for the processes involved in developing diabetes and find some way to effectively address those and prevent or reverse diabetes, at least in some cases.

But we aren't likely to because there isn't enough cool factor or profit motive. It makes me crazy.

<comment><USER32> Eating too much and the "wrong" things proved valuable over our long trek of survival. The compulsion to eat calorie heavy foods and to over-eat, because we can, is fundamental to the animal part of us. People have a lot of conditioning as well on top of that. The solution isn't as simple as making a better mental model. You basically need people to allow themselves to be hungry and be okay with it. Like having a chain smoker stop cold turkey. It doesn't really work for any meaningful percentage of people. [https://www.reddit.com/r/WatchPeopleDieInside/comments/biche...](https://www.reddit.com/r/WatchPeopleDieInside/comments/biche1/do_you_look_like_youre_malnourished/?depth=2)

<comment><USER31> This research contradicts the idea that overeating is the issue:

[https://news.ycombinator.com/item?id=8748147](https://news.ycombinator.com/item?id=8748147)

The existence of Cystic Fibrosis Related Diabetes (CFRD) in a population where about 90% of patients are quite underweight also contradicts the "fat" hypothesis.

</comment></comment></comment><comment><USER33> Surely they can be reversed engineered and some manufacturer can make them on the cheap or am I missing something ????.

<comment><USER34> You can manufacturer anything but you will not be able to commercialize it without getting approval (e.g. FDA approval in the US or CE marking in Europe)

Anything that qualifies as a 'medical device' has a plethora of processes and documentation that must be delivered to the regulatory bodies for that specific country or region.

</comment></comment><comment><USER35> Beta Bionics and others are trying to solve this issue. An automated pancreas. FDA process is slow & expensive though.

</comment><comment><USER36> At this point what stopping those people from going the full DIY path and building their own insulin pump ? In those days of 3D printers and cheap electronics this seems like it should be achievable (I'm probably in full Dunning-Kruger mode here please forgive me). Or even gut one modern commercial unit to get the fluid part but replace the electronics with something more automation-friendly.

<comment><USER37> Would you trust it with your life?

</comment></comment><comment><USER38> The remedy for this insane injustice is to eliminate the FDA's monopoly on medical regulation and allow the non-fraudulent production and sale of medical devices and drugs to consenting adults. No single group has ultimate authority on what constitutes efficacy and the appropriate amount of risk. So long as they are not violating our consent by lying about their regulatory process, no group has a right to conclude for us what we choose to use and consume to better our health.

Until the point that we are free to think for ourselves, we are all subject to the fumbling incompetence and cynical malfeasance of the regulatory cartel. The FDA's mandate is morally equivalent to the mandate present on every street corner in every hood in America: "Nobody but me and my gang sells drugs on my block." Hence nobody is surprised when their cocaine is laced with baking soda and sold at 5000% profit margins. Multiply this across all of medicine and it becomes clear why medicine in America is a schlerotic disaster. Meanwhile the political parties are only divided on whether or not the taxpayer should foot the bill...

<comment><USER39> How many people know enough to "think for themselves" in this area? How many are going to know anything beyond what the manufacturers' advertisements say?

> Until the point that we are free to think for ourselves, we are all subject > to the fumbling incompetence and cynical malfeasance of the regulatory > cartel.

I've worked for FDA-regulated medical device manufacturers twice. I didn't _enjoy_ the experience, and no one would call them efficient, but they do not deserve the venom you are pouring on them.

> The FDA's mandate is morally equivalent to the mandate present on every > street corner in every hood in America: "Nobody but me and my gang sells > drugs on my block."

You rather badly need to re-calibrate your moral compass. Their mandate is "Nobody gets to poison people on my block. Nobody gets to create junk devices that kill people on my block." That is in no way morally equivalent to a gang of drug dealers.

<comment><USER38> > How many people know enough to "think for themselves" in this area? How many > are going to know anything beyond what the manufacturers' advertisements > say?

For one thing, the fact that other people might not be competent enough to think for themselves is not a justification for banning those who are from doing so. For another, I agree that we need regulatory bodies to ensure our medicine is safe and effective -- just that every individual has a right to decide for themselves which regulatory body to give authority to. Science is premised on the providing logic and evidence for one's claims; a scientific regulatory body would provide logic and evidence for why we should trust their judgement. Using threats (legislative or otherwise) to force everybody in the country to trust their judgements is anti-science -- "because I fucking said so" is not a replacement for logic and evidence.

Additionally, as I stated, the standard I'm proposing includes a justified use of force for those defrauding others via false advertising claims. If it can be transparently proven that such claims are unjustified or need further qualification, then providers can rightfully be forced to change their advertising.

> I've worked for FDA-regulated medical device manufacturers twice. I didn't > enjoy the experience, and no one would call them efficient, but they do not > deserve the venom you are pouring on them.

I'm speaking in broad generalities, of course in any enforced institution there will be good and bad actors, and the whole spectrum in between. What I'm railing against is the corrupt political system that allows this sort of tyranny to stifle human freedom without answering probing philosophical questions such as "why am I not allowed to disagree with your determinations?"

> You rather badly need to re-calibrate your moral compass. Their mandate is > "Nobody gets to poison people on my block. Nobody gets to create junk > devices that kill people on my block." That is in no way morally equivalent > to a gang of drug dealers.

I've already qualified my position that such criminals should be held accountable in the court of law, and in this comment qualified it further in stating that it is reasonable to set up regulatory institutions with processes to ensure safety; they simply can't justifiably be enforced.

<comment><USER40> > For one thing, the fact that other people might not be competent enough to > think for themselves is not a justification for banning those who are from > doing so.

Who is banning anyone from doing their own research or thinking? Not the FDA, as near as I can tell.

</comment></comment></comment></comment><comment><USER41> While the FDA has gotten slightly better in recent years it still suffers from a lack of consumer feedback. They need to be willing to embrace a "move fast and break things" approach with highly-informed consenting patients. They're afraid of another thalidomide but they're willing to let an unlimited number of people die so long as it was disease and not treatment that killed them, which is such utter cowardice.

<comment><USER27> I don't trust the "move fast and break things" approach with for-profit healthcare.

With open source stuff like this, it works because nobody is pushing this tech for any reason other than it works. But if commercial products were able to move at this rate, we might see a lot of snake oil because companies can be pretty effective at producing misinformation.

This isn't a critique of commercialized healthcare because I think it works, but you do certainly need regulation for it to continue to work

<comment><USER41> This snake oil market already exists. Supplements. Cupping. Ear candling. Everything sold by Goop. Essential oils. The market exists and it's already killing people like the toxic baby food from a couple years ago.

<comment><AUTHOR> The difference is that Goop-care, by and large, doesn't really do anything, and the iatrogenic problems are mostly second-order (like, you might get an infection by putting something they recommend --- excuse me for saying this --- up your butt). An artificial pancreas is a very serious, active medical intervention. It has to work, reliably; you can't just hope it will help and that all its bases are covered.

<comment><USER42> > ... doesn't really do anything

It allows the gullible to avoid seeking real medical care by propping up delusional notions about how to treat an illness.

<comment><USER43> Not just the gullible, but the desperate, too.

There's another class of people that fall for this stuff, and I am not sure what label (if any) could apply, but I think of people like Steve Jobs.

Arguably, his diagnoses was essentially a death sentence, because few live long from what he had. That said, I don't think he was necessarily gullible. Desperate? Maybe - who wouldn't be? But he had immense resources at hand, but squandered them on treatments known for being snake oil at best.

Maybe fearful would be proper - perhaps coupled with desperation - leading to easier to take, but less effective (where "less" could equal or be very, very close to zero) treatments, vs the conventional ones?

I could see that, and emphasize on that choice as well.</comment></comment></comment></comment></comment></comment>


When Villains Aren't Super - <AUTHOR> https://extranewsfeed.com/when-villains-arent-super-f5646d81db6#.3djjasx9n <comment><USER2> I think the author makes one mistake that unravels the entire piece - the US has 3 branches of government, and even if it ignores federal limits, it's hard to fire judges and congress.

These checks and balances are built into the legal foundation of our country, and are extremely hard to undo. So while any given president may be able to get his way for a while (FDR being the best example), the idea that Trump or anyone else being able to turn this country into a dictatorship really cannot be taken seriously.

Throw the country into a constitutional crises or put us on the verge of revolution/civil war? Plausible. But to get to dictatorship without going through all that? Hard to even comprehend.</comment>


iOS 13 now shows you a map of where apps have been tracking you - <AUTHOR> https://9to5mac.com/2019/06/08/ios-13-location-permissions/ <comment><USER3> Fantastic. It is the asymmetry in information collection that is so frustrating as a consumer. In an _ideal_ marketplace, information flows freely, and informed choices make the market move towards efficient transactions. When no consumers know what information is being collected or how it's used, and it's value is obfuscated, then deep rifts in expectations can emerge.

We need more of this sunlight in order to make good decisions about how we generate and share information about our lives.

<comment><USER4> With trust, trade is unlimited.

That said, we should be able to say NO - and this includes apple. For instance, why should we have to identify ourselves to apple?

<comment><USER5> AFAIK, you don't. An iPhone will work fine without signing in to any Apple service and you can opt out of all Apple data collection right in the device.

I've set up several testing iDevices for work with no Apple accounts.

The only thing you can't do without an Apple account is to use the Apple services like the App Store and iCloud and other paid services.

I think even software updates can be done without an account, but I'm not sure since I haven't tried this.

<comment><USER6> What good is an iPhone without access to the App Store?

<comment><USER7> People bought lots of iPhones before the App Store existed. Before Cydia even existed. They were pretty good. You could send SMS messages, browse the web, take photos, and play it like an iPod even.

<comment><USER8> FWIW, before Cydia there was Installer, and before that something whose name I am not quite remembering (and don't care to look up rocky now)... and I am pretty sure it was running on over 50% of all those original iPhones, as people really found it strange to have a cell phone without even a single game (even Nokia candy bar phones had Snake). (But yeah: at least some people clearly still wanted the device. But that was in a world where there wasn't tempting reason to as everything was accessible with a web browser. In 2019, that reality no longer exists, and without access to app store on a smartphone there are many many things you are cut off from.)

<comment><USER9> I think with the advent of web apps, the need for native iOS apps will decrease, at least in some areas. Fortunately, this happens to coincide with the advancements in internet speed and coverage.

In a few years: You want to play a game? Fine, let's bing it in Safari and play right there.

"there's an app for that" soon will become "there's a web app for that".

<comment><USER10> That was the original intention for the iPhone, 12 years ago. Developers wailed.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER11> It seems a bit extreme to offer apps one of two extremes: either my sub-metre location or no location at all. It seems the reasonable default for location sharing should be something like sharing the rough suburb that I'm in. This solves most use-cases such as showing closest store locations, delivery options, dating apps showing nearby matches, etc. It's only the occasional navigation app that needs to know exactly where the user is located.

<comment><USER12> I specifically get directions "home" to a neighbor's house a bit away. Once I know where I am, I kill Google Maps. I'm sure they could, if they wanted to badly enough, figure the whole thing out, but at least my profile has a certain amount of uncertainty (though what utility that has is probably debatable).

I would love to be able to fuzz my location within a certain (randomized?) radius of my home for certain apps. Strava has a 'privacy circle' that essentially accomplishes this when sharing GPX tracks of runs around one's home. An OS-level feature would be fantastic in many cases.

<comment><USER13> Have you ever checked [https://www.google.com/maps/timeline?pb](https://www.google.com/maps/timeline?pb) to see? In my case, google knows where my phone is during the night: at home.

<comment><USER14> "No visited places"

<comment><USER15> None that they want to show you. I'm sure they still have the data and use it silently.

<comment><USER16> Based on what data?

<comment><USER13> The wifi and cell towers your phone can see, so even without using GPS. If you enable the location services of google, it keeps a history which is typically within 50 meters, within a few minutes accurate (at least in a city).

What google tracks if you disable location services, I don't know.

</comment></comment></comment></comment></comment></comment></comment><comment><USER17> Good gravy this would be an abysmal report on Android. In my experience many of the free utility apps and games I downloaded required location tracking for no good reason. I'm on iOS for that (and other) reasons.

<comment><USER18> Android also has a terrible issue with not having good options on this front. You have to either not download the video game that needs open access to your contacts or micromanage some sketchy looking app that will help you "block" these sorts of things.

<comment> frosted-flakes You can selectively deny permissible requests after the app is installed, but what irritates me is that granting access to my location allows the app to continually track me while it's running in the background (even if you never open the app). I've heard this will change in a future version of Android.

I discovered this when I was scrolling through the DTEK app on my BlackBerry, which shows every time an app requests sensitive data access, and saw that a bunch of apps that I hadn't opened in a while (like GasBuddy) were accessing my location every 5 minutes.

<comment><USER19> I don't think background location works anymore. My GPS logger I use for cycling gets killed after about 20 minutes if it isn't the currently open app when I turn off the screen.

<comment><USER20> This is not Android thing (yet). Just some vendors, start killing apps in the background. However this is developers nightmare, as they can't deliver consistent experience across all devices. IMO background tracking (with all restrictions, killing...) should be handled directly by AndroidOS, not by vendors. Checkout [https://dontkillmyapp.com](https://dontkillmyapp.com)

<comment><USER19> I'm on a nexus 5x with lineage os. Maybe LOS added something but it tends to be close to vanilla android.

</comment></comment></comment></comment></comment></comment><comment><USER21> I wish I could also give apps "coarse" information about my location. Say down to a mile, or even just the zipcode (5 digits only). I.e. if a news app wants to know what to serve to me, zipcode is quite enough. If I'm looking for pizza on yelp they don't need my exact location. That way on the one hand the apps can function, but on the other they can't really track you accurately enough for it to be terribly privacy-invasive.

</comment><comment><USER22> Is it my idea or Apple is aggressively betting more and more in providing privacy to end users? Also it seems that the other side of the party (Android and free services) is moving fast towards the other end of the spectrum.

</comment><comment><USER23> I am glad I shifted to iPhone a year back and was able to convince my wife to shift too last month. Why people who can afford a price of iPhone buy other brand is beyond my understanding. When apps are not even reviewed by anyone on Android then it certainly puts the user at more risk compared to iOS user.

<comment><USER24> Some people are willing to accept a small amount of risk to be able to do what they want with their device without being restricted to what the manufacturer says is OK.

</comment></comment><comment><USER25> Apple might end up becoming a benevolent king for whoever decides (and can afford) to use its ecosystem.

I'm in favour of that, I wish it will democratize this concept to other companies, although it's unlikely Google will since it's in competition with their core business model.

</comment><comment><USER26> I support Apple trying to turn privacy into a major marketing issue, but I think we've basically already learned that consumers just do not care.

<comment><USER27> Yeah, but what if the marketing isn't for consumers?

What if someone at Apple was smart enough to figure out that the rampant abuses perpetrated by privacy-monetizing Silicon Valley et al. were ultimately time-limited and would blow up eventually?

What if Apple's privacy-focused marketing was aimed at regulators?

<comment><USER28> And/or aimed at people like me, who will then go on to force/nag people around me to use more private/secure alternatives.

<comment> bjelkeman-again Works locally around me. My family isn't using Android for this reason.

</comment></comment></comment></comment><comment><USER29> The whole popup window experience is like Windows Vista.

</comment><comment><USER30> I predict apps will spam location requests to induce decision fatigue on the 'share once' users, who will switch to 'share while using' or 'share always'

<comment><USER31> According to the WWDC video [1], this can't happen. Your app has to test for permission every time you want it, and iOS decides when to show the permission dialog.

Additionally, the 'share always' option goes away. Your app has to earn it, or petition Apple directly for that permission. The 'share while using' is also now temporary, as iOS will periodically ask the user to confirm that this is what they want. iOS does this when the user is not using the app (on the home screen), which is why you must now check to see if you have permission every single time.

[1] [https://developer.apple.com/videos/play/wwdc2019/708/](https://developer.apple.com/videos/play/wwdc2019/708/)

<comment><USER16> That's a pain in the ass. I have a number of apps I explicitly granted background access to. That should be my decision, not Apple's.

</comment></comment></comment><comment><USER32> I've been using the location tracking permission setting from day one. But still, making it more obvious and visible is a win for users who are less aware.

</comment><comment><USER33> I really don't understand how people can simultaneously say that Apple is anti-consumer and then ignore moves like this that not only show that Apple is committed to consumers. It would be so easy for them to gather all this info and sell it to advertisers and third-parties and yet they refuse to.

On top of that, I think it's strangely telling that most of the anti-Apple stories when it comes to the "right to repair" movement all have to misrepresent what Apple is doing or why they're taking the action they are in order to make the story interesting and fit the anti-consumer narrative. We live in a really strange time.

<comment><USER34> I've heard plenty of arguments that don't misrepresent Apple. For example, the iPhone has never had replaceable batteries. Also, they were proven to slow down old phones without telling users why, until it became an ordeal [1].

[1] - [https://news.northeastern.edu/2018/10/26/the-new-iphone- come...](https://news.northeastern.edu/2018/10/26/the-new-iphone-comes-out- today-is-apple-slowing-down-your-old-device-to-make-you-buy-the-new-one/)

<comment><USER35> Please don't spread misinformation. It causes real damage.

Your statement is verifiable misinformation.

I am a customer who was _actually_ experiencing unexpected shutdowns due to voltage spikes on a naturally degraded Li-Ion battery on my iPhone 6s. This is something that happens to _all Li-Ion batteries_. I had experienced this on my previous Android phones too when they got old.

The change Apple made was throttling the voltage from spiking to a point that it can shut down a degraded battery when your phone estimates that it has 50% charge left. Yes, this means older phones with degraded battery health (due to normal wear/tear) would run a bit slower. This is the right thing to do because otherwise it means customers would have phones shutting down unexpectedly when they needed them the most (e.g. calling an Uber, or some other critical function). It's a serious issue that absolutely needed addressing, and I'm glad Apple addressed it (and I hope other manufacturers do too).

The mistake Apple made was not communicating this change more widely or explaining in more detail from the start. But they _did_ communicate it in the change notes of the original update they delivered. They weren't trying to intentionally hide it like you're trying to imply.

<comment><USER34> I made the appropriate edit in my original comment.

edit - Apple did not communicate this information to users from the start...that is not misinformation. When I replied to your comment, your comment originally consisted of just your first sentence.

<comment><USER35> Here's a link to the change-log of iOS 10.2.1 (scroll down a bit) where the throttling feature for degraded batteries was first introduced: [https://support.apple.com/kb/dl1893?locale=en_US](https://support.apple.com/kb/dl1893?locale=en_US)

Every single person that upgraded their phone saw this change-log.

There's a line there that clearly says: "It also improves power management during peak workloads to avoid unexpected shutdowns on iPhone."

If your argument is that it's lacking detail, then fine. But that's an entirely different implication. A much less interesting one.

</comment></comment></comment></comment></comment><comment><USER36> They don't have options like "Never allow" or "Provide fake location". Why is that so?

<comment><USER37> "Never allow" already exists. The user can deny location access when it is first requested, or can disable location access through Settings.

"Provide fake location" is not necessary, because apps which fail to work when you deny location access are rejected during App Store review.

<comment><USER38> Well Pokemon Go basically doesn't work without location and it wasn't rejected.

<comment><USER39> Bad example.

Yes, the core gameplay doesn't work, but the app still allows you to log in, manage your account mess with your existing Pokémon and items, move those Pokémon into Pokémon Let's Go's Go Park on the Nintendo Switch.

If you try to play the core game with location permission permanently disabled, the game will alert the user that the game needs the location permission enabled but it will _NOT_ lock the user out of those other functions.

<comment><USER38> And if I'm a new user and create an account, but forbid location access - <USER2> exactly can I do with the app?

<comment><USER40> Manage your newly created account.

</comment></comment></comment></comment></comment></comment><comment><USER41> Does it show Apple itself? Unlike every other phone platform, iOS does not allow a user to get their GPS location without telling Apple what it was.

[https://support.apple.com/en-us/HT207056](https://support.apple.com/en- us/HT207056)

"By enabling Location Services for your devices, you agree and consent to the transmission, collection, maintenance, processing, and use of your location data and location search queries by Apple and its partners and licensees to provide and improve location-based and road traffic-based products and services."

<comment><USER42> Android has over half a dozen settings that must be disabled before the OS actually stops tracking your location and they are spread out to different menus. This is to say nothing of built-in apps like Google maps that have their own location tracking settings which, if changed, return all of the OS settings to their default activated setting. Manufacturers can have their own location services on top of Android's. Updating Android or firmware means having to find all of the hidden settings again to turn off any that have been reset.

Apple's policy is in no way unique and iOS settings cannot be implicitly overridden by app settings. The global settings are app-specific. I have location settings on and disabled for every app except Apple Maps, other apps still need explicit permission when they try to use my location.

<comment><USER43> There is just one setting for location access which blocks it off for all, including OS services.

Please don't spread dishonest misinformation, there's no need for that.

<comment><USER42> > The Google support page for managing and deleting your Location History says > that once you turn it off, "the places you go are no longer stored. When you > turn off Location History for your Google Account, it's off for all devices > associated with that Google Account." The AP's investigation found that's > not true. In fact, turning off your Location History only stops Google from > creating a timeline of your location that you can view. Some apps will still > track you and store time-stamped location data from your devices.[1]

> Google itself offers at least three support pages on location: Manage or > delete your Location History, Turn location on or off for your Android > device, and Manage location settings for Android apps. None of these makes > any mention of Web & App Activity. [1]

1\. [https://www.wired.com/story/google-location-tracking-turn- of...](https://www.wired.com/story/google-location-tracking-turn-off/)

<comment><USER41> Location history is opt-in. You can get your GPS location without enabling it. With iOS, there is no way to even opt out of sending your location to Apple.

Your article is misleading. The same apps that build a history of your location with Android Location History turned off will build a history of your location on iOS and other platforms. It is not unique to Android. The user is well aware of it — if they search, they get local results, and they know that if they have search history enabled, Google will store everything about their query and interactions with it, including where they performed it. This happens on Android and iOS, regardless of whether the user wants full Location History.

Again though, you're getting off track. We're discussing privacy provided (or in this case, not provided) by the OS, not by the apps the user installs, which are governed by OS permissions exactly the same on both platforms anyway.

<comment><USER42> This directly contradicts your original comment.

> Unlike every other phone platform, iOS does not allow a user to get their > GPS location without telling Apple what it was.

> apps that build a history of your location with Android Location History > turned off will build a history of your location on iOS and other platforms. > It is not unique to Android.

The article that I quoted was to provide background to the comment that you claimed was spreading misinformation. I don't think that anyone in this thread has acted in bad faith and I don't see any benefit to the quality of the conversation in accusing commenters of dishonesty, being sinister or otherwise attacking the individual rather than the issue. I am happy to provide the information that has informed my opinions and I am happy to hear disagreements but a flame war is neither healthy nor helpful. Mobile devices are just tools and neither platform is worthy of this level of personal investment.

<comment><USER41> > This directly contradicts your original comment.

No, it doesn't. Android lets you get your GPS location without telling anybody, including Google. This is the default behavior, even on Google- flavored Android devices. It is _impossible_ to get your GPS location on iOS without telling Apple.

You're confusing Google apps that send location to Google on any platform when the app is configured to send location to Google (like search), with what the OS does regardless of which app is asking for location or whether the app itself sends location data anywhere.

> I don't think that anyone in this thread has acted in bad faith and I don't > see any benefit to the quality of the conversation in accusing commenters of > dishonesty, being sinister or otherwise attacking the individual rather than > the issue.

You're confusing me with sbuk and izacus, who are the only people in this thread who have engaged in the behavior you describe. Please direct your scolding appropriately.</comment></comment></comment></comment></comment></comment></comment>


Tesla now allowing owners to enable cabin camera - <AUTHOR> https://www.tesla.com/support/car-safety-security-features#cabin-camera <comment><AUTHOR> I just noticed this capability in the release notes for 2020.24.6.9. Personally, I'm not too comfortable with this. I might, however, be willing to exchange free Internet or Supercharging in exchange for turning the camera on. I genuinely wonder how many people will enable this voluntarily.

Release notes:

[https://teslascope.com/teslapedia/software/2020.24.6.9](https://teslascope.com/teslapedia/software/2020.24.6.9)</comment>


Show HN: Codenames AI Using Word Embeddings - <AUTHOR> https://github.com/thomasahle/codenames <comment><USER2> Very cool use of word2vec and fun to play with. Thanks for sharing.</comment>


Ex-Joyeur - <AUTHOR> http://dtrace.org/blogs/bmc/2019/07/31/ex-joyeur/ <comment><USER2> I very much enjoy watching Bryan Cantrill on YouTube, always interesting, informative and funny. All the best to him for whatever he does next. As an aside I feel (as in I don't really know I only get an impression) that Solaris with Zones, ZFS and DTrace should have been a much bigger deal than it currently is, in today's Linux and container dominated landscape. Joyent seemed to bet a lot on it, amongst other things. If only Oracle didn't mess everything up.

<comment><USER3> Love his talks too! I wish him all the best on his future endeavours!

Hope he stays active in the Illumos community. Though I could understand it if he has seen enough Solaris for one lifetime.

Curious to see what he will do next. Wouldn't surprise me if he was going to do something with Rust. Maybe a startup with a Rust OS....a unikernel with userland thread support ;-)

<comment><USER4> > unikernel

Hah! [https://www.joyent.com/blog/unikernels-are-unfit-for- product...](https://www.joyent.com/blog/unikernels-are-unfit-for-production)

<comment><USER3> Yeah he has about the same amount of love for userland threads ;-)

</comment></comment></comment></comment><comment><USER5> My money* is on Bryan and Jesse announcing a joint venture. Power to them if they do.

* money == wine & cheese;

<comment><USER6> would love to see that also. Two people that know perfectly how to surf on the social media trendy subjects to market themselves</comment></comment>


51 percent of people believe stormy weather can interfere with cloud computing - <AUTHOR> http://www.citrix.com/English/NE/news/news.asp?newsID=2328309

<comment><USER2> Well wouldn't the 51 percent be right? [http://gigaom.com/cloud/some-of- amazon-web-services-are-down...](http://gigaom.com/cloud/some-of-amazon-web- services-are-down-again/)

<comment><USER3> That's pretty much what I was thinking as well.

Stormy weather == power glitches, power glitches == problems with cloud computing.

</comment></comment><comment><USER4> Come on -- show us the wording of the question, sample size (apparently 1000 people), who was asked, and how they were asked. Otherwise it's another hyped statistic.

> an additional 17 percent have pretended to know what the cloud was during a > first date.

Hopefully also a last date. :)</comment>


How to become a great impostor - <AUTHOR> https://theconversation.com/how-to-become-a-great-impostor-98798 <comment><USER2> I've heard it said that the art of being a great consultant is knowing which book to read just before a meeting with the client

<comment><USER3> This reminds me of a classroom debate from school:

If you, the day before a major surgery, saw your doctor reading through a medical textbook on the topic of your surgery, would you be more or less confident in their abilities?

Some said they wouldn't trust the doctor, as they held some notion that the doctor should just know these by virtue of their being a doctor. That if they don't it is a sign of their ill preparedness and lack of ability.

Others had no such issues, that it is legitimate and good that a doctor would be adequately preparing for the surgery by studying.

If you think of things more towards the former, and you end up as a "last minute, read a book" type, as I tend to be, you might wind up feeling like an imposter.

<comment><USER4> Or you might think that a doctor who does a surgery like this every day, has done so for years, and for whom brushing up would thus be redundant is the doctor you want.

Granted, that requires that it be a reasonably common surgery and that you trust that the doctor gives sufficient consideration to non-surgical treatments instead of pushing patients towards surgery.

Perhaps a decent analogy would be a dentist capping a cavity or doing a root canal. They'll do tens of thousands of these in a career. You don't really want to be the first or even the hundredth patient s/he does this work on. And by the time they've done a thousand, looking it up would be silly.

<comment><USER3> You're inserting things into the question that weren't there and tearing it down. Nothing was said about a "routine performance" which is certainly common enough today to that it is worth asking but is not always the case and not always common through time.

Regardless, it is never a bad thing to be overly cautious and redundant. I once heard it said that if necessity is the mother of invention, redundancy is the mother of victory. That is how I view the question.

<comment><USER5> They're exploring an ambiguity in the question. No need to tear _them_ down.

I feel similarly. If I'm getting a common heart surgery, I'd like to go with someone who does it every day. Reading a textbook is a negative signal that they do this frequently. (A checklist, on the other hand, is not and I'd be happy to see it used).

If I'm getting some rare surgery or there's a complication, then seeing the doctor read a textbook makes sense. They can be very experienced overall, but not in this exact case.

</comment></comment></comment></comment></comment><comment><USER6> At first I thought: there are quite a few impostors at the time, it must have been very easy to fool others without access to more information like what the internet provides today.

Then I got to the part where the author talks about the use of the "six ways to influence people", and I realized those tricks are still used very effectively today. Some success "formulas" come to mind.

It'd be great if the same author could write an article about another fascinating character that I got to learn about from someone that met him in person right before the Japanese poisoned him: Ignaz Trebitsch-Lincoln

</comment><comment><USER7> Ah, the story of Demara. I read about him in the book "The Confidence Game: Why We Fall for It... Every Time" by Maria Konnikova [1]. Recommended read.

My interest isn't so much becoming a great imposter; it is rather how to defend myself and my loved ones against cons. Ie. how to recognize them.

A fiction series about con men which I appreciated is Sneaky Pete [2] and the Spanish series La Casa De Papel (Money Heist) [3]

[1] [https://www.goodreads.com/book/show/25387895-the- confidence-...](https://www.goodreads.com/book/show/25387895-the-confidence- game)

[2] [https://en.wikipedia.org/wiki/Sneaky_Pete](https://en.wikipedia.org/wiki/Sneaky_Pete)

[3] [https://en.wikipedia.org/wiki/Money_Heist](https://en.wikipedia.org/wiki/Money_Heist)

<comment><USER8> In Spain it's a fun meme how most foreign movie titles were translated into spanish, totally changing the meaning or simply destroying the original intent of the name.

You could argue some clever titles are not easy to translate, but God knows there was no need to translate "Die Hard" to "Jungla de cristal" (glass jungle). That practice was more prevalent 10-20 years ago, though.

The thing is that now, for one, it happened the other way around with ehm... "Money Heist" what a boring and uninspired name! :-)

<comment><USER7> Yeah, that happens all the time. I'm Dutch native (hence familiar with Dutch title getting translated), and I refer in my own language to La Casa De Papel with the Spanish title. I only used the English title because people here might recognize or use that term in applications such as Netflix. I understand enough Spanish to understand the Spanish title and I very much prefer native titles over translations but I do like it when behind it an understandable translation is added (even if it isn't perfect).

I keep a log (plain text file, using Vim to edit it) of all movies and series I've seen in my life. The way my log works:

Dutch -> remains Dutch as it is my primary native language.

English -> remains English as I understand it well enough.

All other -> Orig. title (English translation, regardless of how well I speak or understand the language).

If I were to start over I'd do it properly with a CSV database or Excel but yeah I didn't and merging 1500 lines I CBA.

</comment></comment></comment><comment><USER9> Demara reminds me of the 90s show The Pretender, I'm going to assume Demara was the inspiration. That show was lots of fun.

And there was an episode of M.A.S.H clearly inspired by Demara. Someone impersonating a surgeon, getting caught then changing identities to a chaplain.

</comment><comment><USER10> I think the real revelation here is the absurdity of credentialism, and how shallow it is in the end.

</comment><comment><USER11> How does this story feel like to people who are suffering from impostor syndrome?

</comment><comment><USER12> "Since his aim was to do good, anything he did to do it was justified. With Demara the end always justifies the means."

How many times in my life have I done such moral licensing?

</comment><comment><USER13> As the old saying goes "Fake it til you make it". Its always seemed like a dubious idiom to me but when reading stories like this one, there obviously has to be some truth in the efficacy of the proposition.

<comment><USER14> I switched fields between BS and PhD, and a major component was learning the jargon. Perspective, conceptualizations, terminology, idioms, etc. Plus lots of facts, of course.

I've changed fields a few more times, over the years. As my interests and circumstances changed. Most recently, I worked as a ghostwriter and consultant. I used to joke that, given a couple months, I could pose as just about any sort of expert. And given the Internet, that's far easier than it was a couple decades ago.

Anyway, it strikes me that learning how to learn is the main thing that you get out of doing a PhD. Plus the credentials and professional network, of course.

<comment><USER15> > given a couple months, I could pose as just about any sort of expert.

Intriguing, and I wonder whether it's true. Probably in social settings for a while, but hopefully not eg through a job interview.

(related xkcd, "Impostor": [https://www.xkcd.com/451/](https://www.xkcd.com/451/) )

<comment><USER16> >xkcd

I just read the article on Deconstruction and... either I am a complete philosophy/humanitary idiot or that entire area is full of con artists who just spit smart words out their mouth to bring their bread at the table. Regardless of that, I never respected anyone who doesn't use formal definitions in serious analysis. I hated (disrespected) philosophy at school and I do it now even more, seeing how they chew the same crap for decades instead of just doing something better. Even politics is better than that.

"in a classical philosophical opposition we are not dealing with the peaceful coexistence of a vis-a-vis, but rather with a violent hierarchy. One of the two terms governs the other (axiologically, logically, etc.), or has the upper hand": signified over signifier; intelligible over sensible; speech over writing; activity over passivity, etc. The first task of deconstruction would be to find and overturn these oppositions inside a text or a corpus of texts; but the final objective of deconstruction is not to surpass all oppositions, because it is assumed they are structurally necessary to produce sense. The oppositions simply cannot be suspended once and for all. The hierarchy of dual oppositions always reestablishes itself. Deconstruction only points to the necessity of an unending analysis that can make explicit the decisions and arbitrary violence intrinsic to all texts"

"To be effective, deconstruction needs to create new terms, not to synthesize the concepts in opposition, but to mark their difference and eternal interplay. This explains why Derrida always proposes new terms in his deconstruction, not as a free play but as a pure necessity of analysis, to better mark the intervals. Derrida called undecidables—that is, unities of simulacrum—"false" verbal properties (nominal or semantic) that can no longer be included within philosophical (binary) opposition, but which, however, inhabit philosophical oppositions—resisting and organizing it—without ever constituting a third term, without ever leaving room for a solution in the form of Hegelian dialectics (e.g., différance, archi-writing, pharmakon, supplement, hymen, gram, spacing)"

I mean: words instead blanket a low-pitch synthesis and require most priorities in it to shift from a detailed to an increasingly informal scene which wraps by itself to form an atopological plane of understanding of the undecidables. Are you think so?

<comment><USER17> > I never respected anyone who doesn't use formal definitions in serious > analysis.

Read Popper for a hint at how misguided this is outside hard science.

<comment><USER18> Isn't Popper required reading material at every decent university?

<comment><USER17> You'd hope.

<comment><USER16> Which particular book do you recommend, regarding my quote?

I also read what another commenter linked below, but cannot say what all that really means. To formulate clearly, I understand what the text says piece by piece, but fail to get the "correct" sense it was supposed to deliver. Maybe I need some decomposition (sorry if it turns to be a silly joke, couldn't resist ;)

<comment><USER17> Sorry, just saw this. The Open Society and its Enemies is the big winner for Popper imo.

Short answer: it's impossible.

Medium answer: the attempt itself is counterproductive and misunderstands how we use language.

Long answer: aside from being impossible, the impulse is related to Platonic essentialism, which is the philosophical spawning ground of authoritarianism and has stifled honest inquiry for circa 2k years.

</comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER19> Well, he didn't do anything wrong, and even delivered some good things in many of the roles he was in, which is more than can be said about many authentic persons with all proper credentials. I don't know why he was blamed and convicted.

I think there are many other pretenders like him everywhere, less prominent, but still more or less successful and well hidden. As long as you are not using your acting talents for crime, this might work.

<comment><USER20> He committed identity theft, desertion, petty theft, and probably a few more. Those are real crimes with real victims. Not to mention the people that received substandard medical care that could have killed them. Don't gloss over crime just because the guy has a good story.

</comment></comment><comment><USER21> His explanation about why he did it perfectly shows why he was so likable: "Rascality, pure rascality."

</comment><comment><USER22> His main issue was that Instagram was not a thing back then.

<comment><USER23> It could be argued that Instagram is a benefit for impostors as it allows them to present a fake track record/history using their timeline

<comment><USER24> Internet and facial recognition made the world a lot smaller and the past a lot harder to erase. And unsurprisingly the fact that you put something in your social media timeline only has value until something casts suspicion over it.

You don't need a trial to decide that the guy who claims _this and that_ is the same guy from an older article being arrested for faking _this and that_. The suspicion alone is enough to kill the con.

If you see your kid's pediatrician's picture in a police station on the other side of the country, as a con-artist on the run, you will not care that their Instachat account says "world's greatest doctor". And you probably won't even dig too deep before dropping their service.

</comment></comment></comment><comment><USER25> The reliance on documents is interesting. If you are having to ask for proof that someone has passed an exam or obtained a qualification then you have already gone wrong to some extent. Most people never show school or university result certificates ever during their working lives.

Just a name, accent and visual cues are enough if you are white with English as first language. People might ask for paperwork as a formality but the job is going to be yours if recruitment is difficult and there aren't any other applicants. The more specialist the work then the more likely this is to be. In tech this is particularly apparent.</comment>


Ask HN: Do you like reading about startups more than doing one? - <AUTHOR>

I struggled with posting this question. Not so much the question as to whether or not have something here in the text box.
On one side, the question begs to be asked. On the other, I'm thinking it must have been asked in the past. And for maximum effect, it would do best without any commentary.
So what to do?
Have you started your startup, or are you waiting? Will you ever start it?
It begs to be asked.
(Interestingly, these came up in the cursory google search. http://www.paulgraham.com/love.html http://www.paulgraham.com/start.html) <comment><USER2> Reading -> Starting -> Writing

Reading about startups was very important when I was in the learning mode. Then once I started, I stopped reading. Now that I have sold my business, I started writing, hoping that someone else would be reading.

<http://StartupForLess.org>

</comment><comment><USER3> I am in the middle of a pretty product intensive startup right now, and I truly miss the glory days in college where I'd dream with my friends about all the great ideas that we could do.

Reading about startups brings back a lot of those feelings.

So to answer your question. I have started my startup, but I still like reading about startups, sometimes more-so than actually doing my own.

</comment><comment><USER4> It's Saturday morning here in the UK. I can barely see because my eyes are suffering the ill effects of a hard day of coding on my start-up yesterday. I should be in bed. Or I should be outside enjoying the sun. Or giving my wife some attention. Instead, I am damaging my eyes even more, by being here. Yes, I do love reading about startups. More than doing one? Nah. That's a bit like loving women but not doing one...

<comment><USER5> Yes it was, but I am sure in his mind he was deciding between that and "That's a bit like loving women but never being in a relationship with one". Considering his sleep-deprived state, I would let it slide ;)

</comment></comment><comment><USER6> I actually started first and then began to read, kind of counter intuitive but it wasnt on purpose.

Reason is in my circle of friends when i was at uni we didnt talk much of startups. Actually it was unheard of, stable job was the way to go. I had ideas back then but never implemented them cause it was all about the big income in a big company.

If i knew of this world of startups and this whole startup scene i would have probably started about 2 years out of uni cause its dam more exciting and fun plus the payoff for hard/smart work is actually there. I guess everyones path is different and things happen for a reason, main thing is im here now so its all good.

Now its been 5 years out of uni and im almost done with my first startup. Its been about a year in the making. Designing, planning, coding and then reading as i went along. We are about 2 months away (doing final testing) and quite excited and scared at the same time.

If all goes well the i will do more reading (cause i'll need to know alot more) and myself and the team wont be looking back ... full steam ahead.

</comment><comment><USER7> I started my startup. It's more fun than reading about them, although reading about them is fun too.

</comment><comment><USER8> I like reading about startups but I like building things more. I started my first serious attempt a week or so back and aim to get a scrappy release in peoples hands within the next 2~3 weeks. It'll lack a lot, but hopefully it'll give me a foothold to build other things.

</comment><comment><USER9> Before you build an application, you need to learn how to build it.

Starting a startup requires much knowledge, not very much, but reading a lot, can help you avoid mistakes other had made when they started their startup.

Reading intensively can be unuseful, because you'll forget what you have read.

So make a plan, read about the things you planed to do. Don't be shy to ask the community, sometimes you'll get downvoted, but a time you'll get a gold comment, that have important information that may change your startup.

Planning is the most important, not to loose time. Some courage and START!

</comment><comment><USER10> I've started. I've already been self employed for a couple of years. But since it's been as someone selling hours of work for pay, it doesn't count

The past couple of months, I've been working on an actual product. That's my startup. (I hope to have a minimal feature set version ready for launch this summer.)

Reading about this stuff leads to ideas for doing it though.

</comment><comment><USER11> I was like that and now, I don't read as much anymore. A lot of them are pretty much the same anyway.

I'm working on my startup but been very scared of putting it out to the public. (Well, I hope that is going to change soon.)

That's another obstacle to hurdle. You work on it but releasing it is a different thing.

</comment><comment><USER12> I'm 17 and hoping that I don't make the mistakes that others did and reinvent the wheel. So, currently, reading lots.

</comment><comment><USER13> Its hard for me to work on mine. Too busy helping build other people's startups. Fortunately it looks like this year maybe the last year I do contracting and switch to full-time startup mode.

</comment><comment><USER14> Expose oneself to varying degrees of ideas, problems, and solutions. Read to question. Mistakes are important for progress, all the planning in world isn't going to help. Get your hands dirty, work on a project that matters to self no matter how small or unimportant it may be to the outside world.

</comment><comment><USER15> I am generally not interested in startups. I come to hacker news for the interesting articles and the high quality of the comments generated by the intelligent and diverse community here.

</comment><comment><AUTHOR> For my own situation, I've not started one. It's still a dream, but one I've kept on the wayside by working for startups as opposed to having my own.

</comment><comment><USER16> In some capacity, yes, because I spend most of my time reading and researching instead of getting down with the nitty-gritty. On the other hand, I don't have an idea I want to implement.

I currently have a Bulgarian programmer making me a Flash game. But I'd rather have something I could devote myself to for 10+ hrs/day.</comment>


The Real Cost of Filling Up: Gasoline Prices by Country - <AUTHOR> http://www.bloomberg.com/visual-data/gas-prices/ <comment><USER2> Apparently gas in Venezuela is absurdly cheap. Good to know.</comment>